Australia

Australia

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?

Internal Investigations

Legal professional privilege applies in the context of civil proceedings, criminal investigations and in the context of regulatory investigations by authorities such as the office of the Australian Information Commission (the primary privacy regulator in Australia).

The test for legal professional privilege in each context (internal, criminal and data protection matters) in Australia is the same.

Legal professional privilege is derived from the common law and from legislation, such as the Evidence Act 1995 (Cth), at both a state and federal level. In Australia, legal professional privilege (which is often referred to as client privilege) is a fundamental right that vests in the client – not in or with the lawyer.

The test – in summary

Confidential communications:

  • between a lawyer and their client, one or more lawyers acting for the client, or lawyers acting for the client and a third person (such as an expert witness);
  • which are for the dominant purpose of providing legal advice or professional legal services; and
  • are in relation to a current or pending legal proceeding, are protected by legal professional privilege.

Legal professional privilege also extends to confidential documents prepared for the purpose of giving or obtaining legal advice and for the purpose of a legal proceeding. For example, a report/document prepared by a forensic IT consultant or an internal IT operative that is created to obtain legal advice will normally be privileged.

How is privilege lost?

Legal professional privilege may be abrogated by some common law exemptions and by the express and/or necessary implication of legislative provisions.

For example, if a client seeks legal advice in an attempt to further a crime or fraud, this advice and related communications will not be subject to legal professional privilege. Further, a claim of legal professional privilege is unlikely to be able to be maintained if it is being used to frustrate a process of law.

In the context of civil litigation, where the court may order documents to be produced during processes such as discovery, such orders will not require documents that are subject to a claim of legal professional privilege to be produced. However, the documents will need to be identified in a list of documents that is provided to the party seeking discovery.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

There is no limitation period placed on legal professional privilege in Australia.

c) Are communications to/by companies and in-house counsel protected by privilege?     

In Australia, courts have considered whether in-house lawyers are protected by legal professional privilege by assessing whether they are acting in their capacity as a lawyer and have the requisite independence to provide unfettered advice.

To attract legal professional privilege, communications or documents must be made in a lawyer's capacity as a lawyer in order to provide the client with legal advice or for the purpose of actual or anticipated litigation.

Communications made by in-house lawyers who act beyond their role as a legal advisor (for example by weighing in on operational matters) will fall outside the scope of legal professional privilege. This is also the case if a communication or document is found to have been made for mixed purposes.

Exercising independent professional judgement is a key factor that will be considered in establishing whether in-house counsel is acting in the capacity of a lawyer. Claims for legal professional privilege have been rejected on the basis that in-house counsel have not acted at sufficient arm's length from their client, such as when documents are produced by in-house lawyers who are subject to the directions of their managers and therefore giving rise to the impression that they lack necessary independence.

Legal professional privilege has also been denied in relation to communications where in-house lawyers have been involved in the commercial decision-making of a transaction.

Whether an in-house lawyer has a practising certificate has also been considered by courts in Australia when deciding whether legal professional privilege should apply to their advice. While failing to have a current practicing certificate is not necessarily fatal to a claim of legal professional privilege, it may lead to a court inferring that the communications made and documents created by the in-house lawyer are not for the purpose of providing legal advice or for the purpose of litigation.

In a data breach/cyber incident, it is important that any in-house counsel makes it clear when they are giving legal advice and when they are acting in an operational capacity – for example as an incident response coordinator which may involve giving commercial advice on how to respond to the incident.

d) Are there any specific requirements of a privileged incident response engagement letter?

Yes, it is recommended that external counsel engage any third parties required to assist with a response in order to best set up an ability to claim privilege over the work done.

All third-party engagement letters should include a statement that the third party is being involved for DLA Piper/in-house counsel to advise the affected entity.

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes.

Communications or documents must be confidential and have occurred or come into existence for the “dominant purpose” of obtaining legal advice or in relation to actual or anticipated litigation to attract legal professional privilege. The term “dominant” has been held to mean a “ruling, prevailing or most influential” purpose.

To avoid any later arguments as to what the dominant purpose of the document, it is recommended that a lawyer (internal or external) prepare the record of the interview if at all possible. If it is not possible for a lawyer to prepare the record of the interview, it should be clearly noted at the commencement of the interview that the purpose of the interview is to enable the affected entity to obtain legal advice.   

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

It does not matter whether the documents are located at the client or lawyer's premises.

c) How are seized documents put into evidence in a criminal/civil procedure?

Generally, privileged materials cannot be used in legal proceedings in Australia.

There are extremely limited circumstances where this general rule will not apply.

A party who claims privilege will generally have a right to object to use of privileged material. External counsel should be briefed as a matter of urgency if a government agency or third party attempts to use privileged materials.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

A client will be deemed to have waived legal professional privilege if the client acts in a way that is inconsistent with the confidentiality which the legal professional privilege is supposed to protect.

The waiver of legal professional privilege is available under several circumstances. Firstly, the privilege can be waived by disclosing the effect of the legal advice, regardless of whether the advice itself is disclosed. Accordingly, it reminds parties to think twice before voluntarily disclosing compliance material that has been prepared by lawyers.

Secondly, the privilege may be waived if a third party is copied into the communication. The principle endorsed by the Full Federal Court is that “for a client to deploy the substance or effect of legal advice for forensic or commercial purposes is inconsistent with the maintenance of the confidentiality that attracts legal professional privilege.”

The legal professional privilege will also not apply in circumstances where the communications are made for improper and/or illegal purposes, notwithstanding the fact that the lawyers involved were not necessarily aware of the illegality. The Federal Court in Aucare Dairy Pty Ltd v Huang emphasised that there is a risk that where there is evidence of illegality and/or improper purpose by a party, that party will not be entitled to legal professional privilege.

Additionally, legal professional privilege may only be claimed by a company director over documents containing legal advice if the documents are related in some way to the director in their personal capacity and not merely to the operations of the company. The Federal Court found in Equititrust Ltd (in Liq) (Receivers appointed) (Receivers and Managers Appointed) v Equititrust Ltd (in Liq) (Receiver appointed) (Receivers and Managers Appointed) (No.3) that the fact documents containing legal advice were addressed to a director or “the Directors,” or procured by a director did not mean that the director had personal concerns in the matters raised by the documents disputed or mean that the advice was provided on the basis of joint privilege.

The Court also held that commonality of interest is a prerequisite for common interest privilege to apply and that the mere fact the legal advice was communicated to Equititrust and that a company can only act through its directors did not mean that its directors had a common interest privilege in that advice.

Legal professional privilege was also dismissed in Hancock v Rinehart where the Supreme Court of New South Wales held that legal advice obtained by a trustee belongs to the trust and not the trustee personally. The Court noted that the costs of obtaining the legal advice were paid from the trust fund, and accepted the suggestion that the advice was obtained in behalf of the trust and not the trustee in her personal capacity.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

It may be possible that a company could wish to rely on a privileged report or documents created during an investigation. In those circumstances it will be necessary to waive privilege.

It may be possible to waive privilege only in that document but care must be taken.

External legal counsel should be engaged in any discussion about a decision to waive privilege as in Australia it is possible, through a concept called "issue waiver" to lose privilege over all materials relating to a particular topic.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

It will depend on the scope and nature of the information shared.

Again, care should be taken as to the contents of such notifications so as to not inadvertently waive privilege.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

We have not located any decisions on privilege that have arisen in the context of a data breach in the last five years.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

Australia is a federation. There is relevant legislation dealing with privilege at a federal and state level, as well as in the common law.

There are numerous courts cases that consider cross-border privilege issues.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Yes, that is the general approach.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

The critical element to maintaining privilege in Australia is to ensure that the privileged material remains confidential and that there is no express or implied (through conduct) wavier of that privilege.

Last modified 19 Nov 2021

Austria

Austria

Content to follow shortly.

Last modified 15 Mar 2019

Bahrain

Bahrain

Content to follow shortly.

Last modified 25 Jul 2019

Belgium

Belgium

Content to follow shortly.

Last modified 15 Mar 2019

Bosnia and Herzegovina

Bosnia and Herzegovina

Content to follow shortly.

Last modified 31 Aug 2016

Brazil

Brazil

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?   

The lack of regulation for internal investigations includes legal professional protection, so the general rules set forth for lawyers are applied in internal investigation conducted by lawyers.

The engagement of a lawyer has historically been an effective way to create and maintain confidentiality in an internal investigation. In Brazil, having lawyers in charge of the investigation is crucial, considering the specificities of the local legal professional confidentiality treatment.

The Brazilian Bar Association Statute (“BBAS”) sets forth “the inviolability of the lawyer’s office or place of work, as well as their work tools, written, electronic, telephone and telematics correspondence, as long as they relate to the practice of law” as every lawyer’s right. Law Enforcement Agencies in charge of criminal investigations, therefore, cannot have access to evidence originating from the protected sources mentioned above, except in cases in which there is indication that the lawyer took part in a crime or keeps physical evidence of a crime in their office.

No special legal privilege rules for data protection matters.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

The legal professional protection applies throughout all criminal investigations.

c) Are communications to / by companies and in-house counsel protected by privilege?

The BBAS does not distinguish in-house lawyers from external counsel. The BBAS specifically sets forth the practice of “legal management” as a lawyer’s private activity. Unlike many European countries, in-house lawyers have the same rights and duties of external counsel, as long as their role exclusively relates to the practice of law. This means in-house lawyers who perform executive management roles or other activities not related to the practice of law do not have the same legal treatment. In addition, the Brazilian Bar Association Ethics Code (“BBAEC”) provides that in-house attorneys must also preserve their liberty and independence.

Foreign lawyers are not allowed to practice law in Brazil and are considered “Consultants” when acting in Brazil, as per Provision nº 91/200 of the Brazilian Bar Association. Therefore, considering that foreign lawyers are consultants when acting in Brazil, the local legal professional protection guarantee may have less strength for foreign lawyers.

d) Are there any specific requirements of a privileged incident response engagement letter?

No, there are no specific requirements in that sense.                      

2) Documents and Reports             

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Notes or transcripts of employee interviews: yes.

Expert reports prepared or obtained for the purpose of giving legal advice: yes, if the expert work was retained or requested by a lawyer.

b) Does it matter whether the documents are located at the premises of the client or the lawyer? 

Yes, as stated above, the BBAS sets forth “the inviolability of the lawyer’s office or place of work, as well as their work tools, written, electronic, telephone and telematics correspondence, as long as they relate to the practice of law” as every lawyer’s right. Law Enforcement Agencies in charge of criminal investigations, therefore, cannot have access to evidence originating from the protected sources mentioned above, except in cases in which there is indication that the lawyer took part in a crime or keeps physical evidence of a crime in their office.

c) How are seized documents put into evidence in a criminal / civil procedure?

Search and seizures are a precautionary measure set forth in the Brazilian Criminal Code of Procedure. Documents seized during the execution of search and seizures must be listed in a notice drafted by the responsible law enforcement agent and later presented in investigation files, usually in separated and specific records.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

The legal professional protection may not be recognized in the following situations:

  • If the communication is in furtherance of a crime, or to avoid a threat to someone’s life or honor.
  • For the attorney’s own protection in cases of “severe threat to life or honor” or when any action taken by the client against the attorney is regarded as an “affront” and the disclosure of confidential information is required in “self-defense against the client.”
  • If previously authorized by a client to disclose (waiver), except for the attorney to serve as witness.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so, does that mean privilege has been waived?

