Introduction
In the wake of the Enron scandal, Congress passed the Sarbanes-Oxley Act of 2002. Claiming authority thereunder, the SEC promulgated rules to allow attorneys to report known securities violations to the SEC, even if doing so would breach attorney-client privilege. Since 2002, the SEC has asserted that those rules present no ethical problem because they preempt state privilege law. After the Financial Crisis of 2007–08, Congress passed the Dodd-Frank Act of 2010. Exercising authority thereunder, the SEC created a whistleblower program that awards lucrative bounties to providers of tips that lead to successful enforcement actions. Seemingly in excess of delegated authority, the SEC permits bounties to be awarded for information that is privileged under state law.
The SEC’s purported preemption immediately drew the ire of attorneys and state bar associations after the enactment of the Sarbanes-Oxley Act on the ground that the SEC purported to allow disclosure of client information where state privilege laws and attorney ethics rules prohibited it. Similar criticism resurfaced with the establishment of the whistleblower bounty program nearly ten years later. As I have argued in previous work, these critiques have substantial merit, and the SEC’s purported preemption lacks statutory authorization. Yet, between these brief flurries of protest, and in the last decade, there has been no serious legal challenge to the SEC’s rules that allow attorneys to collect bounties, without repercussion, for information that is confidential or privileged under state law. Why not?
In this article, I posit that one potential reason for the dearth of legal challenges to the SEC’s preemption rule is the difficulty of establishing standing for such a lawsuit. To establish standing under Article III, litigants must show a concrete “injury in fact” that the challenged action caused and that is redressable by the relief requested in the lawsuit. Pragmatically, demonstrating injury by a whistleblower who disclosed privileged information and showing that a court’s ruling could redress that injury requires the plaintiff to know the identity of the whistleblower. But the SEC guards the identities of its whistleblowers with intensely protective confidentiality rules. When an SEC investigation is initiated against a company, it is often impossible to tell whether it was prompted by a tip and whether the tip consisted of privileged information.
In this article, I examine the legal and pragmatic obstacles to bringing a lawsuit challenging the SEC’s purported preemption of attorney privilege and confidentiality rules, and I investigate creative solutions to establish standing for such a lawsuit.
I. Background
The SEC’s attorney-conduct rules arose from the Enron scandal, when the collapse of gatekeeper accountability was at the forefront of the public mind. The resulting Sarbanes-Oxley Act required the SEC to create standards of conduct for attorneys practicing before it; accordingly, the SEC promulgated attorney-conduct rules codified as “Part 205.” Part 205 requires attorneys to report securities violations “up the chain of command” within a company. Because the company itself is the client, such an up-the-ladder reporting requirement leaves intact the attorney-client privilege and any rules regarding attorney confidentiality. However, the rules also allow attorneys to report violations directly to the SEC if they believe it reasonably necessary:
To prevent the issuer from committing a material violation that is likely to cause substantial injury to the financial interest or property of the issuer or investors; …
To prevent the issuer, in a Commission investigation or administrative proceeding from committing perjury … , suborning perjury … or committing any act … that is likely to perpetrate a fraud upon the Commission; or …
To rectify the consequences of a material violation by the issuer that caused, or may cause, substantial injury to the financial interest or property of the issuer or investors in the furtherance of which the attorney’s services were used.
As detailed in previous work, these conditions conflict with the requirements of several states regarding attorney conduct. For instance, California bars disclosure unless “the lawyer reasonably believes the disclosure is necessary to prevent a criminal act that the lawyer reasonably believes is likely to result in the death of, or substantial bodily harm to, an individual.” This rule prohibits reporting a securities violation that does not constitute a crime likely to cause peril to life or limb, and it does not permit disclosure except to prevent future harm. Similarly, in New York, attorneys may only reveal confidential client information to the extent “reasonably necessary” to “prevent reasonably certain death or substantial bodily harm [or] to prevent the client from committing a crime.” To alleviate the dilemma that attorneys may wish to report misconduct to the SEC but risk discipline for violation of state privilege law or confidentiality rules, Part 205 states that, “[w]here the standards of a state or other United States jurisdiction where an attorney is admitted or practices conflict with this part, this part shall govern.” In other work, I argue that this preemption rests on shaky ground.
