Last week’s Privilege Point noted a large law firm’s failure to protect its own data breach investigation as privileged or as work product. Wengui v. Clark Hill, PLC, — F.R.D. —, 2021 U.S. Dist. LEXIS 5395 (D.D.C. Jan. 12, 2021). Courts assessing such protections normally first examine what initiated the corporate investigation — applying the “primary purpose” tests mentioned last week.
One “initiation” focus that sometimes dooms a privilege or work product claim is the absence of any lawyers during this initiation phase. If non-lawyer executives exchange unprotected email message traffic about starting an investigation for business purposes or for other non-litigation purposes, it is very difficult for the corporation to ever successfully win either a “primary purpose” privilege or work product argument – the initiation train has left the station by the time lawyers arrived on the scene. And corporations normally must present evidence that their investigation was not mandated, and was different from what the corporation would have done absent its need for legal advice (on the privilege side) or its need to prepare for anticipated litigation (on the work product side). One way to maximize both protections is to conduct successive or parallel investigations — one of which is undertaken in the ordinary course, and a different investigation satisfying one or both primary purpose standards. The paradigmatic example of that expensive and therefore often unrealistic approach involved Target — which conducted two separate investigations into its massive data breach. In re Target Corp. Customer Data Sec. Breach Litig., MDL No. 14-2522 (PAM/JJK), 2015 U.S. Dist. LEXIS 151974 (D. Minn. Oct. 23, 2015).
The Clark Hill law firm did not face these “initiation” hurdles. The preliminary internal communications were of course among lawyers — and the firm also quickly hired another law firm to represent it. But many corporations hamper if not doom later privilege or work product claims by delaying lawyers’ involvement. Management should immediately reach out to lawyers if there is a data breach, or some other worrisome incident. Those lawyers can memorialize and then follow through on the primary purpose standards. Next week’s Privilege Point will focus on the second investigation phase that courts examine: the investigation’s course.