As the data protection law in Brazil is very recent and only became enforceable in August 2020, data breach class action is still not common in Brazil. In any case, legal professional protection will not be recognized following the same understanding to the above answer.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

Please refer to question 3a.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

Not that I am aware of.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?      

No, there are no specific rules or cases in Brazil in that sense.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

There is no specific legislation ruling data that holds a privileged nature in foreign countries.

However, if a foreign lawyer is authorized by a license granted by the Brazilian Bar Association to practice law in Brazil, the individual has the same rights as Brazilian lawyers, including legal privilege.

In other circumstances, according to the rules set forth by the Civil and Criminal Procedure Codes, an individual may not be compelled to testify about facts that are protected by professional confidentiality. In that sense, foreign attorneys could decline to testify based on information obtained in the attorney-client relationship, considering it to be covered by legal privilege.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?     

Any data requested by foreign countries in the event of a civil / criminal investigation must be done through International Legal Cooperation.

In Brazil, the Ministry of Justice​ plays the role of central authority for the international legal cooperation system, being the recipient of demands usually made through diplomatic channels. One of the responsibilities of the central authority is to classify the requests received according to the nature of the claim and to give the proper guidance to the matter.

In the case of a data request, the request would be submitted to the Brazilian Superior Court of Justice (STJ), which will only grant authorization to fulfill the requested measure after examining the comprehensibility of the case and the possibility of offense to the national sovereignty, public order, or human dignity.

In situations where compliance with legal cooperation measures abroad is required by Brazilian authorities – whether they are investigative, administrative, or judicial – the procedure does not go through the STJ. In such cases, the dispatch of the magistrate's request is made directly by the Ministry of Justice, which also plays the role of central authority for active cooperation requests.

Based on that, the request for data protected by legal privilege would have a very low chance of being granted by the STJ, except in very exceptional cases that would follow the answer provided in Question 3a.

Last modified 15 Mar 2019

Bulgaria

Bulgaria

Content to follow shortly.

Last modified 7 Jun 2016

Canada

Canada

Content to follow shortly.

Last modified 15 Mar 2019

Chile

Chile

Content to follow shortly.

Last modified 21 Jan 2020

China

China

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?

No. There is no legal principle or legislation on legal privilege in China. Therefore, there is no legal privilege in the context of internal or criminal investigations, and/or data protection matters. Under PRC law, a lawyer owes a general confidentiality obligation to the client that covers confidential information, state secrets and commercial secrets obtained from the client during the representation.

PRC law is silent on this issue. In practice, the instructions from the client does not need to come from in-house counsel for the confidentiality obligation to apply.

Confidentiality obligation applies in the context of criminal investigations. However, under certain scenarios, a lawyer has the obligation to report if the information is related to the preparation or commission of criminal acts.

Article 48 of PRC Criminal Procedure Law provides that “[a] defense lawyer has the right to keep confidential information of the client obtained during the professional practice. For information that involves any impending or ongoing criminal activity which would jeopardize state and public security or cause serious personal safety damage, a lawyer must inform PRC judicial authorities.”

For details, please refer to DLA Piper Legal Professional Privilege Global Guide, China – Legal professional privilege in the context of criminal investigations.

As discussed above, legal privilege is not recognized in China, hence there are no special rules addressing legal privilege in the context of data protection.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

As discussed above, legal privilege is not recognized in China. Instead, certain confidentiality obligations apply when a Chinese lawyer starts representing the client.

c) Are communications to / by companies and in-house counsel protected by privilege?     

The source of such information does not matter. As long as such information about the client is obtained during the lawyer’s professional representation and falls under the scope of confidential information, a defense lawyer should be entitled to rely on article 48 of the PRC Criminal Procedure Law (the content of which is set out in the answer to question 1a) to assert confidentiality.

d) Are there any specific requirements of a privileged incident response engagement letter?

No. However, an engagement letter should nonetheless cover the work to be carried out in China, at least, as an attempt to preserve privilege protection of the China-related work product and communication that might be afforded to the same in jurisdictions outside of China. For each case, this needs a deeper analysis of the scope of work, involvement of cross-border teams, what non-Chinese jurisdictions are involved, and the applicable privilege considerations for those non-China jurisdictions.

2) Documents and Reports  

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

As discussed above, legal privilege is not recognized in China. PRC law does not set out in detail various categories of documents that are protected by confidentiality obligation owed by a lawyer. The law generally provides three broad categories of information that are protected: confidential information, state secrets, and commercial secrets.

b) Does it matter whether the documents are located at the premises of the client or the lawyer? 

The location of where the documents are located does not matter. See further details in answer to question 2a) above.

c) How are seized documents put into evidence in a criminal / civil procedure?

Under PRC law, seized documents shall be clearly checked in the presence of a witness and the holder of such documents. A list must be made in two copies at the scene signed by the investigators, the witness and the holder of the documents. One copy of the list must be given to the holder, and the other copy must be attached to the collected documents and stored in the appropriate evidence archive. (Article 142 of the PRC Criminal Procedure Law)

Both the prosecution and the defendant are then entitled to present the seized documents to the court as part of their respective cases during the trial proceedings.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

Exceptions to the duty of confidentiality include:

  • any fact or information concerning the client or any other party who is about to or is in the process of committing a crime that may endanger state security or public security or cause serious personal safety damage;
  • information that the client agrees to disclose;
  • if disclosure is required by regulatory authorities during administrative investigations; or
  • if disclosure is required by judicial authorities in civil litigation proceedings.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

Data breach litigations are still relatively new in China and we are not aware of any such cases. In any event, the waiver point does not apply since legal privilege is not recognized in China.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

Data breach litigations are still relatively new in China and we are not aware of any such cases. As mentioned, the waiver point does not apply since legal privilege is not recognized in China.

4) Privacy Litigation  

a) Were there any data breach privilege cases in your jurisdiction in the last 5 years? If so, please provide details.

Legal privilege is not recognized in China. Therefore, there is no case precedent on this point.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?      

Legal privilege is not recognized in China. Hence, there are no specific rules or cases in China that deal with privilege. However, for work products and data originating from China as part of a cross-border scenario/case, attempts should be made (including having certain engagement arrangements and work and communication protocols in place) to preserve privilege protection of the China-related work product and data/communication that might be afforded to the same in jurisdictions outside of China. For each case, this needs a deeper analysis of the scope of work, involvement of cross-border teams, what non-Chinese jurisdictions are involved, and the applicable privilege considerations for those non-China jurisdictions.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Legal privilege is not recognized in China, therefore, the privileged data outside of China will not be treated as privileged data in China. A lawyer in China may rely on the lawyer’s confidentiality obligation as an attempt to resist disclosure of such data. However, there are exceptions to confidentiality as discussed in the answer to questions 3a) above.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?     

Legal privilege is not recognized in China. However, for work products and data originating from China as part of a cross-border investigation, attempts should be made (including having certain engagement arrangements and work and communication protocols in place) to preserve privilege protection of the China-related work product and data/communication that might be afforded to the same in jurisdictions outside of China. For each case, this needs a deeper analysis of the scope of work, involvement of cross-border teams, what non-Chinese jurisdictions are involved, and the applicable privilege considerations for those non-China jurisdictions.

Last modified 19 Nov 2021

Croatia

Croatia

Content to follow shortly.

Last modified 17 Jun 2016

Cyprus

Cyprus

Content to follow shortly.

Last modified 15 Jun 2016

Czech Republic

Czech Republic

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?

N/A – already answered in the full legal professional privilege global guide. An attorney must follow all of the rules of the GDPR as any other processor of personal data.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

The litigation privilege commences at the moment, when the attorney has found out the fact, which is subject to the privilege.

c) Are communications to / by companies and in-house counsel protected by privilege?

Yes under the agreement.

d) Are there any specific requirements of a privileged incident response engagement letter?

2) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

The legal privilege includes all information the attorney has found out with regard to providing legal services.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?

Already answered in the Legal professional privilege - Global Guide.

c) How are seized documents put into evidence in a criminal / civil procedure?

Already answered in the Legal professional privilege - Global Guide.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

The legal privilege may be waived by the client or after hers/his death or termination its legal successor. The legal privilege also continues after the case is terminated or the attorney is deleted from the bar´s list.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

N/A.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

N/A

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last 5 years? If so, please provide details.

Yes.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?

No, we are not aware of any.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Most likely not, but there is no specific explanation to the privilege obligation under Czech law nor any useful case law yet.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?

This would be considered a legal privilege, if falling under its scope.

Last modified 19 Nov 2021

Denmark

Denmark

Content to follow shortly.

Last modified 16 Jul 2019

Egypt

Egypt

Content to follow shortly.

Last modified 18 Sep 2019

England and Wales England and Wales

England and Wales

Content to follow shortly.

Last modified 7 Mar 2019

Estonia

Estonia

Content to follow shortly.

Last modified 4 Aug 2016

European Union

European Union

Content to follow shortly.

Last modified 1 Apr 2019

Finland

Finland

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?   

Internal investigations are generally not protected by attorney-client privilege in Finland and there are no directly applicable laws on internal investigation, except for the Finnish Auditing Act (1141/2015, as amended). Chapter 8, section 4 of the Auditing Act sets out a derogation from the provisions on the right to obtain information and carry out inspections concerning advocates, legal counsels, and attorneys. The Auditor Oversight Unit does not have the right to obtain information, documents, or records from the advocate concerning the advocate's client or inspect them. This covers both legal advice and litigation privilege. Notwithstanding the exception to preserve privilege in general, it is advisable that an external counsel is involved.

According to Chapter 15, section 17 of the Finnish Code of Judicial Procedure, an attorney or a legal council may not without permission disclose privileged information that they have obtained in providing legal advice on the legal position of their client in a criminal investigation or in other proceedings prior to legal proceedings.

The elements, as set above, to establish legal privilege also apply to civil matters.  

Chapter 6, section 35 of the Finnish Data Protection Act incorporates a separate professional secrecy obligation for information acquired in connection with processing that takes place under the authority of a data controller or data processors.

Furthermore, Chapter 6, section 36 of the Finnish Data Protection Act provides an obligation for the supervisory authority to keep the identity of a natural person, who has notified the authority on possible breaches of data protection laws, in secrecy where the circumstances warrant it.

Breach of either one of the sections in the Finnish Data Protection Act is punishable under the Finnish Criminal Code (39/1889, as amended). 

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

In principle, documents in the possession of outside counsel are protected by attorney-client privilege. For instance, documents and communications containing general advice provided by an outside counsel prior to any investigation by the authorities enjoy attorney-client privilege protection.

In general, legal privilege only applies to information disclosed after the establishment of an assignment between the client and the counsel. However, information provided by the client, prior to establishing an attorney-client relationship, may still be regarded as privileged information if the nature of such information warrants it. For example, information disclosed to a counsel per said counsel’s request to decide whether to accept an assignment, would be considered privileged information.

c) Are communications to / by companies and in-house counsel protected by privilege?     

Legal privilege only applies to documents in the possession of an outside counsel. Therefore, it is recommended that during criminal investigation, an outside counsel is sought to ensure the protection of legal privilege.

d) Are there any specific requirements of a privileged incident response engagement letter?

Not to our understanding.

