Reed Smith Client Alerts

Outside counsel can play a number of meaningful roles in post-data breach investigations, including providing insight and advice subject to the attorney-client privilege. However, parties must be mindful of how much they share about internal investigations to avoid waiving the privilege. In a recent opinion, the U.S. Court of Appeals for the Sixth Circuit ruled that a data breach defendant waived its attorney-client privilege for investigation-related communications with counsel after disclosing investigative findings in discovery requests and relying on the findings to assert an affirmative defense.

It’s wise to get attorneys involved as soon as possible following a data breach, but as a recent Sixth Circuit decision indicates, companies and their counsel need to be mindful of how they use investigative findings to avoid waiving the attorney-client privilege. The decision in In re: United Shore Financial Services, LLC, No. 17-2290 (6th Cir. Jan. 3, 2018) demonstrates the perils of using the privilege as a sword and shield, as ultimately the appeals court found United Shore Financial Services, LLC’s (“United Shore”) disclosure of investigative findings and apparent reliance on those findings to assert an affirmative defense resulted in a waiver of privilege as to “all communications involving the same subject matter.”