Corporations’ investigations generally deserve (1) privilege protection only if the corporations are primarily motivated by their need for legal advice; and (2) work product protection only if they are motivated by anticipated litigation, and the company would not have created the investigation-related documents in the same form but for that anticipated litigation.

In In re Premera Blue Cross Customer Data Security Breach Litigation, Case No. 3:15-md-2633-SI, 2017 U.S. Dist. LEXIS 178762 (D. Or. Oct. 27, 2017), Premera claimed privilege and work product protection for its data breach investigation.  The court rejected both claims.  Among many other things, the court assessed Premera’s work product claim for documents created by its consultant Mandiant.  Premera had hired Mandiant to review its claims data management system in October 2014.  On January 29, 2015, Mandiant discovered malware on the system.  Premera quickly hired an outside lawyer, and on February 21, 2015, “Premera and Mandiant entered into an amended statement of work that shifted supervision of Mandiant’s [later] work to outside counsel.”  Id. at *22.  Premera predictably argued that Mandiant’s later work was protected, because Mandiant was then working “on behalf of an attorney.”  Id. at *23.  But the court rebuffed the argument — bluntly explaining that the “flaw in Premera’s argument . . . is that . . . [Mandiant’s] scope of work did not change [from the October 2014 agreement] after outside counsel was retained.”  Id.  As the court noted, the “only thing that appears to have changed involving Mandiant was the identity of its direct supervisor.”  Id.

Companies seeking to maximize privilege and work product protection for internal corporate investigations should carefully document the primary motivations, showing that the corporation did something different or special because of its need for legal advice or because of anticipated litigation.  The documentation of course should start with law firms’ and consultants’ retainer letters – but all documents created before, during, and after investigations should help evidence the necessary motivational elements under the privilege and (if appropriate) the work product doctrine.