2) Documents and Reports  

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

In general, documents are protected by legal privilege if the purpose of such documents relates to the provision of legal advice provided by an attorney. The content of legal professional privilege is in general determined by the prohibitions on evidence laid down in Chapter 17 of the Code of Judicial Procedure. Furthermore, the corresponding exceptions on the legal privilege are described in Chapter 7, section 3 and 4 of the Finnish Coercive Measures Act (806/2011, as amended). For example, under chapter 7, section 3, there is no prohibition on seizure or reproduction if the person in respect of whom the obligation of professional secrecy has been imposed consents to the seizure or reproduction. The other exceptions on prohibition on seizure or reproduction cover, for example, offences with a certain maximum term of imprisonment.

b) Does it matter whether the documents are located at the premises of the client or the lawyer? 

In general, it does not matter where the documents are located.

c) How are seized documents put into evidence in a criminal / civil procedure?

Conditions for seizing documents are set out in Chapter 7, section 1 of the Finnish Coercive Measures Act. Accordingly, documents may be seized if they can be used as evidence in a criminal procedure. The evidence (ie the seized document) is named by the party and if necessary, the court decides whether it can be used and whether it should be kept secret.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

Privilege may be waived in three different situations:

  • The person whose privilege is at hand waives their right to privilege.
  • Privilege yields to a provision of the law.
  • Legal protection of the lawyer requires them to be released of privilege.

In addition, the protection of legal professional privilege is under statutory exception of Chapter 15, section 10 of the Finnish Criminal Code (39/1889, as amended), which establishes a responsibility to report to authorities or to the person in danger a serious offence the preparation of which the person with the duty to report has knowledge of.

Furthermore, the Act on Detecting and Preventing Money Laundering and Terrorist Financing (503/2008, as amended) includes disclosure duties which may override lawyers' confidentiality obligations. Also, section 7 d of the Advocates Act (496/1958, as amended) provides that an advocate must openly and truthfully supply the information required by the Disciplinary Board of the Finnish Bar Association in supervisory matters regardless of the possible confidential nature of the information.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?   

To our understanding, this has no effect on the confidentiality of the attorney or the legal counsel or the prohibitions on evidence laid down in Chapter 17 of the Code of Judicial Procedure. However, this issue has not been addressed in case law.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

In principle, no. However, there are no explicit rules on this and the question of whether a notification or sharing of the findings mean a waiver needs to be assessed on case-by-case basis.

4) Privacy Litigation  

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

Not to our understanding.

b)    Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?

Not to our understanding.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

In general, it does not matter where the documents are located.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?     

This needs to be addressed on a case-by-case basis.

Last modified 19 Nov 2021

France

France

The concept of legal professional privilege as such does not exist in France because disclosure requirements in French litigation are extremely narrow. As a result, rules of legal professional privilege protecting documents from disclosure have not developed in France like they have in England and Wales, the US and other common law jurisdictions. Legal advice provided by a lawyer to their client is, instead, protected by professional secrecy.

Professional secrecy is a general obligation not to disclose secrets, imposed on all persons who, in light of their professional status, have access to such secrets. The obligation is sanctioned both by criminal law (art. 226-13 Criminal Code) and by disciplinary measures.

The question of whether a document is protected by professional secrecy in France is determined not by the content of the communication, but by the role of the author and/or of the recipient. In essence, a lawyer is prohibited from communicating information acquired in the course of assisting a client. This obligation is of public order. It is general, absolute and unlimited.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?

Professional secrecy applies to any information disclosed by client to their lawyer during an internal investigation. Even though the client may subsequently freely disclose the lawyer conclusions to third parties, such conclusions are covered when they relate to information communicated by the client to their attorney.

However, professional secrecy will not apply to information communicated by third parties to an attorney during an internal investigation. In this context, an attorney has to inform said third parties before any communication that their exchanges will not be covered by professional secrecy of the attorney and thus may be disclosed in all or part.

French professional secrecy applies in the context of criminal investigations. Moreover, Article 432 of the French Code of Criminal Procedure expressly forbids the use of correspondence exchanged between the defendants and their attorney(s) as evidence. However, if an attorney is suspected of committing a crime or being an accomplice to a crime, client exchanges may be used as evidence before the French criminal courts for the strict requirements of the attorney’s own defense.

Please note that the French law No. 2021-1729 of December 22, 2021 “for confidence in the judicial institution” has created exceptions to the French attorneys professional secrecy. Article 3 of that law provides that legal privilege is not opposable to the police and judicial investigations measures relating to offences of tax fraud, corruption and the financing of terrorism as well as the laundering of these offences. However, in such cases, the competent Bar Head (Bâtonnier), its representative or the person at whose premises the search of investigation measures take place may object to the seizure of a document and require that this objection be examined by the Judge of Liberty and Custody (Juge de la détention et des libertés). According to Articles 18 and 19 of Law No 78-17 on information technology, data files and freedom, professional secrecy can be opposed to a request from the French Supervisory Authority (Commission Nationale de l’Informatique et des Libertés (CNIL)) to provide information or documents that are covered by such professional secrecy.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

Professional secrecy applies from the beginning of the exchange between an attorney and the client.

Pursuant to Article 2 of the Réglement Intérieur National (RIN) of the French Bar Council, French professional secrecy applies in all matters, whether it be legal advice or litigation. Secrecy applies no matter when a document was created and regardless of the support, whether physical or electronic (eg paper, fax, email).

Professional secrecy covers, notably:

  • legal opinions addressed or meant to be addressed by lawyers to their clients
  • correspondence between lawyers and their clients, and between lawyers – except correspondence identified as “official”
  • meeting notes and, in general, all the elements of lawyers’ files, including all information provided to lawyers in the exercise of their profession
  • clients’ names and lawyers’ agendas
  • payment of fees
  • information required by statutory auditors

c) Are communications to / by companies and in-house counsel protected by privilege?

As a matter of French law, in-house counsel (juristes d’entreprise) are considered to be a separate profession and do not enjoy the same status as attorneys who are members of the Bar (avocats). Under French law, in-house counsel are subject to professional secrecy obligations regarding information that can be characterized as “business secrets” received within the framework of their position in the company. In-house counsel are also prohibited from voluntarily sharing with non-authorized third parties legal advice they provide to the company they work for. A breach of this obligation is deemed a criminal offence (Article 226-13 of the French Criminal Code).

Nonetheless, French courts do not extend the full professional secrecy coverage to communications between in-house counsel and employees, officers or directors of a company in the context of obtaining legal advice. The European Court of Justice confirmed this principle in the Akzo Nobel judgment in an EU competition context. As a result of the French courts' position and the Akzo Nobel judgment, French authorities investigating antitrust and competition law issues can make use of internal company legal advice.

Furthermore, in-house counsel (unlike external lawyers) are obliged to testify if called or to provide evidence regarding their employers.

Lastly, the French Cour de Cassation recently decided that French law will be applicable to determine whether legal professional privilege applies to communications with in-house counsel from other jurisdictions, not the local law of the country in which the communication was made.

d) Are there any specific requirements of a privileged incident response engagement letter?

In practice, to ensure professional secrecy applies, it should be made clear that the document has either been drafted by or is intended for a lawyer, and has been prepared in connection with the request for or provision of legal advice.

2) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, according to Article 2.2 of the National Rules of Procedure (Règlement Intérieur National (RIN) of the French Bar Council, professional secrecy applies to interview notes and more generally to each element of the file, information and confidence received by the attorney who is a member of the Bar (avocat) in the performance of their position.

Regarding experts, unlike attorneys who are members of the Bar (avocats), such third parties are not subject to professional secrecy. They may, however, be subject to professional secrecy obligations regarding information that can be characterized as “business secrets” received in the framework of their position. 

Furthermore, the client, not being bound by professional secrecy, can use exchanges or documents covered by professional secrecy. Therefore, any document, such as the final report, employee interviews or expert reports may be communicated by the client and will thus no longer be protected by professional secrecy.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?

No, the location of the documents does not affect the application of professional secrecy.

c) How are seized documents put into evidence in a criminal / civil procedure?

Documents covered by professional secrecy cannot be seized during a criminal procedure, unless such seizure is expressly authorized by a judge (for instance, when the documents concerned reveal the participation from an attorney to a criminal activity).

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

Response to the first question regarding the waiver:

A client can opt to use a document covered by professional secrecy, but the client cannot release the attorney from their professional secrecy obligations. Professional secrecy may, however, be waived in the interest of the defense of the client or in the interest of the defense of the attorney where they are personally facing judicial proceedings.

In the latter circumstance, the production of protected documents must be essential to the attorney’s defense.

Response to the second question:

The client should make sure to inform its employees (if any) of the confidential nature of the document. The concerned file(s) on the client’s computer (if any) should indicate that the information contained in it is covered by professional secrecy.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

A company cannot be required to disclose the content of an internal investigation in civil litigation if this investigation is protected by professional secrecy.

A company may, however, choose to disclose the content of an internal investigation that is protected by professional secrecy. In this case, the disclosed content of the internal investigation will no longer be protected by professional secrecy.

In addition, it must be noted that where information covered by professional secrecy (in the specific case, medical secrecy) might be disclosed during a public hearing, the CNIL has already granted a request for a closed hearing (Deliberation of the CNIL No SAN-2020-015 of 7 December 2020).

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

The sharing of the content of an internal investigation that is protected by professional secrecy to third parties or affected individuals means the company waives professional secrecy in regards to the disclosed content of the investigation. Thus, the disclosed content of the internal investigation will no longer be protected by professional secrecy but the remaining information that was not disclosed remains covered by professional secrecy.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

To the best of our knowledge, there has not been any published case of civil litigation in regards to GDPR in France as of the date of this report.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?

Communications between French lawyers and foreign lawyers will be subject to professional secrecy only if certain precautions are taken (Article 3 RIN).

For EU lawyers, such precautions may consist of clearly marking communications as “confidential” and/or entering into a confidential agreement covering any, or specified types of, communication (Article 5.3.1 of the Code of Conduct for Lawyers in the EU).

The French Cour de Cassation has ruled that whether professional secrecy covers communications between lawyers registered in two different countries will depend on an analysis of the provisions of the applicable foreign laws.

From a data protection standpoint, to the best of our knowledge, there has not been any rules and/or cases in France that deal specifically with privilege in a multi-state/cross-border scenario.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Communications between French lawyers and foreign lawyers will be subject to lawyer’s professional secrecy only if certain precautions are taken (Article 3 of the RIN), as applicable provisions in other jurisdictions regarding lawyer’s professional secrecy may not be enforced before French courts.

As already mentioned, for communication between EU lawyers, the precautions must include the sender clearly expressing their wish for the communication to remain confidential or without prejudice before communicating the first documents. If the prospective recipient of the communications is unable to ensure their status as confidential or without prejudice they should inform the sender accordingly without delay (Articles 3.3 of the RIN and 5.3 of the Code of Conduct for Lawyers in the EU). Then, the lawyers’ communications should be marked as “confidential” or “without prejudice.”

For communication with non-EU lawyers, the precaution must include the sender making sure that, before exchanging confidential information, the country where the foreign fellow lawyer practices has rules that ensure the confidentiality of the correspondence. If not, the lawyer must enter into a confidential agreement covering any, or specified types of, communication with the non-EU lawyer or ask their client if they accept the risk of exchanging non-confidential information (Article 3.4 of the RIN).

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?

The French notion of lawyer’s professional secrecy might not be enforced before courts of another country. It is then crucial for a lawyer to make sure of the rules applicable in every jurisdiction to control the scope of each national lawyer’s professional secrecy.

Last modified 1 Apr 2019

Georgia

Georgia

Content to follow shortly.

