Ensuring that internal investigations remain protected by the privilege faces mounting challenges. Government regulators such as the U.S. Department of Justice (DOJ) and the Securities and Exchange Commission (SEC) have become increasingly aggressive in probing the limits of privileged information, emboldened by several decisions in which courts not only entertain but have actually ordered requests for disclosure of investigative materials in civil discovery. Faced with this shifting landscape, it is now more important than ever for organizations to understand the protective measures they can take to preserve these privileges, safeguarding against future attack.
Two recent cases highlight the risk of disclosure of investigatory materials.
Simultaneous Litigation and Regulatory Action
In July 2019, Capital One disclosed that it experienced a data breach that allegedly compromised the personal data and information of over 100 million people. Capital One immediately faced regulatory scrutiny and a class action. During the class action, plaintiffs learned that Capital One had retained a third-party cybersecurity consulting firm to analyze the July 2019 incident, and sought that firm’s forensic report. Capital One asserted that the firm’s forensic report was protected under the work-product doctrine. The Eastern District of Virginia nevertheless ordered disclosure of the report on the ground that it was not prepared “because of” the threat of litigation, but rather would have been prepared in substantially the same form regardless of the litigation. See In re: Capital One Consumer Data Security Breach Litig., No. 1:19-MD-2915, Dkt. No. 641 (E.D. Va. June 25, 2020). In reaching this conclusion, the court focused on the consulting firm’s pre-existing relationship and fee arrangement with Capital One for substantially similar services and on the broad distribution of the report.
The Blurred Lines of Waiver
In 2013, RPM’s audit committee hired outside counsel to perform an internal investigation of issues related to an accrual, which had become the focus of an SEC investigation. RPM’s outside counsel then shared findings of the investigation with the SEC on the express understanding that there was no waiver. Notwithstanding that agreement, the SEC, in a subsequent enforcement action, sought outside counsel’s investigatory materials, including memoranda of witness interviews, and the D.C. District Court ordered their production. See Sec. and Exchange Comm’n v. RPM Int’l, Inc., No. 1:16-cv-01803-ABJ, Dkt. No. 81 (D.D.C. Feb. 12, 2020). The court found that the internal investigation was conducted because RPM’s auditor would not sign the company’s form 10-K without an investigation and not because of the SEC enforcement action or anticipated litigation. Accordingly, the court held that the investigation was not privileged. Moreover, the court also concluded that RPM had waived any arguable privilege by sharing the contents of interview memos with both its auditor and the SEC.