Exacerbating the conflict are SEC incentives for breaching client confidences. In the Dodd-Frank Act, Congress charged the SEC with establishing a regime to “pay [an] award[] to [an] eligible whistleblower[] who voluntarily provides the SEC with original information that leads to a successful enforcement action yielding monetary sanctions of over $1 million.” Eligible whistleblowers may collect a bounty of between 10 and 30 percent of the total monetary sanctions collected. Privileged information is eligible for a bounty when disclosure is “permitted pursuant to [Part] 205.” Accordingly, where Part 205 permits the disclosure of otherwise privileged or confidential information, a bounty may be paid for that information.
II. Possible Paths to Standing
Known instances of attorneys blowing the whistle to the SEC are rare. There appears to be only one case that addresses the validity of the SEC’s preemption of privilege law. This case raises the issue literally as an afterthought. In Wadler v. Bio-Rad Laboratories, Inc., the plaintiff was in-house counsel who had reported up the ladder to the defendant’s audit committee because he believed that the company had not taken reasonable steps to investigate and remedy violations of the Foreign Corrupt Practices Act. Thereafter, he was fired and brought a retaliation claim against the defendant in the Northern District of California. On the eve of trial, after having assured the court that it intended no more dispositive motions, the defendant moved for summary judgment on the ground that virtually all information the plaintiff needed to prove his case was privileged under California law. Chief Magistrate Judge Spero denied the motion on the ground that it was untimely, but he went on to address the merits, ultimately determining that the SEC preempted a state’s ethical rules to the extent they would create an obstacle to the whistleblowing program’s antiretaliation rules.
There is a dearth of direct legal challenges to the SEC’s preemption of privilege law because, at least in part, standing for any such challenge is difficult to establish, and those parties that might be able to establish standing may lack the incentive to do so. Indeed, the context of Wadler—a whistleblowing lawyer pressing an antiretaliation claim—is one of the few vehicles for such a challenge that does not present standing issues. Such cases are evidently rare. Even if they were not, the ability to challenge the SEC’s preemption in such a case is not within the control of the would-be challenger. In the sections below, I assess potential challengers of the SEC preemption provision. I analyze obstacles—legal and practical—that these challengers may face, and I explore theories to overcome those obstacles.
A. Standing of Snitched-Upon Clients to Challenge Preemption
The most obvious challenger of the SEC’s preemption of state privilege laws would be a firm or individual subject to an SEC enforcement action that resulted from a tip by the defendant’s attorney. The equally obvious problem is that, in the absence of voluntary self-disclosure by the whistleblower, the defendant, in many instances, might never know that a whistleblower was responsible for the instigation of an investigation, much less that the whistleblower was a lawyer. The SEC is extraordinarily protective of its whistleblowers. According to the SEC’s Office of the Whistleblower, “Whether or not you seek anonymity, the SEC is committed to protecting your identity to the fullest extent possible.” Although the SEC acknowledges that it may be required to disclose a whistleblower’s identity as part of the discovery process once a judicial or administrative proceeding is underway, the SEC may not even know the whistleblower’s identity if the whistleblower submits the tip anonymously.
Additionally, even if it was clear that a whistleblower prompted the SEC to institute a legal proceeding, the nature of the information could easily be such that the defendant could not know that the whistleblower was a lawyer. Modern internal investigations involve millions of documents and volumes of interview memoranda, often spread across several law firms and shared with various non-lawyer employees and vendors. The content of such documents may be untraceable to any particular lawyer; a tip involving such content could just as easily come from a disgruntled employee. While tips originating from in-house counsel might be easier to trace, a short list of potential leakers becomes much more difficult to compile once sensitive documents are in the hands of outside counsel. To be sure, there are instances where the information revealed by the SEC in an investigation (or even the fact of the investigation itself ) might enable the client to compile a short list of potential leakers or even to positively identify the whistleblower. Lawyers, however, are likely savvy enough to report tips anonymously through a whistleblower attorney, making identification more difficult.
An additional problem is that, even if a defendant knew the identity of the whistleblower, it is plausible that revealing the whistleblower’s identity by suing to enforce the privilege might be interpreted to violate the SEC’s antiretaliation rules. Investigated entities who suspect that an employee blew the whistle may not, under the Dodd-Frank Act, “discharge, demote, suspend, threaten, harass, directly or indirectly, or in any other manner discriminate against, a whistleblower in the terms and conditions of employment.” Similarly, under the Sarbanes-Oxley Act, employers may not “discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee in the terms and conditions of employment because of any lawful act done by the employee.” Whistleblowers have a private right of action for retaliation that can include double backpay. And a client-employer’s attempt to identify the whistleblower can support a freestanding SEC investigation even if the whistleblower’s tips do not. Recommending, as such a lawsuit would imply, that the whistleblowing lawyer be disciplined by the state bar association for violating privilege would likely compound this problem. Moreover, a firm under investigation by the SEC would hardly want to compound its problems with the SEC by treading anywhere even arguably close to this line.