Last modified 6 Jun 2016

Germany

Germany

Content to follow shortly.

Last modified 15 Mar 2019

Greece

Greece

Content to follow shortly.

Last modified 2 Mar 2015

Hong Kong

Hong Kong

Content to follow shortly.

Last modified 15 Mar 2019

Hungary

Hungary

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

The attorney-client/legal professional privilege (LPP) exists in internal investigations in the same manner as in civil and criminal investigations, that is in relation to investigations by any authority (including but not limited to Competition Authority, Prosecution’s Office). This LPP is based on the Sections 9-13 of Act LXXVIII of 2017 – on Legal Practice.

As a general rule, LPP in Hungary applies to qualified lawyers and junior lawyers, European Community jurists, foreign legal counsels, bar association registered in-house counsel, as well as those persons who assist these people in their work.

The Act on Legal Practice defines LPP as any and all facts, information and data about which the legal practitioner gains knowledge during the course of carrying out their professional duties.

(Section 9-13 of Act LXXVIII of 2017 – on Legal Practice)           

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

No, legal privilege is not affected by any time periods. (Section 9 (4) of Act LXXVIII of 2017 – on Legal Practice)

c) Are communications to/by companies and in-house counsel protected by privilege?     

Yes, communications with bar association registered in-house counsel are protected by LPP. (Section 4 of Act LXXVIII of 2017 – on Legal Practice)

d) Are there any specific requirements of a privileged incident response engagement letter?

No, there are there no specific requirements since LLP also applies to bar association registered in-house lawyers in Hungary. However, it is advised to always clearly mark documents sent to clients and bar association registered in-house counsel from external law firms as legally privileged.

(Section 9 of Act LXXVIII of 2017 – on Legal Practice)

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, as the LPP extends to all types of documents, parts of document, emails and other data carriers containing such LPP information. (Section 9 (2) of Act LXXVIII of 2017 – on Legal Practice)         

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

As regards the legal status of the document, it does not matter whether it is located at the premises of the client or the lawyer. However, in case of an official investigation, different procedures may be applied based on where the document is located. For details, please see question 6. (Section 13 of Act LXXVIII of 2017 – on Legal Practice)

c) How are seized documents put into evidence in a criminal/civil procedure?

On the premises of the lawyer:

The lawyer may not disclose the documents and data containing privileged information, may not be obliged to testify and provide data concerning privileged information during the authority’s revision, inspection, or onsite search.

On the premises of the client:

If the documents containing LPP are considered as “made for the purposes of defence” then those may not be examined, may not be seized and may not be copied by public authority bodies; their presentation, handing them over, giving access to them may be refused.

The law describes the term made for the purposes of defence as: documents or part of documents that were created for the sake or within the frameworks of exercising the client’s right to defence in public authority proceedings, during the communication between the legal practitioner and their client or a record of what was said during such communication, and this character is evident from the document itself. Documents that are not in the possession of the client or the legal practitioner shall not be deemed as documents made for the purposes of defence, except when they prove that the document has been removed from their possession unlawfully or under a criminal procedure.

The authority is entitled to have access to the document – without infringement of the right to LPP, and to the extent absolutely necessary – to establish whether reference to classification as a document made for the purposes of defence is obviously groundless or not.

If the classification of the document is disputed between the client and the authority, during the inspection or onsite search the authority may take possession of the document concerned, providing the document is placed on a storage device that excludes access to the data and the possibility to make subsequent changes.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

The person concerned may waive their rights to LPP, except when the document is connected with the defence in a criminal case where such waiver cannot be made.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

In the case of data breach investigations, the authority must be given access to all documents of the data controller, and may request copies thereof, and is entitled to inspect all such documents – including those stored on electronic data medium – which are presumed to have any bearing on the case at hand, and may request copies of such documents. The data controller and the organisation or person involved in the case at hand must comply with the authority’s request within the time limit prescribed by the authority.

If the findings of such internal investigation falls under LPP, then giving access to the authority may be refused. In such cases it is highly recommended to engage external legal counsel for advice in advance.

(Section 51(1)-(2) of Act CXII of 2011 – on the Right of Informational Self-Determination and on Freedom of Information)

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

This will depend on the scope and nature of the information to be shared. Referring to question 3b, in such cases it is highly recommended to engage external legal counsel for advice in advance.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

We are not aware of such specific cases.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?

We are not aware of such specific case law.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Yes, but only if it complies with Hungarian legal requirements.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

In Hungary there is no specific law on this.

Last modified 19 Nov 2021

Indonesia

Indonesia

Content to follow shortly.

Last modified 20 Aug 2016

Ireland

Ireland

Content to follow shortly.

Last modified 28 Sep 2020

Israel

Israel

Content to follow shortly.

Last modified 18 Sep 2019

Italy

Italy

Content to follow shortly.

Last modified 15 Mar 2019

Japan

Japan

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

No. In general, there is no system of privilege or other system similar to discovery procedures. Therefore, in Japanese litigation, each party is able to select the evidence which will be submitted to the court (except in limited circumstances, parties will not be forced to disclose its documents. The exception is detailed in question 6 below). Accordingly, even though there is no privilege system, the risk that documents relating to legal advice are disclosed to the other party is quite low.

In addition, we are not aware of any specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters.

Please note that lawyers may refuse to give testimony in court about the issue related to their client.

Please also note that the privilege is also not introduced in the investigation by Japan Fair Trade Commission regarding violation of anti-trust law. There are currently, however, ongoing moves to introduce such a system.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

No. Please refer to our answer to question 1a above.

c) Are communications to/by companies and in-house counsel protected by privilege?     

No. Please refer to our answer to question 1a above.

d) Are there any specific requirements of a privileged incident response engagement letter?

No. Please refer to our answer to question 1a above.

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

No. As mentioned in the answer to question 1a above, there is no privilege system in Japan. As such, none of these documents are protected by privilege.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

No.

c) How are seized documents put into evidence in a criminal/civil procedure?

  • Criminal Procedure

Prosecutors can submit the seized documents to court as evidence. There is no privilege system in criminal procedures so legal advice provided by an attorney to a client could be seized and be submitted to the court as evidence.

  • Civil Procedure

As mentioned in question 1 above, there is no system similar to discovery procedures. Therefore, in Japanese litigation, each party is able to select the evidence which will be submitted to court (except in limited circumstances, parties will not be forced to disclose their documents). In other words, each party must generally acquire evidence by itself.

The exception, however, is that a party can file a petition for submission of documents to court. The court may order the other party to submit the documents if the petition has reasonable grounds. However, if the documents include information which any attorney knows in the course of its business and is subject to the confidentiality duty imposed to the attorney, the court shall not issue such order.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

No. Please refer to our answer to question 1a above.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

No.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

No.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

No.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

No.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

No.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

As no such system of privilege exists, there are no such regulations under Japanese law.

Last modified 19 Nov 2021

Kuwait

Kuwait

Content to follow shortly.

Last modified 5 Aug 2019

Latvia

Latvia

Content to follow shortly.

Last modified 1 Aug 2016

Lebanon

Lebanon

Content to follow shortly.

Last modified 18 Sep 2019

Lithuania

Lithuania

Content to follow shortly.

Last modified 5 Sep 2016

Luxembourg

Luxembourg

Content to follow shortly.

Last modified 15 Mar 2019

Macedonia

Macedonia

Content to follow shortly.

Last modified 12 Aug 2016

Malta

Malta

Content to follow shortly.

Last modified 19 Aug 2016

Mexico

Mexico

Content to follow shortly.

Last modified 10 Oct 2016

Morocco

Morocco

Content to follow shortly.

Last modified 7 Apr 2020

Netherlands

Netherlands

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?

In the Netherlands, there is no specific legal privilege applicable in the context of internal investigations, criminal investigations and/or data protection matters.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

There are no specific time periods applying to legal privilege.

c) Are communications to/by companies and in-house counsel protected by privilege?

In-house counsels who are admitted to the Dutch bar (Cohen advocaten or advocaten-in-dienstbetrekking) also fall within the scope of legal professional privilege when they act in the capacity of an attorney (advocaat), provided that they comply with all the requirements set out by the Dutch bar and that their independent position vis-à-vis their employer is confirmed by a signed professional statute. This was confirmed by a judgement of the Dutch Supreme Court on March 15, 2013 (ECLI:NL:HR:2013:BY6101). The requirement of having a processional statute in place that guarantees the in-house lawyer’s independence was reiterated in the judgement of the Rotterdam District Court of 7. October 2019 (ECLI:NL:RBROT:2019:7856).  There can also be other reasons for an in-house lawyer to be considered insufficiently independent, for example if the head of the company's legal department is on the executive board and therefore responsible for the management of the company, presenting a potential conflict of interest.

In-house lawyers based outside the Netherlands can also rely on professional legal privilege if it is afforded to them by national law of their home jurisdiction. However, if the in-house lawyers are too embedded in the company, independence may not be properly safeguarded and professional legal privilege may not apply.

d) Are there any specific requirements of a privileged incident response engagement letter?

No, the general rules apply: documents specifically prepared for the purpose of seeking legal advice or to be used in the context of providing legal advice fall under the scope of legal professional privilege.

2) Documents and reports

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, the general rules apply: documents specifically prepared for the purpose of seeking legal advice or to be used in the context of providing legal advice fall under the scope of legal professional privilege. In principle, any type of information is covered by legal professional privilege, including letters, emails, phone calls and digital data. Third parties that are assigned by an attorney to provide (expert) advice on the legal issue for which the client has approached the attorney can claim (derived) privilege.

In 2015, the District Court of The Hague (ECLI:NL:RBDHA:2015:248) ruled that a report about a housing corporation drafted by a law firm following an internal investigation, which only contained factual findings and no legal findings, qualifications or conclusions did not fall within the scope of legal privilege. The Court decided that the defendants in the civil law procedure needed to be provided with a copy of the report. A relevant consideration of the Court was that the report had been given to the defendants in draft form in an earlier stage.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?

In principle, all communications between a lawyer (admitted to the Dutch bar) and their clients are protected by legal privilege, if the lawyer acts in their professional capacity. It does not matter where the communications are stored.

c) How are seized documents put into evidence in a criminal/civil procedure?

Legal professional privilege applies to a search for seizure.

Any search and/or seizure at a lawyer's premises needs to be pre-authorised by an examining judge and must be executed in the least burdensome manner.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

Legal professional privilege can be waived by the client or by the lawyer. As lawyers have an obligation to maintain confidentiality, they  should not waive legal privilege without their client’s consent. Lawyers may be subject to disciplinary action of the bar, or even be held criminally liable if they do not fulfil this obligation.

A practical step to ensure that privilege is not lost: always indicate clearly that the correspondence between a lawyer and their client is confidential (for instance mark the document with “legal professional privilege” or “client-attorney privilege”).

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

It may be necessary in litigation to produce a privileged document as evidence. If so, Dutch law makes it possible to share this information only with the court (subject to the court’s and the counterparty’s approval). If the counterparty does not approve, however, the court may not involve the document in its deliberations. As an alternative, it may be agreed to share a document only between lawyers or only within a ‘confidentiality ring’.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

Yes, however see the answer above at question 3 b) for alternatives.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

No.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?

Yes, see answer to question 1 c) above.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Yes, if the conditions for privilege are satisfied, the physical location of the data is not determinative.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?

There are no specific rules on this. Whether local privilege is respected depends on the privilege regulations of the country where the investigation takes place.

