Protecting Attorney-Client Privilege and Work-Product Doctrine in Internal Investigations

Ensuring that internal investigations remain protected by the privilege faces mounting challenges. Government regulators such as the U.S. Department of Justice (DOJ) and the Securities and Exchange Commission (SEC) have become increasingly aggressive in probing the limits of privileged information, emboldened by several decisions in which courts not only entertain but have actually ordered requests for disclosure of investigative materials in civil discovery. Faced with this shifting landscape, it is now more important than ever for organizations to understand the protective measures they can take to preserve these privileges, safeguarding against future attack.

Two recent cases highlight the risk of disclosure of investigatory materials.

Simultaneous Litigation and Regulatory Action

In July 2019, Capital One disclosed that it experienced a data breach that allegedly compromised the personal data and information of over 100 million people. Capital One immediately faced regulatory scrutiny and a class action. During the class action, plaintiffs learned that Capital One had retained a third-party cybersecurity consulting firm to analyze the July 2019 incident, and sought that firm’s forensic report. Capital One asserted that the firm’s forensic report was protected under the work-product doctrine. The Eastern District of Virginia nevertheless ordered disclosure of the report on the ground that it was not prepared “because of” the threat of litigation, but rather would have been prepared in substantially the same form regardless of the litigation. See In re: Capital One Consumer Data Security Breach Litig., No. 1:19-MD-2915, Dkt. No. 641 (E.D. Va. June 25, 2020). In reaching this conclusion, the court focused on the consulting firm’s pre-existing relationship and fee arrangement with Capital One for substantially similar services and on the broad distribution of the report.

The Blurred Lines of Waiver

In 2013, RPM’s audit committee hired outside counsel to perform an internal investigation of issues related to an accrual, which had become the focus of an SEC investigation. RPM’s outside counsel then shared findings of the investigation with the SEC on the express understanding that there was no waiver. Notwithstanding that agreement, the SEC, in a subsequent enforcement action, sought outside counsel’s investigatory materials, including memoranda of witness interviews, and the D.C. District Court ordered their production. See Sec. and Exchange Comm’n v. RPM Int’l, Inc., No. 1:16-cv-01803-ABJ, Dkt. No. 81 (D.D.C. Feb. 12, 2020). The court found that the internal investigation was conducted because RPM’s auditor would not sign the company’s form 10-K without an investigation and not because of the SEC enforcement action or anticipated litigation. Accordingly, the court held that the investigation was not privileged. Moreover, the court also concluded that RPM had waived any arguable privilege by sharing the contents of interview memos with both its auditor and the SEC.

Preventative Steps to Preserve Protected Material in Investigations and Subsequent Civil Litigation

Companies can mitigate the risk of subsequent disclosure by laying a robust foundation for the attorney-client privilege and work-product protection during an internal investigation. To build that shield, key factors to consider include the following:

• Purpose: It is critical to show that the investigation was conducted for a legal purpose, rather than for business purposes or to satisfy regulatory or contractual obligations. The purpose of the communication and work should be clearly and unequivocally documented.
• Oversight: Supervision of the investigator is vital. Investigations that are undertaken by compliance or internal audit tend to be routine, business, or regulatory-focused events. Conversely, investigations that are conducted or directed by in-house and outside counsel tend to involve higher business risks and greater potential for legal exposure, increasing the likelihood that related communications will be treated as privileged.
• Types of Material: Communications involving third parties, press or marketing materials, public notices, business and technical documents, and communications between only non-lawyers are lightning rods in privilege disputes. If the content is privileged, consider who is involved in preparing or discussing such documents, why they are involved, what they contribute to the materials, when and how the materials are being created, and to whom they are disclosed.
• Prior Disclosure: Any privileged documents previously shared or even summarized with outside parties—auditors, regulators, and enforcement agencies—are particularly susceptible to challenge. This includes providing information in exchange for “cooperation credit” in connection with government investigations. Confidentiality and non-waiver agreements with the government may not be binding against subsequent civil litigants or even a change of heart by the relevant agency.

With recent cases suggesting that the government is challenging the applicability of the privilege to investigatory materials, and courts are backing those attacks, organizations should remain vigilant in establishing and preserving the protections afforded by both the attorney-client communication privilege and work product doctrine during the course of the internal investigation.