Third-party forensic investigations performed at the direction of counsel are part-and-parcel of virtually every data breach. There has been little case law, however, directly addressing the extent to which the attorney-client privilege and/or work product doctrine protects those forensic investigations from disclosure. Last week, the Central District of California held that, under the specific facts at issue, that information is indeed protected by at least the attorney work product doctrine.
In In re Experian Data Breach Litigation, 15-1592 (C.D. Cal. May 18, 2017), the Court considered plaintiffs’ motion to compel production of the investigation report and other documents created by Experian’s investigator after Experian suffered a data breach (Experian’s outside counsel hired the investigator). Plaintiffs lobbed numerous arguments why the information should not be protected, including, for instance, that Experian (i) hired the privileged investigator to create a privilege shield when it had a preexisting duty to investigate the breach; (ii) plaintiffs could not access the same underlying forensic data relied on by the investigator, thus making the report the only way for plaintiffs to ascertain the reason for the breach; and (iii) Experian waived any protection by sharing the report with a co-defendant. The court rejected these arguments, holding that the report and related materials were created in anticipation of litigation and therefore protected by the attorney work product doctrine. Notably, the Court did not address Experian’s argument that the report was also protected by the attorney-client privilege.
As mentioned above, there is little case law directly addressing the extent to which the attorney-client privilege and/or work product doctrine protects forensic investigations performed in the wake of a data breach. For this reason alone, the Experian decision is important. The decision is also important because it makes clear that plaintiffs are willing to challenge claims of privilege and, for attorneys advising breached companies, highlights the importance of taking all steps necessary to ensure maximum protection of forensic investigations.