Last modified 18 Nov 2021

New Zealand

New Zealand

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

No, there is no specific privilege for investigations, but the usual privilege rules will apply.

In New Zealand, privilege applies to:

  • communications with legal advisors for the purpose of requesting or obtaining legal services and providing such services;
  • communications made or prepared for the dominant purpose of preparing for a proceeding or apprehended proceeding;
  • communications made in connection with an attempt to settle or mediate a dispute.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

No.

c) Are communications to/by companies and in-house counsel protected by privilege?     

Yes, communications with in-house counsel are protected by privilege if the communication is for the purpose of requesting, obtaining or providing legal services.

d) Are there any specific requirements of a privileged incident response engagement letter?

No.

2) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, if prepared for the purpose of obtaining legal advice or for the purpose of preparing for a proceeding.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

No.

c) How are seized documents put into evidence in a criminal/civil procedure?

There are different procedural rules for criminal and civil proceedings. Usually they will be entered into evidence by being introduced by a witness, or by agreement.

When documents are seized it is usual for a process to be put in place to isolate privileged documents and exclude these from review.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

Yes. A party who holds the privilege can waive that privilege. Privilege can also be waived inadvertently by reference to privileged communications in other documents.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

If a company wishes to rely on privileged documents in litigation, it would be required to waive privilege. Your lawyer can advise on whether you should waive privilege and the implications of the waiver.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

Sharing privileged documents with third parties may amount to a waiver of privilege and careful thought should be given before sharing privileged documents.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

No.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

No.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Yes, if it is within one of the categories above.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

Privileged information does not have to be provided in court or disclosed to any party.

Last modified 19 Nov 2021

Norway

Norway

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

The legal basis for the attorney-client/legal professional privilege (LLP) exist in internal investigations in the same manner as in civil and criminal investigation, that is in relation to investigations by the Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime (Økokrim) or the Competition Authority and other authorities with similar investigation powers. This LLP is based on a mix of case law and the Sections 119, 204, and 205 of the Criminal Procedural Code and Section 22-5 of the Civil Procedural Act.

As a main rule, LLP in Norway applies to qualified lawyers and junior lawyers, as well as those persons who assist the lawyer in their work.

There are some exceptions/caveats to the LLP, such as in criminal investigations where it leads to an innocent person being convicted or a serious crime being committed, where waivers can be made.

In addition, the LLP does not apply to information a lawyer receives when acting in another capacity, for instance as a member of a company’s Board of Directors.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

There are, to our knowledge, no time period limits or differences as such between litigation and legal advice with respect to the LLP.

c) Are communications to/by companies and in-house counsel protected by privilege?     

Under Norwegian national law, communications with in-house counsel are protected by LLP.

Under EEA/EU law, however, information given to in-house counsel is not protected by LLP. The result of this is, for instance, that if a dawn raid is undertaken by the EFTA Surveillance Authority (ESA), which falls within the scope of EEA/EU law, any in-house counsel at the company in question cannot invoke LLP. However, while in-house counsel may not be able to claim that their communications are protected by LLP in the context of investigations by the ESA, they may seek to do so in the context of an investigation by the Norwegian Competition Authority.

d) Are there any specific requirements of a privileged incident response engagement letter?

No, there are no specific legal requirements, since LLP also applies to in-house lawyers in Norway. However, it is advised to always clearly mark documents sent to clients and in-house counsel from external law firms with “legally privileged”.

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

The LLP in Norway applies to all types of documents, including parts of documents and emails where the lawyer is copied in, provided that they satisfy the criteria mention in question 1 above.

LLP also applies regardless of the lawyer’s nationality. In a case where an in-house counsel of a US corporation had prepared certain strategy documents in connection with a dispute, it was held that sections containing legal considerations and assessments of litigation risk were to be considered as privileged information, cf. decision by the Appeals Selection Committee of the Supreme Court, 22 December 2000. The Supreme Court clarified the duty to produce legally privileged material (in this case a lawyer's annual accounts) in a redacted version as evidence in a law suit. In other words, parts of a document may be legally privilege and other parts not.

In December 2010, the Supreme Court concluded that information regarding money transfers as part of the lawyer's legal practice, as well as the client's identity in a specific instruction for legal advice, was privileged information.

In 2012, the Supreme Court stated that even when a lawyer is subject to bankruptcy proceedings, information on names of clients and on money transfers between lawyer and client will be subject to LLP, and supersede any duty of disclosure unless otherwise provided by a clear statutory provision. In 2013, the Supreme Court concluded that evidence in the form of email correspondence will be considered privileged information if it is sent as a copy to the lawyer, regardless of whether the lawyer has had access to its content. However, taxation and VAT legislation was for posterity amended so that a lawyer is under obligation, regardless of LLP, to give transaction data, and balance and debt information, inclusive of parties to the transaction, to the government. The Supreme Court has also found concerning the Tax Authorities' right of access to email correspondence between a taxpayer and his lawyer to be exempt from the review without further examination. In 2018 the Supreme Court also rejected Økokrim's request to get access to a lawyer’s time sheets. The Supreme Court in addition clarified the duty to produce legal privilege material (in this case a lawyer’s annual accounts) in a redacted version as evidence in a law suit.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

No.

c) How are seized documents put into evidence in a criminal/civil procedure?

Seized documents are first "cleared of LLP" before they become part on an ongoing investigation and are used as evidence. Clearance is done with forensic tools which filters out any legal privilege document by a search of lawyers’ email addresses and other search terms such as “legally privileged”. When the relevant data material is collected and mirror-copied for an investigation, the entity should ensure that the IT or technical personnel together with the lawyer reviews all the material that is identified as privileged, and such documents are excluded from the material.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

LLP may be waived by the party receiving the advice and/or having submitted the privileged information. Such waiver should be made in writing.

If a lawyer is sued by a client for alleged malpractice, the lawyer is free to disclose privileged information to the extent that this disclosure is necessary for their defence. However, information received under a specific confidentiality agreement cannot be divulged even in such cases.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

Documents protected by the LLP cannot be seized by either external or internal investigators, unless the company representative with the necessary authority release the document from the privilege.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

With reference to the question above, there is no reliance on internal investigation with respect to LLP.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

There are several examples of fines for "general data breach" in Norway; however, we are not aware of any data breach privilege cases.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?

LLP applies regardless of the lawyer’s nationality. In a case where an in-house counsel of a US corporation had prepared certain strategy documents in connection with a dispute, it was held that sections containing legal considerations and assessments of litigation risk were to be considered as privileged information, cf. decision by the Appeals Selection Committee of the Supreme Court, 22 December 2000.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Yes, but only if it complies with Norwegian legal requirements, as it does not matter if the advice is provided by a lawyer/in-house counsel of a different jurisdiction.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

We do not have specific case law on this apart from the fact that an in-house lawyer would have to provide LLP documentation to ESA even if under Norwegian law it is covered by the LLP exemption.

Last modified 19 Nov 2021

Oman

Oman

Content to follow shortly.

Last modified 25 Jul 2019

Poland

Poland

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

Lawyers are obliged by a duty to keep confidential all information which they became aware of in the course of providing legal services. In accordance with Polish law, lawyers are bound by the professional secrecy of lawyers, which means that they must keep all information concerning their provision of legal services confidential.

Generally, professional secrecy exists in all kinds of proceedings, including civil, criminal and competition law. However, under some circumstances, strictly provided by law, the secrecy obligation may be waived in criminal and competition proceedings.

There are no specific rules on secrecy regarding data protection matters, ie the general obligation of professional secrecy applies.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

No.

c) Are communications to/by companies and in-house counsel protected by privilege?     

There is no separate law concerning the secrecy of in-house lawyers. Therefore, the abovementioned comments apply to in-house lawyers, provided that in-house lawyers are qualified lawyers (if the in-house lawyer is not a qualified lawyer, ie they are not admitted to the Bar, the professional secrecy rule does not apply to them).

Generally, the abovementioned rules will apply to non-national qualified lawyers (who obtained a professional title in a Member State of the EU or third country and are admitted to the Bar) in the event that they provide services in the territory of Poland. Polish law specifies the scope and limitation of legal services provided by foreign qualified lawyers in the territory of Poland. However, general rules applicable to lawyers will be applicable to foreign qualified lawyers, including the professional secrecy rule.

d) Are there any specific requirements of a privileged incident response engagement letter?

No.

2) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, if they are prepared or obtained for the purpose of giving legal advice.        

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

Yes, generally we recommend to store all such documents at the premises of external lawyers.

c) How are seized documents put into evidence in a criminal/civil procedure?

Documents are seized, analysed by prosecution agency and put in the case files if they are relevant for the proceedings. In civil cases there are no discovery rules.

3) Waiver of Privilege   

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

Professional privilege is an obligation of lawyers towards clients. If a client wants to use document that is privileged, they can do so. Clients may also waive the privilege for the lawyer. It needs to be done expressly.

The most important exception to professional secrecy is covered by the Polish Code of Criminal Procedure. Under its regulation, a judge, after a prosecutor’s motion, can lift the confidentiality obligation and allow a lawyer to be examined as a witness. It could happen for the purpose of justice and in the absence of any other proper evidence. This regulation is highly criticised in Polish legal society and it is used in very limited cases. Furthermore, a lawyer is obliged to disclose information which refers to money laundering or terrorist activities regulated under a separate statute.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

There are no specific rules on this matter related to data protection regulations, general rules apply.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

N/A

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

As mentioned in the answer to question 1, there is no legal privilege under Polish and professional secrecy rules apply instead, therefore there is no relevant case law on data breach privilege to reference.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

The professional secrecy rules are regulated in local law and applicable to lawyers acting in Poland. There are no specific rules or case law we can identify which pertains to cross-border scenario.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

As mentioned above, there is no legal privilege under Polish and professional secrecy rules apply instead. Therefore, there are no clear rules on cross-border applicability of legal privilege and it is unclear whether foreign data would be treated as privileged in Poland.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

As mentioned above, in the case of proceedings on the territory of Poland, lawyers are bound by the professional secrecy of lawyers, which means they must keep all information concerning their provision of legal services confidential. For exceptions applicable to criminal proceedings, please refer to question 3a.

Last modified 19 Nov 2021

Portugal

Portugal

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?

No, legal privilege legal framework applies regardless of the type of investigation.

In Portugal, legal professional privilege is recognized as a fundamental right and duty of the lawyer, safeguarded both in the constitution of the Portuguese Republic and in secondary legislation (civil and penal legal frameworks).

Under the Statute of the Portuguese Bar Association (EOA), the broad definition of legal professional privilege covers a broad spectrum of information and documentation, applying to general legal advice, representation in litigation proceedings and covering all facts that a lawyer becomes aware during or as a result of their professional activity. Every fact and/or document (in any format) related to professional matters disclosed to a lawyer by a client, its associated parties, co-defendants, counterparties, and other, is covered.

Legal professional privilege is binding regardless of whether the lawyer is remunerated or has agreed to carry out the representation or service.

This obligation is applicable to every lawyer that has had, directly or indirectly, any intervention in the matter. In the case of a law firm, this duty is extended to every lawyer and support staff of the firm and in practice, anyone who assists the lawyer is obliged to maintain the same professional privilege, compliance with which should be ensured by a written statement drawn up to that effect before the beginning of the collaboration, and any violation of that duty is a disciplinary infraction.