Finally, it is possible that, even if a lawyer-whistleblower were identified and even if that identification did not implicate antiretaliation concerns, a court might find that at least one form of relief—a declaration that the tip was privileged and that the privilege was not preempted by SEC rules—would not redress the plaintiff-client’s injury, thus defeating standing. To meet the redressability prong of Article III standing, a court must find that the plaintiff-client’s injury is likely to be redressed by a favorable decision. If, however, the SEC’s investigation of the plaintiff-client was inevitable, notwithstanding the whistleblower’s tip, standing again would prove problematic.
Accordingly, existing standing requirements may prevent an investigated firm from challenging the SEC’s preemption authority. Below, I sketch an alternative way an investigated—or even a not-yet-investigated—firm might challenge preemption without knowing the identity of the whistleblower: by arguing that uncertainty regarding legal consultation is itself an injury. This approach alters the basis of the alleged “injury in fact.” Rather than claiming injury on the basis that an attorney breached privilege in violation of state law by reporting to the SEC, which purported to preempt discipline under state law for the breach, the firm could claim that its ability to obtain legal advice through counsel was inhibited by the SEC’s rule. In essence, the claim would be, “I cannot consult with my attorney candidly and thus cannot obtain her informed legal advice because I’m afraid that she might, without repercussion, disclose my confidential information to the SEC to seek a bounty, even though state law does not allow her to do so.” The broad applicability of this argument could support standing; it is no counterargument to say that the plaintiff could seek another lawyer, because any attorney in the jurisdiction could, in violation of state privilege rules, disclose to the SEC. Moreover, such an argument would not implicate the antiretaliation concerns at issue where a known whistleblower has made a report. Finally, such an injury is certainly redressable by a ruling that the SEC cannot preempt state privilege law. However, the SEC might argue that the plaintiff-client’s injury is not fairly traceable to the SEC’s unlawful preemption of state privilege laws, as third parties—the lawyer whistleblower—must act in order for the injury to occur.
B. Standing of State Bar Associations to Challenge Preemption
A second group of candidates for challenging the SEC’s purported preemption of state privilege rules consists of bar associations in states where attorney-client privilege rules are incompatible with Part 205. These associations could pursue claims against the SEC on several grounds.
Most intuitively, a state bar association could challenge the SEC’s purported preemption on the basis that it prevents the bar association from disciplining attorneys who violate the state’s privilege rules by reporting confidential information to the SEC without client consent. To determine whether an organization has suffered “injury in fact” sufficient for Article III standing, courts ask whether the act or omission injured the organization’s interest, and whether the organization used resources to counteract that harm. “To satisfy these elements, the challenged conduct must ‘perceptibly impair[ ] the organization’s ability to provide services’ … . It must inhibit the organization’s daily operations, … or ‘ma[k]e the organization’s activities more difficult.’” The SEC’s purported preemption of state privilege rules certainly makes a state bar association’s activities “more difficult” in that it prevents the bar association from disciplining attorneys who violate the rules. However, the difficulty must be “more than simply a setback to the organization’s abstract social interests. The organization must allege that discrete programmatic concerns are being directly and adversely af fected by the challenged action … .” This suggests that a bar association must actually, rather than hypothetically, be prevented from disciplining a faithless attorney. This leads back to the same basic problem stymying lawsuits by clients under SEC investigation: The bar association must be able to identify an existing whistleblower that it would like to discipline.
There may be other approaches. To date, the bar associations of Washington, California, and New York published statements declaring that the disclosures permitted by Part 205 are inconsistent with the privilege law of those jurisdictions, perhaps implying that lawyers electing to blow the whistle on their clients do so at their peril. These bar associations might claim that the resources expended in issuing these statements constitute an “injury in fact” that would have been avoided if the SEC had drawn Part 205 more narrowly and had not purported to preempt state privilege rules that conflict with Part 205. There are two potential obstacles to such an approach. First, “an organization does not suffer an injury in fact where it ‘expend[s] resources to educate its members and others’ unless doing so subjects the organization to ‘operational costs beyond those normally expended.’” Accordingly, these bar associations would have to demonstrate that issuing such statements increased their operational costs.
