Are Data Breach Investigations Privileged?

Over the past year, the number of data breaches has skyrocketed and, as a result, companies are facing increased risk of litigation for any perceived failure to protect their customer data.  In the context of data breach litigation, organizations routinely withheld from production documents related to internal compliance investigations on the grounds of the attorney-client or work product privilege.  A recent decision from a U.S. District Court in the District of Columbia calls into question the privileged status of those documents. In U.S. ex rel Barko v Halliburton Co., a former contract administrator for Kellogg, Brown and Root (“KBR”) alleged that Halliburton and other KBR contractors inflated the costs of construction services on military bases in Iraq.  In connection with a qui tam suit, the administrator Harry Barko sought documents relating to possible violations of the corporate code of conduct.  KBR withheld documents related to internal compliance investigations on the grounds that they were privileged and Barko moved to compel production.  After an in camera review, a District Court Judge for the District of Columbia held that the documents were not protected by the attorney-client or work product privilege, but the reasoning behind that decision may surprise you.

In concluding that the documents were not privileged, the court highlighted the involvement of non-attorneys in the investigation process, the timing of the investigation in relation to the litigation, and the representations made to those involved, specifically that those being interviewed were not told about the legal nature of the inquiry.  However, the lynchpin of the court’s logic was that the investigations were taken pursuant to regulatory law rather than for purpose of obtaining legal advice.  Here, the court cited Department of Defense regulations that require contractors to have internal controls for compliance, including a mechanism, such as a hotline, by which employees may report suspected instances of improper conduct.  The court reasoned that an investigation would have been conducted regardless of whether legal advice was sought because compliance investigations were required by regulatory law and corporate policy.

In this regard, the court’s holding appears to be flawed because regulations are of course enforced by criminal investigations and civil actions, such as the one brought by the plaintiff.  While the regulations may require an investigation, the goal is not to force companies to conduct investigations for the sake of investigations, but instead to detect and respond to violations of those regulations.  Even without a mandate, a corporation must undertake an investigation before it can assess its potential liability and determine next steps.   Granted, some aspects of regulatory compliance will not involve rendering legal advice, such as employee training.  Nevertheless, Barko involved allegations of false claims and overbilling the federal government.  It seems counter-intuitive that an investigation into such allegations would not be in anticipation of litigation or, at a minimum, for the purpose of rendering legal advice to the corporation on how to proceed.

The court also appears to have overreached when concluding that the investigation would have been conducted regardless of whether legal advice was sought.  The idea, the court reasoned, was that the Department of Defense regulations require contractors to have internal control systems, such as KBR’s Code of Business Conduct, to facilitate the timely discovery and disclosure of improper conduct in connection with government contracts.  However, simply being required to investigate potential violations does not supplant nor override the ultimate purpose of the investigation, which is to determine whether there has been a violation of the law.

The facts in Barko are similar to those often encountered in the data breach context.  Consider a typical data breach under the Health Insurance Portability and Accountability Act (“HIPAA”).  As with Barko, the initial investigation may be handled by non-attorney personnel such as a member of the IT department, and may be guided by corporate policy and Department of Health and Human Services (“DHHS”) regulations.  Additional similarities can be seen in the Department of Defense regulations cited in Barko which required contractors to 1) have a written code of business ethics, 2) implement internal controls for compliance, 3) conduct internal and/or external audits, 4) enact disciplinary action for improper conduct, 5) timely report to appropriate government offices, and 6) fully cooperate with any government agencies.   Similarly, HIPAA requires covered entities to have 1) written policies and procedures regarding the protection of personal health information, 2) appropriate safeguards for protecting that information, 3) regular risk assessments, 4) sanctions against members who fail to comply with HIPAA rules, and 5) notification to the DHHS within 60 days for breaches, and imposes a duty on covered entities to provide records and cooperate with the DHHS in compliance reviews and investigations.

DOD Regs cited by Barko	HIPAA Requirements
Have a written code of ethics.	Have written policies and procedures for protecting personal health information (“PHI”).
Implement internal controls for compliance.	Implement appropriate safeguards for safeguarding PHI.
Conduct internal and/or external audits.	Conduct regular risk assessments.
Enact disciplinary action for improper conduct.	Enact sanctions against employees who fail to comply with the HIPAA rules.
Timely reporting to appropriate government offices.	Notification to DHHS is required within 60 days for certain breaches.
Full cooperation with any government agencies is required.	Imposes a duty to cooperate with DHHS in compliance reviews and investigations.

Given these parallels, it is likely only a matter of time before Barko is cited in the context of data breach litigation.  Nearly every U.S. state and several federal agencies have regulations that effectively require an organization to conduct an investigation any time there is security incident.  If the court’s reasoning in Barko is adopted by other districts, it may hinder an organization's ability to assert the attorney-client or work product privilege over documents related to the investigation and response.

That being said, it is important to note that the precedential value of the Barko decision is currently limited to the D.C. District.  In addition, most significantly, the opinion does not purport to overturn, challenge or reinterpret existing jurisprudence, but instead relies entirely on existing case law as applied to the facts of the case.  As a result, organizations can and should take steps to avoid some of the same pitfalls that plagued KBR.  Specifically, organizations should clearly identify (from the outset and throughout) those investigations that are intended to be legally privileged – i.e., for the purpose of obtaining legal advice and at the direction of counsel - both in written documents and in communications with employees.  Further, internal and external counsel should lead or be heavily involved in any investigation where the organization may want to assert the attorney-client or work product privilege.

Court Opinion: US ex rel Barko v Halliburton Co