A lawyer may refuse to testify about facts covered by legal professional privilege. Any acts practiced by a lawyer in breach of legal professional privilege cannot be used as evidence in court. Moreover, breach of legal professional privilege rules can give rise to a disciplinary procedure, as well as civil and/or criminal liability.

Nonetheless, legal professional privilege does not cover facts:

  • known to the public;
  • previously proven in court;
  • deemed a crime in which the lawyer is a suspect of having played an active role;
  • described in public documents/deeds; and
  • absolutely necessary to defend the dignity, rights and legitimate interests of the lawyer or of the client, the authorization of the Bar Association (exceptional cases).

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

No. There are no specific types or categories of legal professional privilege, thus it does not vary depending on whether the privilege relates to legal advice or litigation. The obligation to maintain professional secrecy is not limited in time and exists regardless of whether the act required from the lawyer involves judicial or extra-judicial representation, is paid or free, and even if the lawyer has not accepted the service.

c)  Are communications to / by companies and in-house counsel protected by privilege?

Yes, to the extent in-house counsels are members of the Portuguese Bar Association. In-house counsels have the same rights and are bound by the same duties as independent lawyers, notably as regards legal professional privilege. In fact, under Opinion No. E-07/07 of the General Council of the Bar Association, the search and seizure by the Competition Authority of documents in the office and computer of an in-house lawyer should be considered not only void but may also constitute a criminal act.

d) Are there any specific requirements of a privileged incident response engagement letter?

Under Portuguese law, there are no specific requirements for privileged incident response engagement letters. However, the engagement letter should be concluded in writing, directly between the lawyer and the third party prior to starting the cooperation and should include language making clear that the purpose is to assist the lawyer in the scope of its professional activity and the obligation of the third party to comply with secrecy obligation.

2) Documents and Reports  

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, legal professional privilege extends to any document or data directly or indirectly related to the facts revealed to the lawyer in the course of their professional activity.

If a client suspects a data breach and contacts a lawyer to assist them in clarifying the situation, and consequently the lawyer requests a third-party forensic expert to investigate and prepare a report, we understand that this report will be covered by legal professional privilege.

The engagement letter shall be concluded, in writing, directly between the lawyer and the third party prior to starting the cooperation and should include language making clear that the purpose is to assist the lawyer in the scope of its professional activity and the obligation of the third party to comply with secrecy obligation.

b) Does it matter whether the documents are located at the premises of the client or the lawyer? 

No, it doesn’t matter where the documents are located. Regarding raids, searches and seizures carried out in a law firm (or in any other archive location), please see the answer to Question 2c.

c) How are seized documents put into evidence in a criminal/civil procedure?

Regarding raids, searches, and seizures, those carried out in a law firm, or any other archive location, as well as the interception and recording of conversations or communications (telephone or email registered in the Bar Association) of a lawyer in the exercise of the legal profession, may only be ordered and presided over by a judge in accordance with the EOA. The concerned lawyer, the president of the Regional Council, the president of the delegation or a delegate of the Bar Association, as applicable, should be present.

In the course of a raid, a lawyer may file a complaint for breach of legal professional privilege, in which case the judge must interrupt the investigation of the documents, seal them and wait for the president of the court of appeals to decide whether the documents can be accessed, according to the EOA.

Notwithstanding the above, no correspondence concerning the exercise of the legal profession can be seized, except where such correspondence is related to a criminal fact in relation to which the lawyer has been formally charged, pursuant to the Code of Criminal Procedure and the EOA.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

A lawyer can be authorized by the Portuguese Bar Association to disclose facts covered by professional privilege if it is absolutely necessary for the defense of the dignity, rights and legitimate interests of the lawyer or their clients or representatives. However, even after authorization, lawyers may choose to maintain secrecy.

The waiver must be made by means of a request, signed by the lawyer, and addressed to the President of the District Council to whose geographic area the lawyer’s professional domicile belongs. The request should identify, in an objective, concrete and exact manner, the fact or facts in relation to which the waver is sought, contain the complete identification of the requesting lawyer, be accompanied by the documents necessary for examination of the request and, where the request concerns a proceeding in progress, be accompanied by the relevant procedural documents.

Professional legal privilege can be lifted by order of the court under the Criminal Procedure Code. Although the Bar Association is heard before the court’s decision to waive professional privilege, it is highly discussed whether its opinion is binding or not. Consequently, it is also disputed whether a lawyer that refuses a court order to waive professional privilege incurs a crime of disobedience under the Criminal Code.

It should be noted that professional privilege cannot be waived regarding correspondence between lawyers, as it is considered that this absolutely confidential as long as it is identified as such.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

Legal professional privilege is fully applicable to litigation. This means a lawyer can refuse to disclose facts that are subject to legal privilege. However, a lawyer can be authorized by the Portuguese Bar Association to disclose facts covered by professional privilege if that is absolutely necessary for the defense of the dignity, rights and legitimate interests of the lawyer or their clients or representatives.

In the context of the Data Protection Law (ensuring the implementation of the General Data Protection Regulation in Portugal) anyone who is subject to legal privilege, without cause and the respective consent, reveals or discloses personal data is punished with imprisonment up to one year or a fine up to 120 days. The fine is increased in double in its limits in case of:

  • a worker in public office or equivalent, under the terms of the criminal law;
  • a Data Protection Officer;
  • intention to obtain any patrimonial advantage or other illegitimate benefit;
  • endangering the reputation, honor, or privacy of third parties.

The legal duty of cooperation of public and private entities with the local Data Protection Authority cannot affect the legal privilege duty imposed to the Controller.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

Please refer to our answer b) above.

4) Privacy Litigation  

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

In 2018, the IT systems of some Portuguese law firms were hacked. The documents and information disclosed were almost all subject to legal professional privilege and included clients’ personal data, from their addresses, citizen card numbers, mobile phone number and social security and taxpayer numbers. This case is still on trial.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?       

Yes, the Code of Conduct for European Lawyers contains provisions regulating the legal privilege in the scope of cross-border/multi-state activities, notably, establishing that a lawyer of a Member State may be obliged to respect the professional rules of other Member States’ Bar Associations.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

In the EU, the Code of Conduct for European Lawyers sets forth that it is subject to legal privilege the information that a Lawyer gains knowledge in the scope of their professional activity.

Thus, in general terms, the legal professional privilege extends to lawyers who are admitted to a Bar Association in an EU Member States. The Code of Conduct for European Lawyers sets forth that while acting in other Member States, a lawyer may be bound to comply with the professional rules of the Bar or Law Society of the host Member State, which means that non-national lawyers acting in Portugal must comply with the Portuguese Lawyers’ Bar Statutes and, in general, with Portuguese Law. Hence, in these circumstances they are subject to the same guidelines and code of conduct as Portuguese lawyers, notably the rules of legal professional privilege.

In the case of communications, a lawyer of a Member State who sends a communication to a lawyer in other Member State must indicate that the communication is “confidential.”

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?     

Please refer to our answer above in relation to investigations outside Portugal in an EU Member State.

Last modified 19 Nov 2021

Qatar

Qatar

Content to follow shortly.

Last modified 25 Jul 2019

Romania

Romania

Content to follow shortly.

Last modified 15 Mar 2019

Russia

Russia

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

Russian law does not in general recognise the concept of legal professional privilege. However, the concept of legal professional privilege is still expressed in certain ways. The most similar concept is advocate secrecy. An advocate secret is any information connected with an advocate providing legal services to their client. Such information may include:

  • the fact of an advocate being contacted by a client;
  • the information obtained by an advocate from their client;
  • the evidence and documents collected by an advocate while preparing for a case; and
  • the content of legal advice provided to the client.

An advocate secret is protected by law and there is no need to enter into a special agreement (ie a confidential agreement).

Information considered an advocate secret cannot be requested to be provided to any state bodies (either in the context of civil or criminal litigation or upon the request of the antimonopoly authority). Advocates cannot be questioned as a witness regarding circumstances that became known to them while rendering legal services to their clients.

Under Russian law, not every lawyer is considered an advocate. To gain the status of an advocate, a candidate must meet the special requirements set out in the federal law and pass a special exam.

If a lawyer does not have the status of an advocate, the information they receive from their clients can be protected by a regime of commercial secrecy. This regime differs from the concept of legal professional privilege.

Commercial secrecy is a specific regime for protecting confidential information. Commercial secrecy covers information of any character (production, technical, economic, organisational, etc, including the results of intellectual activity in the scientific and technical area, as well as information on the methods for performing a professional activity) which has an actual or a potential commercial value because it is unknown to third parties. A regime of commercial secrecy is deemed to have been established if the holder of commercially secret information has adopted the set of measures listed in federal law to protect the confidentiality of the information.

A commercial secret cannot be disclosed to third parties unless it is officially requested by an authorised state body (investigating agencies, agencies in charge of a pre-trial inquests, judicial authorities and antimonopoly bodies). A commercial secrecy regime cannot be applied to certain types of data specifically excluded by law (for example, constituent documents, documents confirming entries in the relevant state registers, etc). This means that the commercial secrecy regime does not provide immunity against document requests or seizure during inspections conducted by any competition authority (including dawn raids).

Russian competition law specifies that commercial secrecy cannot be established in relation to information provided by a party to a competition investigation on its own initiative to the regulatory authority. This means that commercial secrecy can only be applied to information that has been provided in response to a request from the competition authority, or obtained by the competition authority during an inspection.

The competition authority should not disclose any commercial secret obtained in the course of the exercise of its powers, except in specific circumstances permitted by law (eg upon the request of a court, investigation agency, etc). Therefore, the commercial secrecy regime does not necessarily protect information or documents from disclosure to the competition authority, but it does serve to protect it from further disclosure by the competition authority to third parties (including other parties to the antimonopoly case).

If a commercial secret is wrongfully disclosed. the relevant employees of the competition authority may be subjected to civil, administrative and/or criminal liability. Damage caused by the disclosure of a commercial secret may be compensated by the state.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

N/A

c) Are communications to/by companies and in-house counsel protected by privilege?     

In-house counsel cannot disclose to third parties (except authorised state bodies) commercial secrets which they obtained during the performance of their employment. Authorised state bodies have a right to seize documents or question an in-house counsel as part of a special inspection of the company or criminal prosecution of the head of the company or other employees, as well as in other special cases.

There is a general human and constitutional right for the secrecy of correspondence, telephone calls, etc (Article 23 of the Russian Constitution). This right can be limited if the information is officially requested by authorised state bodies. However, this applies only to private correspondence and not to official/business correspondence.

d) Are there any specific requirements of a privileged incident response engagement letter?

N/A

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Those documents can be protected if they fall under an advocate secret or commercial secret, as described above.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

No, the key consideration is whether this falls under an advocate secret or commercial secret, as described above.

c) How are seized documents put into evidence in a criminal/civil procedure?

No specific rules apply in this regard.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

Advocate secrecy is unlimited in time and can only be waived by the client. There are certain exceptions to this rule stated in the law.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

N/A

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

N/A

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

N/A

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

N/A

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

N/A

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

N/A

Last modified 19 Nov 2021

Saudi Arabia

Saudi Arabia

Content to follow shortly.

Last modified 7 Apr 2020

Scotland

Scotland

Content to follow shortly.

Last modified 15 Mar 2019

Serbia

Serbia

Content to follow shortly.

Last modified 1 Aug 2016

Singapore

Singapore

Content to follow shortly.

Last modified 15 Mar 2019

Slovak Republic

Slovak Republic

Content to follow shortly.