The second potential obstacle is that it may not be sufficient that the bar association incurred expenses in making such declarations due to the possibility that a lawyer would blow the whistle; expenses incurred to prevent possible injury—not certain, and perhaps not even likely, injury—as a result of the challenged regulation may be insufficient to establish standing. One might analogize to Clapper v. Amnesty International USA, where the Supreme Court held that plaintiffs—a group of attorneys, journalists, and human rights organizations—lacked standing to challenge the Foreign Intelligence Surveillance Act, which permitted warrantless surveillance of international communications. The Court held that costly measures to insure the privacy of such communications did not constitute an injury. The argument that plaintiffs “have standing because they incurred certain costs as a reasonable reaction to a risk of harm is unavailing—because the harm [plaintiffs] seek to avoid is not certainly impending. In other words, [plaintiffs] cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” Accordingly, the argument that state bar associations incurred expenses because of Part 205 might not prevail unless the bar associations can point to instances where lawyers actually breached their professional obligations under state law by blowing the whistle.
However, the holding in Clapper is the result, at least in part, of the great uncertainty of the government’s decision to surveille the plaintiffs’ communications. The harm arising from a whistleblowing lawyer is arguably less attenuated, in that the SEC has already instituted a bounty program and preempted conflicting state rules to incentivize whistleblowing. In this respect, a fitting analogy might be plaintiffs who seek standing in a data breach case on the basis that they expended resources to protect their information following news of the breach, even though their information was not actually misused by the hackers. Courts have arrived at different conclusions about whether such plaintiffs have standing.
C. Standing of States to Challenge Preemption
The last potential group of candidates who might challenge the SEC’s purported preemption of state privilege law is the group of states whose privilege laws are inconsistent with Part 205. Each of these states codified its privilege rules in its state code. These states may be able to sue the SEC to challenge preemption of their privilege laws.
The standing of states to challenge federal preemption is controversial: “Again and again … the legal community has tied itself in knots over questions about when state plaintiffs should have standing to sue in federal court, especially in cases where they seek to sue federal-government defendants.” Loosely speaking, in addition to suing to vindicate the proprietary interests that it would be able to if it were a private citizen, a state may have standing to pursue “sovereign” and “quasi-sovereign” interests in court. The sovereign interests a state may sue to vindicate include, classically, “the maintenance and recognition of borders” and “the power to create and enforce a legal code.” A state may also sue to vindicate a “quasi-sovereign interest in the health and well-being—both physical and economic—of its residents in general … [and] in not being discriminatorily denied its rightful status within the federal system.”
The theory of sovereign standing, at least facially, seems most directly to support a state’s standing to challenge preemption of its laws. Indeed, states have done so in numerous other contexts. For example, Oregon sued to vindicate its Death with Dignity Act, which allowed physicians to prescribe life-ending drugs to terminally ill patients who requested them. The U.S. Attorney General declared that assisted suicide was not a “legitimate medical purpose,” and thus doctors prescribing drugs under the Death with Dignity Act would thereby violate the Controlled Substances Act. The trial court found that “Oregon ha[d] alleged and proved a sufficient injury to its sovereign and legitimate interest in the continued enforceability of its own statutes” to establish standing, as the Attorney General’s declaration “essentially nullified” the Oregon statute. Similarly, Wyoming sued to vindicate a state statute that allowed for the expungement of misdemeanor offenses, such that people convicted of misdemeanors could nonetheless purchase firearms. The Bureau of Alcohol, Tobacco and Firearms (“ATF”) declared that the expungement procedures were insufficient and that individuals whose misdemeanors had been expunged under the state statute could nonetheless be found guilty of unlawful possession of a firearm under federal law. The Tenth Circuit affirmed Wyoming’s standing to challenge the ATF’s action, which “undermine[d the State’s] ability to enforce its legal code.” On the other hand, other recent cases concluded that states lacked standing to challenge enforcement of federal law that conflicted with their own statutes. For instance, Virginia responded to the Affordable Care Act (“ACA”) by passing a state law declaring that no Virginian would be required to acquire or maintain health insurance, relying on this state law when challenging the ACA’s individual mandate in federal court. The Fourth Circuit held that, because the state statute “simply purports to immunize Virginia citizens from federal law …, [it] reflects no exercise of ‘sovereign power.’”
