A district court recently extended the work product doctrine to protect a forensic report prepared in response to a data breach suffered by Experian (In re Experian Data Breach Litigation). The third party that prepared the report was retained by outside counsel after the company became aware of a potential incident. In subsequent class-action litigation brought by impacted individuals, Experian refused to turn over the investigator’s report, claiming the report was privileged as attorney work product.

In evaluating Experian’s claim of privilege, the court looked at whether the report was prepared “because of” anticipated litigation and thus could be protected by privilege. The court stated that to conduct its analysis it needed to look at the totality of the circumstances, and did not need to look at whether anticipated litigation was the primary or secondary motivation for creating the report. Applying this standard, the court found it irrelevant that Experian likely had multiple motivations in preparing the report that did not relate to the chance that litigation may occur.

Here, the court found, the report was drafted in its particular format “because of” anticipated litigation. In looking at the totality of the circumstances, the court found significant the fact that the investigator was engaged by outside counsel and conducted its investigation at counsel’s direction. Also important to the court was the fact that the report was used by counsel to evaluate Experian’s legal obligations and develop their legal strategy, was closely protected by counsel, and was not widely disseminated to the breach response team or other employees working on remediation. The report was thus protected from discovery under the work product doctrine.

TIP: This decision serves as a reminder of the importance of retaining external counsel to engage investigators and direct their work. Other factors to consider in establishing privilege in a data security investigation include the use of the investigator’s work for legal strategy, counsel control of any resulting reports, and minimizing the circle of individuals who have access to the report.