Last modified 15 Mar 2019

Slovenia

Slovenia

Content to follow shortly.

Last modified 28 Jul 2016

South Africa

South Africa

Content to follow shortly.

Last modified 15 Mar 2019

South Korea

South Korea

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?

There are no express provisions regarding attorney-client privilege in Korean law, including with regard to any definition, scope, or applicability.

However, under various laws, there are provisions relating to attorneys’ obligations of confidentiality and the right to refuse to give testimony that may be detrimental to a client. These include:

  • the constitutional right to assistance of counsel (Article 12(4) of Constitution of the Republic of Korea)
  • attorneys’ duty of confidentiality (Article 26 of the Attorney-at-Law Act)
  • attorneys’ right to resist searches and seizures (Article 112 of the Criminal Procedure Act)
  • attorneys’ right to refuse testimony (Article 315, Paragraph 1 of the Civil Procedure Act )
  • attorneys’ right to refuse to testify in respect of secrets of other persons of which they obtained knowledge in consequence of a mandate they received in the course of their profession (Article 149 of Criminal Procedure Act)
  • attorneys’ right to refuse production of documents (Article 344, Paragraph 1, Subparagraph 3, Item C of the Civil Procedure Act)

The Foreign Legal Consultant Act has codified the rule of confidentiality as applied to communications with non-national qualified attorneys (Article 30 of the Foreign Legal Consultant Act).

Some practitioners therefore take the view that the concept of legal professional privilege is recognized under Korean law as a by-product of those confidentiality obligations.

There have been continuous legislative attempts to introduce attorney-client privilege into the Korean legal system. In fact, a group of members of the National Assembly introduced two separate bills concerning attorney-client privilege during the 20th National Assembly (2016~2020). These bills suggested amendments to the current Attorney-at-Law Act to include a provision expressly granting the right to refuse disclosure of documents containing privileged communications between an attorney and their client, unless there is a special exception permitting disclosure or the client consents to its disclosure. But these bills were not passed by the National Assembly and subsequently discarded with the end of the 20th National Assembly’s term. Currently in the 21st National Assembly (2020-2024), a proposed amendment to the Attorney-at-Law Act would expand Article 26 on the attorney’s duty of confidentiality to include the protection of clients’ rights via attorney-client privilege. The amended Article 26 would prevent the disclosure of:

  • confidential communications between an attorney and a client relating to a matter;
  • any material provided by a client to an attorney relating to a matter; and
  • any material prepared by an attorney relating to a matter, unless
    • the client consents to such disclosure;
    • there is significant public interest for disclosure, such as the client obtaining legal advice for criminal purposes; or
    • the attorney must disclose such material or communications to defend themself in a dispute with the client.

Further, the amendment would prohibit such protected communications and materials from being used as evidence in any judicial or administrative proceeding. However, whether the proposed bill will be passed by the National Assembly and ultimately enacted is yet to be seen.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

As mentioned above, there are no express provisions regarding attorney-client privilege in Korean law.

The proposed amendment to the Attorney-at-Law Act providing for such privilege does not stipulate any particular time period for asserting privilege.

c) Are communications to / by companies and in-house counsel protected by privilege?

Correspondence between an in-house counsel and their clients is not expressly denied protection by legal professional confidentiality. In the case of in-house counsel, the existence of privilege is subject to stricter examination. In other words, one would have to consider that there is a strong opinion against protecting attorney-client privilege between in-house counsel and the company because in-house counsel has a dual position as an employee and counsel at the same time.

The proposed amendment to the Attorney-at-Law Act providing for such privilege does not differentiate between outside and in-house counsel with respect to asserting privilege.

d) Are there any specific requirements of a privileged incident response engagement letter?

The proposed amendment to the Attorney-at-Law Act providing for such privilege does not provide for any specific requirements regarding a privileged incident response engagement letter. However, should the proposed amendment become law, it would be advisable for such letters to include statements that the third party is involved for the attorney to advise the affected entity, to maximize the chance of protecting any communications and material with privilege.

2) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

The proposed amendment to the Attorney-at-Law Act providing for such privilege may protect such material, as long as it is provided to or prepared by the attorney. However, the proposed amendment is silent on the scope of such privilege, such as whether the copy of the material provided to the attorney still in the client’s possession is also protected by privilege, or whether material prepared by third parties who are retained by the attorney for a matter is also protected by privilege.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?

Please see our response to question 2a above.

c) How are seized documents put into evidence in a criminal / civil procedure?

Pursuant to Article 112 of the Criminal Procedure Act, a person who is or was a licensed attorney may resist search or seizure of articles entrusted to them by their clients on the basis that they are confidential.

In practice, however, when a search or seizure is conducted against a corporation, any legal opinions/advice from in-house counsel are not protected by legal professional confidentiality, and may be used and investigated by the investigative authorities. The Korean courts do not sanction such practice.

Therefore, documents obtained via seizure by investigative agencies can be used as evidence in the same manner as other evidence according to the relevant evidentiary laws in either the Civil Procedure Act or the Criminal Procedure Act.

The proposed amendment to the Attorney-at-Law Act providing for such privilege would prevent such documents from being used as evidence. One of the exceptions to privilege ((a) the client consents to disclosure, (b) there is significant public interest for disclosure, such as the client’s obtaining legal advice for criminal purposes, or (c) the attorney must disclose such material or communications to defend him/herself in a dispute with the client) would have to be met for such material to be used as evidence in any judicial or administrative proceeding.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

There are a number of situations in which legal professional confidentiality may not apply or may be waived. For example, legal professional confidentiality can be waived if necessary steps were not taken to ensure that the communications, both written and oral, were undertaken in confidence, or if the client or the attorney voluntarily discloses confidential information during an investigation.

The proposed amendment to the Attorney-at-Law Act providing for such privilege provides for limited exceptions to such privilege, ie:

  • the client consents to disclosure;
  • there is significant public interest for disclosure, such as the client obtaining legal advice for criminal purposes; or
  • the attorney must disclose such material or communications to defend themself in a dispute with the client.

In addition, communications between attorneys and clients must be confidential to be protected (the same condition is not stipulated for material provided by the client to the attorney, or material prepared by the attorney in the current amendment). Therefore, under the proposed amendment, the client would have to ensure that communications with the attorney are confidential to maximize the scope of privilege.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

If a company needs to rely on the findings of internal investigations and use them in a data breach litigation as favorable evidence, such reliance and use can be deemed as consenting to disclosure under the proposed amendment to the Attorney-at-Law Act. Yet, it is unclear as to whether a concept called “issue waiver” would apply under the current version of the amendment.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

The amendment to the Attorney-at-Law Act does not have express provisions. However, whether notification to or sharing of the information constitutes a waiver will depend on the scope and nature of the information being shared with affected individuals or third parties in individual cases. Therefore, to avoid being deemed as an inadvertent waiver, one should exercise prudence and care when sharing the contents of such information.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

We have not located any court decision in which the issue of data breach privilege was addressed.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?

South Korea is not a multi-state nation, so the question would be inapplicable. The proposed amendment does not expressly contemplate cross-border scenarios.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

The proposed amendment does not have express provisions governing the situation above. Therefore, whether the privileged data in another jurisdiction would be treated as privileged in our jurisdiction is up to judicial determination through case laws.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?

The proposed amendment does not have express provisions governing the situation above. In a similar vein, it also remains to be seen what (additional) elements our courts would require so privileged data in a foreign jurisdiction would remain privileged in our jurisdiction.

Last modified 5 Aug 2019

Spain

Spain

Content to follow shortly.

Last modified 15 Mar 2019

Sweden

Sweden

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

The general rule on legal privilege in Sweden is the following: An advocate has a duty of confidentiality in respect of matters disclosed to the advocate within the framework of the legal practice or which in connection therewith becomes known to the advocate. Exceptions from the duty of confidentiality apply if the client consents thereto or where a legal obligation to provide the information is at hand.

An exception also applies if disclosure is necessary to enable the advocate to avert complaints by the client or to pursue a justified claim for compensation in respect of the mandate concerned.

This general rule also applies in the contexts mentioned and there is thus no specific legal privilege arising in the contexts mentioned.

"Matters disclosed" is given a wide interpretation and includes everything disclosed to the advocate, including but not limited to correspondence, notes and reports made/prepared by the advocate, the client, the opponent or a third party.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

No there are no specific time periods and the legal privilege applies also after a specific matter/instruction has been concluded and ended.

c) Are communications to/by companies and in-house counsel protected by privilege?     

Yes, all communications to/by an advocate within the framework of the legal practice is protected by privilege including communications to/by companies and in-house legal counsel.

d) Are there any specific requirements of a privileged incident response engagement letter?

No.

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, all communications to/by an advocate within the framework of the legal practice is protected by privilege.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

No, if the documents are subject to legal privilege this should not matter. Having said this, there are cases in Sweden in which the legal privilege has in fact been broken when the documents are located at the premises of the client or a third party, especially in connection with seizures and investigations carried out by Swedish public authorities/agencies. On a related note, Stockholm District Court has ruled (T 7678-18) that mirroring of a hard drive at a parent company's address, where two defendants that were board members of the subsidiary subjected to seizure, also had their workplaces, did not mean that the mirroring occurred with a third party. Furthermore, Stockholm District Court stated that legal privilege should not be considered broken as a consequence of information being available both with the subsidiary and the parent company.

c) How are seized documents put into evidence in a criminal/civil procedure?

If documents in possession of an advocate or the client lawfully have been seized in connection with criminal or some types of administrative proceedings, then the public prosecutor or the public authority /agency concerned may rely on and present the documents in Swedish criminal or administrative proceedings. Depending on the content in the seized documents, the court may decide that the content of the seized documents should be treated as confidential in the court proceedings.

There are no means available for carrying out and executing a forced seizure of documents within the framework of Swedish civil proceedings. Instead, a party in civil proceedings may ask the court to order the other party to present certain specified documents, an Edition Order. If an Edition Order is issued and the documents are not presented, the other party may be called to a hearing and under oath declare that the party is not in possession of the documents. However, an Edition Order may not be granted against an advocate or concern documents that are subject to legal privilege.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

Yes, waiver of legal privilege is always possible by the party or parties protected by the legal privilege. If a waiver is given it is pertinent to consider what the waiver should encompass and to document this in clear language.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

Yes, we can envisage that there might be situations in which a company needs or wants to rely findings of internal investigations and if so, this could be construed as that privilege being waived by the company concerning the findings revealed/disclosed.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

It is difficult to provide a general answer to this. The company notifying affected individuals or sharing findings with third parties could, if the company wants to mitigate the risk for this being construed as a waiver, state to the individuals/third parties that the findings of internal investigations disclosed are strictly confidential and that they may not be disclosed by them to any one unless there is a legal obligation to do so such as a binding court order to this effect or if express consent hereto is obtained.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

No.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

Not that we are aware of. However, the Swedish Bar Association position is that the laws and regulations on legal privilege that apply for non-Swedish advocates should be recognised and upheld in Sweden.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

It is difficult to provide a general answer to this. We trust that if the privileged data deriving from outside Sweden would also classify as privileged data in Sweden, then the answer should generally be yes. Other situations are difficult to assess without knowing and considering the specific circumstances and facts.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

A non-Swedish court or a non-Swedish public authority/agency cannot enforce an order to disclose privileged data directly against a Swedish advocate or a person residing in Sweden or a Swedish legal entity. They can possibly seek assistance from Swedish courts and/or authorities/agencies to do so, if there is a treaty on legal aid in place that deals with privileged data. Even if so, material Swedish laws and regulations concerning privileged data will in all likelihood be upheld.