Quasi-sovereign standing may enable a state to sue to defend the interests of its residents, although the contours of the doctrine appear less clear. For instance, in Massachusetts v. EPA, Massachusetts established standing when challenging the Environmental Protection Agency’s decision not to address rising sea levels because, at least in part, its “stake in representing its quasi-sovereign interests,” presumably its citizens’ interests in maintaining sea levels. Whether the state usually must establish citizen standing to obtain quasi-sovereign standing is disputed, but the doctrine allows, at least sometimes, states to sue in parens patrie.
These bases would seem to support the standing of states with attorney-client rules more rigid than Part 205 to challenge the SEC’s preemption of those rules. The exceptions to the attorney-client privilege listed in Part 205 weaken the duties that attorneys owe their clients by certain states’ statutes. The SEC purports to deny the states the power to enforce these duties, thus injuring these states’ “abilit[ies] to enforce [their] legal code[s].” Accordingly, these states should be able to establish a sovereign interest sufficient to challenge preemption. Because the privilege laws of California, New York, Washington, and other states predate Part 205 and actually regulate the lawyers of these states, rather than purporting to immunize them from federal law, such states may have sovereign interests sufficient to establish standing. Even if a state’s declaration of a sovereign interest were to fail, the state might be able to sue based on a quasi-sovereign interest in preventing clients within the state from having their confidential information shared by their state-licensed lawyers, without their consent, with the SEC for a bounty. (Recall that the uncertainty of this outcome might raise other standing problems.) However, the status of states to sue to protect their laws from preemption is controversial and, even if it were not, scarce public resources might make the attorney-client privilege in the SEC whistleblowing context a low priority for such defense.
D. Standing of Snitch for Declaratory Judgment to Uphold Preemption
As emphasized in prior sections of this article, a state bar association or state officials may lack standing to initiate a lawsuit to uphold state rules against an invalid claim of federal preemption. As introduced in this section, however, a state bar association or state officials could defend state rules against an invalid claim of federal preemption if a plaintiff-snitch initiated a lawsuit seeking a declaratory judgment to uphold preemption.
One final approach to achieve a judicial ruling on whether the SEC’s purported preemption of privilege law is valid involves a “sacrificial lamb” of sorts: An attorney who blew, or planned to blow, the whistle on a client in a state where Part 205 conflicts with state privilege law could sue the state bar association or other state officials for a declaratory judgment that Part 205 preempts the applicable state privilege law. Supreme Court precedent permits plaintiffs to seek declaratory judgments establishing preemption. This approach could expose one attorney to all the personal and professional hazards associated with being identified as a whistleblower. However, this would be on a purely voluntary basis, and in view of his or her personal circumstances, a lawyer might nonetheless undertake such a project for the “warm glow” of establishing the right to disclose violations and clarify the law.
E. Summing Up Standing
The careful protection of the identities of SEC whistleblowers, including stringent antiretaliation rules and the right to report anonymously, make the challenge of the SEC’s purported preemption of privilege a difficult feat. It may be difficult for either clients or state bar associations to establish actual injury when they cannot identify the lawyer who reported their secrets or whom they would like to sanction. In the rambling warren of most internal investigations, it may also be difficult for investigated firms to establish that a favorable ruling would redress their injury, because it is difficult to tell whether a whistleblower tip containing privileged information made an investigation inevitable. State bar associations, though they may have incurred real expenses to warn lawyers that blowing the whistle to the SEC may violate their rules, may run aground on the argument that any injury is probabilistic, rather than actual. Although states may sue to enforce their privilege laws, the success of such a project is uncertain, and they may decide that they have better things to do.
More creative solutions may be riskier. Reframing the injury as an inability to consult a lawyer might make the injury too attenuated and could be pragmatically difficult for a firm wishing to avoid SEC scrutiny. Only a lawyer with time, money, and nothing to lose would risk suing preemptively to avoid censure by a state bar association for blowing the whistle. Such methods could work but are likely only to appeal to those whose ultimate interest is proving a point.
III. Conclusion
The SEC’s purported preemption of state privilege and confidentiality rules has endured for twenty years. For the last decade, lawyers may even receive bounties for tips that violate state privilege and confidentiality rules. Despite protest at the time these rules were promulgated, legal challenges to these rules have been rare, in part because challengers don’t know how often attorneys actually violate privilege by blowing the whistle. The same secrecy that shrouds much of the whistleblower program also prevents potential challengers from establishing standing. This article provides an assessment of potential paths to standing, explaining why these rules have remained largely unchallenged for so long. While some creative solutions may be effective for the right plaintiff, such a project is unlikely, and the SEC should embark on reforms voluntarily.
