It’s wise to get attorneys involved as soon as possible following a data breach, but as a recent Sixth Circuit decision indicates, companies and their counsel need to be mindful of how they use investigative findings to avoid waiving the attorney-client privilege. The decision in In re: United Shore Financial Services, LLC, No. 17-2290 (6th Cir. Jan. 3, 2018) demonstrates the perils of using the privilege as a sword and shield, as ultimately the appeals court found United Shore Financial Services, LLC’s (“United Shore”) disclosure of investigative findings and apparent reliance on those findings to assert an affirmative defense resulted in a waiver of privilege as to “all communications involving the same subject matter.”
The United Shore litigation arose out of unauthorized intrusions into a database (operated by United Shore’s co-defendant) where United Shore stored potential borrowers’ personal identification information. After discovering the intrusion, United Shore enlisted a third-party consultant to assist in an investigation that produced several conclusions about the breach. In the ensuing data breach litigation, United Shore cited its co-defendant’s acts or failure to act as an affirmative defense. Later, a discovery request asked United Shore to identify “all investigations, notifications and remedial efforts taken in response to any unauthorized use of its accounts.” As part of its response, United Shore referenced the investigation and detailed the consultant’s conclusions, including that the co-defendant’s actions caused the data breach. However, United Shore withheld a substantial amount of documents on the basis of attorney-client privilege because its counsel had commissioned the investigation.
Granting co-defendant’s motion to compel, the U.S. District Court for the Eastern District of Michigan ruled that United Shore could not use the privilege as a sword and a shield. Because United Shore “disclosed the privileged conclusions of [the consultant’s] investigations, and because it appears United Shore intends to use the findings of the investigation to prove the cause of the intrusion,” the privilege was waived and United Shore had to produce the documents, the court said.
Seeking to protect its privileged material, United Shore petitioned the U.S. Court of Appeals for the Sixth Circuit for a writ of mandamus to vacate the district court’s order. However, as the Sixth Circuit explained at the outset of its opinion, the “remedy of mandamus is a drastic one to be invoked only in extraordinary situations where the petitioner can show a clear and indisputable right to the relief sought.” Analyzing the petition under a five-factor test, the Sixth Circuit found no reason to vacate the order. Rather, “United Shore cited [co-defendant’s] action or lack of action as an affirmative defense. And it commissioned an investigation that concluded that [co-defendant] was at fault. Thus, it attempted to prove a defense by disclosing or describing the attorney-client communications.” As a result, United Shore waived the attorney-client privilege “with respect to all communications involving the same subject matter,” the Sixth Circuit explained.
The attorney-client privilege can be a powerful tool, but it must be wielded with care. As demonstrated by the United Shore ruling, counsel and client should carefully consider the implications of disclosing privileged investigative findings and formulate a consistent, forward-looking strategy. In particularly thorny scenarios such as data breach investigations, the temptation to use privileged findings may be strong, but the consequences of making a disclosure of the investigation’s findings should be fully assessed and deliberated before doing so.
Client Alert 2018-029
