September 24, 2021

Volume XI, Number 267

Advertisement

September 24, 2021

Subscribe to Latest Legal News and Analysis

September 23, 2021

Subscribe to Latest Legal News and Analysis

September 22, 2021

Subscribe to Latest Legal News and Analysis

Another Court Deems Forensic Investigation Report Neither Privileged Nor Work Product Protected

A magistrate judge in the US District Court for the Middle District of Pennsylvania recently ordered Rutter’s, a convenience-store chain, to produce an investigative report prepared by a security consultant regarding a suspected data breach event, as well as all communications between the party and the company performing the investigation. In so ruling, the court held that the report and related communications were not protected from disclosure by the work product doctrine or the attorney-client privilege. See In re: Rutter’s Data Sec. Breach Litig., No. 1:20-cv-000382-JEJ-KM (M.D. Pa. July 22, 2021) (ECF No. 95).

In striking the claim of work product protection advanced by Rutter’s counsel, the court’s decision hinged on a few factors. First, the statement of work executed between the retaining law firm and the security consultant described the services with a non-litigation motivation: “The overall purpose of this investigation will be to determine whether unauthorized activity within the Rutter’s systems environment resulted in the compromise of sensitive data, and to determine the scope of such a compromise if it occurred.” Analyzing this statement, the court reasoned “[w]ithout knowing whether or not a data breach had occurred, Defendant cannot be said to have unilaterally believed that litigation would result.” The court also noted that a 30(b)(6) designee of the party testified that he was not anticipating litigation when he signed the agreement for the investigative services, nor was he aware of any other employees anticipating litigation. The court also found instructive the fact that the outside counsel who hired the security consultant was not the entity that paid the consultant—Rutter’s paid the firm directly. And no evidence was presented to show the consultant provided the report to outside counsel for an assessment of legal risk prior to delivering it to Rutter’s. Without showing that the investigation was conducted because of a reasonable anticipation of litigation, Rutter’s could not establish that the work product doctrine protected the report from disclosure.

Further, finding that the investigative report merely set forth the facts of the suspected data breach—as opposed to opinions or proposed tactics in response—the court ruled that the report and related communications with the party opposing disclosure were not protected by the attorney-client privilege. Each element of the description of services was either deemed inherently factual or involved IT personnel working alongside each other with no attorney involvement or input. Thus, the court held Rutter’s could not establish the investigative report, and communications between the consultant and Rutter’s, had the primary purpose of providing or obtaining legal assistance for Rutter’s.

The court’s ruling underscores the need to involve outside legal counsel early, as well as clearly defining the scope and purpose of any data breach investigations in order to protect the fruits of those investigations from disclosure in litigation. Courts are more likely to shield from disclosure documents related to data breach investigations that are spearheaded by outside counsel, expressly designed to assist in actual or reasonably anticipated litigation, involve legal counsel input in the work being conducted by IT personnel, and conducted in parallel with secondary investigations not intended to be used in anticipation of litigation or facilitating legal advice. See, e.g., In re: Target Corporation Customer Data Sec. Breach Litig., 2015 WL 6777384 (D. Minn. Oct. 23, 2015); In re: Capital One Consumer Data Sec. Breach Litig., MDL No. 1:19md2915 (E.D. Va.). Companies wanting to protect such investigations should recognize the importance of engaging outside counsel at the outset of any data breach or other internal investigation, and empowering counsel to exercise consistent control over the direction of the investigation and determine the recipients of any final report. Legal counsel can advise on the necessary steps to try to protect the attorney-client privilege or work product surrounding the investigation, including how to define the scope of the investigation and contemporaneously document the expectation of work protect protection, if applicable.  

Read the opinion here.

Copyright © 2021, Hunton Andrews Kurth LLP. All Rights Reserved.National Law Review, Volume XI, Number 209
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Meghan A. Podolny Attorney Litigation Hunton Andrews Kurth Richmond
Counsel

Meghan’s practice focuses on strategic counseling for clients on information governance and eDiscovery planning for complex commercial, high-profile litigation matters.

Meghan is counsel in the firm’s litigation practice and the head of the Information Governance & eDiscovery Group, which focuses on providing state-of-the-art data management and eDiscovery advice and services to corporate clients across multiple industries. Her experience includes developing and implementing best practice guidelines on enterprise-level information governance...

804-788-8458
Joshua P. Hanbury Attorney Energy Litigation Hunton Andrews Kurth Richmond
Associate

Josh is a creative and solutions-driven litigation associate with a unique talent for managing clients’ needs in complex litigation. In particular, clients from the financial services, environmental, and products manufacturing sectors rely on Josh’s agility and process management skills to guide them through all facets of discovery and ESI governance.

Josh frequently works closely with clients early in a matter to develop and execute discovery plans that best position those clients to develop their cases. Often representing clients in the...

804-788-8517
Advertisement
Advertisement
Advertisement