Privilege Under Pressure: The Shifting Data Breach Investigation Landscape

From the law firm of Greenberg Traurig:

Go-To Guide:

• Recent case law shows skepticism by some courts when evaluating whether forensic reports prepared after a data breach are protected under privilege, with some courts questioning privilege over communications with the client and counsel where the forensic firm is copied.
   
• Companies may consider reviewing their practices for managing breach investigation communications and information sharing.
   
• To preserve confidentiality, companies should consider managing who receives breach investigation updates and how they are delivered.

[…]

Traditionally, after data breaches of all sizes, outside counsel’s standard approach has been to hire highly technical vendors, such as forensic investigators, to perform the analysis of how a breach unfolded to inform their legal advice. This approach creates a three-way relationship focused on providing companies with the best legal advice possible after a breach. The forensic firm’s role in such situations is as a consulting expert, often providing a comprehensive report to support legal counsel’s efforts. Previously, lawsuits after a breach were rare, and challenges to defendants’ breach investigation methods were even more uncommon. Thus, collaboration between companies’ legal counsel and forensic firms proceeded unquestioned.

The CCPA’s Potential Effect on the Landscape

Since 2020, the number of lawsuits filed after data breaches have increased dramatically, especially where a significant number of individuals’ personal information is exposed. The reason for the increase may be California’s data privacy law, the CCPA¹, which allows plaintiffs to claim statutory damages of $100 to $750 per affected person. While damages are limited to California residents, plaintiffs’ lawyers have persisted in filing nationwide class actions involving non-Californians, resulting in a proliferation of lawsuits. These lawsuits have led to increasing challenges against keeping forensic reports protected under privilege.

Read more about recent federal cases that are posing challenges to claiming attorney-client privilege or work product doctrine at The National Law Review.