The last three Privilege Points (Part I, Part II and Part III) addressed a large law firm's failure to successfully assert privilege or work product protection for its own internal investigation into its own data breach. Wengui v. Clark Hill, PLC, --- F.R.D. ---, 2021 U.S. Dist. LEXIS 5395 (D.D.C. Jan. 12, 2021).
As in many if not most similar cases, the court examined how Clark Hill used the investigation results. Courts review content and assess circulation. The Clark Hill court pointed to consultant Duff & Phelps's Report's "pages of specific remediation advice." Id. at *17-18. The court bluntly stated that "'[t]he fact that the report was used for a range of non-litigation purposes' reinforces the notion that it cannot be fairly described as prepared in anticipation of litigation." Id. at *12 (citation omitted). And not surprisingly, the wider the circulation, the more the investigation seems primarily business-motivated and ordinary. Widespread internal circulation can seriously weaken both a privilege and a work product claim. One court protected a company's data breach investigation after repeatedly noting that its outside law firm only shared its investigation report with in-house lawyers, not the company's "Incident Response Team." In re Experian Data Breach Litig., SACV 15-01592 AG (DFMx), 2017 U.S. Dist. LEXIS 162891, at *22-23, *25 (C.D. Cal. May 18, 2017). Again looking to the paradigmatic Target case, the Clark Hill court noted that "there is no indication that the Target report was shared as widely for non-legal purposes as the Duff & Phelps Report." 2021 U.S. Dist. LEXIS 5395, at * 17. Along with the Report's remedial-focused content, this circulation assessment led the court to "conclude[] that Clark Hill's true objective was gleaning Duff & Phelps's expertise in cybersecurity, not in 'obtaining legal advice from [its] lawyer.'" Id. at *16 (second alteration in original) (citation omitted).
Clark Hill is the latest in a worrisome series of cases rejecting privilege and work product protection for internal corporate investigations after assessing those investigations': (1) initiation; (2) course; and (3) use. There is a glimmer of good news – corporations and their lawyers generally can assert privilege and work product protection for communications about the investigation and about the investigation results. But these alarming decisions should remind corporations' management and their lawyers that normally someone will have to testify under oath that the investigation report and related documents would not exist in the same form if the corporation had not required legal advice, and/or had not anticipated litigation. The content and circulation pattern of every document created before, during, and after an investigation should support these assertions.
Published May 24, 2021.