Last modified 19 Nov 2021

Switzerland

Switzerland

Content to follow shortly.

Last modified 20 Aug 2016

Thailand

Thailand

Content to follow shortly.

Last modified 15 Mar 2019

Turkey

Turkey

Content to follow shortly.

Last modified 21 Oct 2015

Ukraine

Ukraine

Content to follow shortly.

Last modified 15 Mar 2019

United Arab Emirates

United Arab Emirates

Content to follow shortly.

Last modified 5 Aug 2019

United States

United States

Content to follow shortly.

Last modified 15 Mar 2019

Legal professional privilege is derived from the common law and from legislation, such as the Evidence Act 1995 (Cth), at both a state and federal level. It is important to remember that legal professional privilege (which is often referred to as client privilege) is a fundamental right that vests in the client.

Confidential communications between a lawyer and their client, one or more lawyers acting for the client, or lawyers acting for the client and a third person (such as an expert witness) for the dominant purpose of providing legal advice or professional legal services in relation to a current or pending legal proceeding are protected by legal professional privilege.

Legal professional privilege also extends to confidential documents prepared for the purpose of giving or obtaining legal advice and for the purpose of a legal proceeding. Legal professional privilege may be abrogated by some common law exemptions and by the express and / or necessary implication of legislative provisions.

For example, if a client seeks legal advice in an attempt to further a crime or fraud, this advice and related communications will not be subject to legal professional privilege. Further, a claim of legal professional privilege is unlikely to be able to be maintained if it is being used to frustrate a process of law. Legal professional privilege applies in the context of criminal investigations and in the context of regulatory investigations by authorities such as the competition authority.

Legal professional privilege in the context of civil litigation

In the context of civil litigation, where the court may order documents to be produced during processes such as discovery, such orders will not require documents that are subject to a claim of legal professional privilege to be produced. However, the documents will need to be identified in a list of documents that is provided to the party seeking discovery.

What is protected by legal professional privilege?

Communications and / or documents must be confidential and have occurred or come into existence for the 'dominant purpose' of obtaining legal advice or in relation to actual or anticipated litigation in order to attract legal professional privilege.

The purpose for which a communication occurs or a document is brought into existence is a question of fact that must be determined objectively. Evidence of the intention of the document's creator, or of the person who authorised or procured it, is not necessarily conclusive.

'Dominant' has been held to mean a 'ruling, prevailing or most influential' purpose. In determining whether the dominant purpose exists, the courts will examine the circumstances of the case objectively, rather than considering the subjective view of the person making the communication.

Typically, legally privileged communications occur between a client and their legal adviser, but can include those between a client and a third party (eg consultant) where the client engages the third party to produce something (eg tax advice) for the purpose of obtaining legal advice.

If the dominant purpose test is met, legal professional privilege may extend to documents such as:

  • Notes, memoranda or other documents made by staff of the client, if those documents relate to information sought by the client's legal adviser to enable legal advice to be provided
  • A record or summary of legal advice, even if prepared by a non-lawyer, but not to the client's opinions on, or stemming from, the legal advice
  • Drafts, notes and other material brought into existence by the client for the purpose of communication to the lawyer, whether or not they are actually communicated to the lawyer, or
  • A lawyer's revisions of the client's draft correspondence

Are communications with in-house counsel protected by legal professional privilege?

In Australia, courts have considered whether in-house lawyers are protected by legal professional privilege by assessing whether they are acting in their capacity as a lawyer and have the requisite independence to provide unfettered advice.

To attract legal professional privilege, communications / documents must be made in a lawyer's capacity as a lawyer in order to provide the client with legal advice or for the purpose of actual or anticipated litigation.

Communications made by in-house lawyers who act beyond their role as a legal adviser (eg by weighing in on operational matters) will fall outside the scope of legal professional privilege. This is also the case if a communication or document is found to have been made for mixed purposes.

Exercising independent professional judgement is a key factor that will be considered in establishing whether in-house counsel is acting in the capacity of a lawyer. Claims for legal professional privilege have been rejected on the basis that in-house counsel have not acted at sufficient arm's length from their client, such as when documents are produced by in-house lawyers who are subject to the directions of their managers and therefore giving rise to the impression that they lack the necessary independence.

Legal professional privilege has also been denied in relation to communications where in-house lawyers have been involved in the commercial decision-making of a transaction.

Whether an in-house lawyer has a practising certificate has also been considered by courts in Australia when deciding whether legal professional privilege should apply to their advice. While failing to have a current practising certificate is not necessarily fatal to a claim of legal professional privilege, it may lead to a court inferring that the communications made and documents created by the in-house lawyer are not for the purpose of providing legal advice or for the purpose of litigation.

Does legal professional privilege apply to the correspondence of non-national qualified lawyers?

Legal professional privilege is available in relation to legal advice from foreign lawyers, provided that the 'dominant purpose' requirement is met.

How is legal professional privilege waived?

A client will be deemed to have waived legal professional privilege if the client acts in a way which is inconsistent with the confidentiality which the legal professional privilege is supposed to protect. Waiver of legal professional privilege may be implied in some circumstances.

It is important to maintain the confidentiality of communications and documents that legal professional privilege attaches to. Legal professional privilege has been deemed to be waived in circumstances where the substance, general essence or conclusion of legal advice has been communicated in a public forum such as a media statement, board papers that have been provided to third parties or during negotiations.

Legal professional privilege in the context of merger control

Under the Competition and Consumer Act 2010 (Cth), the Australian Competition and Consumer Commission (ACCC) has broad powers to compel the production of documents, including by way of subpoenas and search warrants.

The general principles of privilege (as outlined above) apply to competition or merger control in Australia, and in respect of enforcement action taken by the ACCC.

Whilst it is clear that documents subject to legal professional privilege are protected from compulsory disclosure and requests for production by regulators (such as the ACCC), it is often impossible to ascertain if documents are privileged if the production of the documents is required immediately. If that is the case, the person or company that is the subject of the immediate requirement to produce documents ought to identify the potentially privileged documents, and reserve the right to assert a claim of privilege. The potentially privileged documents should be produced separately, and in a sealed package, to the regulator. If agreement cannot be reached with the regulator as to whether the documents are privileged, the issue of privilege will be determined by the Court.

Typically, records of internal investigations will be privileged where they were generated for the purpose of providing legal advice on the subject matter of the investigation. On the other hand, records of a transaction will generally not be privileged, even if that transaction is later investigated.

Waiver of legal professional privilege

Recent cases have highlighted that parties and practitioners must take care to avoid the unintentional waiver of legal professional privilege. For example, in ASIC v Park Trent Properties Group Pty Ltd [2015] NSWSC 342, the Supreme Court of New South Wales held that the defendant had waived privilege over legal advice provided in the preparation of a compliance manual by voluntarily disclosing the manual to the Australian Securities and Investments Commission (ASIC). Key to the court’s finding was that:

  • The legal advice shaped the substance of the manual, and
  • The manual was deployed to obtain an advantage

This decision reaffirms that privilege can be waived by disclosing the effect of the legal advice, regardless of whether the advice itself is disclosed. Accordingly, it reminds parties to think twice before voluntarily disclosing compliance material that has been prepared by lawyers.

The Western Australian Supreme Court recently found that the privilege in lawyer-client emails may be waived if a third party is copied. In TEC Hedland Pty Ltd v. The Pilbara Infrastructure Pty Ltd [2018] WASC 300, the central issue was whether the maintenance of the privilege is inconsistent with the use of the relevant communication. TEC had agreed to supply electricity to Pilbara. B&V, the party copied into the emails between TEC and its lawyers, had been engaged to perform a test procedure. The test procedure was one of the issues in dispute. The court referred to the Full Federal Court decision of Bennett v Chief Executive Officer of the Australian Customs Service [2004] FCAFC 237 and endorsed the principle that:

'for a client to deploy the substance or effect of legal advice for forensic or commercial purposes is inconsistent with the maintenance of the confidentiality that attracts legal professional privilege'.

The court concluded that TEC had waived privilege over the emails with its lawyers by copying B&V. This case confirms the importance of ensuring only essential parties, and not third parties, are copied into privileged communications.

Illegality

The principle that legal professional privilege does not apply to communications made for improper and / or illegal purposes is well settled. The Federal Court has applied this principle in circumstances where the lawyers involved were not necessarily aware of the illegality. In Aucare Dairy Pty Ltd v Huang [2017] FCA 746, there was evidence to indicate that the defendant, Huang, had moved and / or placed ownership of assets of an insolvent company beyond the reach of Aucare, with whom the insolvent company had previously been in a failed joint venture with. The court found that Huang's lawyers knew and / or participated in the alleged fraud, despite the plaintiff not having suggested this and there being no direct evidence that this was the case. The court ordered production of privileged correspondence between Huang and her lawyers. This case emphasises that there is a risk that where there is evidence of illegality and / or improper purpose by a party, that party will not be entitled to legal professional privilege.

Directors

In Equititrust Ltd (in Liq) (Receivers appointed) (Receivers and Managers Appointed) v Equititrust Ltd (in Liq) (Receiver appointed) (Receivers and Managers Appointed) (No.3) [2016] FCA 738, the Federal Court held that a director may only claim privilege over documents containing legal advice if it relates in some way to the director in their personal capacity, and not merely to the operations of the company. A former director of Equititrust claimed privilege (both joint and common interest) over a range of documents produced by Equititrust that contained legal advice. The court held that only 11 of the 625 disputed documents were privileged. In relation to joint privilege, the court found that there was scarce evidence that the director had personal concerns in the matters raised by the documents disputed and clarified that: legal advice addressed to a director or 'the Directors' did not necessarily mean that the advice was provided on the basis of joint privilege; and the fact that a director was involved in procuring the legal advice did not on its own establish joint privilege. In relation to common interest privilege, the court highlighted that commonality of interest is a prerequisite for the privilege to apply – the mere fact that legal advice was communicated to Equititrust does not mean that its directors had a common interest privilege in that advice; and the fact that a company can only act though its directors does not give rise to a common interest. This case reminds directors of the need to clearly identify legal advice obtained in their personal capacity in order for it to be subject to privilege.

Trustees

In Hancock v Rinehart (Privilege) [2016] NSWSC 12, Gina Rinehart claimed privilege over documents produced by her former lawyer pursuant to a subpoena issued by her daughter, Bianca, as the new trustee of the Hope Margaret Hancock Trust (Gina was the former trustee). The Supreme Court of New South Wales found that there was no evidence to support Gina's claim of privilege. Gina had not adduced any evidence about the circumstances and purposes of the disputed documents, including whether the documents had been created for Gina in her capacity as trustee. The court noted that if the costs of obtaining legal advice are paid from the trust fund, the suggestion is that advice was obtained on behalf of the trust and not the trustee personally. This case reiterates the position that legal advice obtained by a trustee belongs to the trust and not the trustee personally.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?

Internal Investigations

Legal professional privilege applies in the context of civil proceedings, criminal investigations and in the context of regulatory investigations by authorities such as the office of the Australian Information Commission (the primary privacy regulator in Australia).

The test for legal professional privilege in each context (internal, criminal and data protection matters) in Australia is the same.

Legal professional privilege is derived from the common law and from legislation, such as the Evidence Act 1995 (Cth), at both a state and federal level. In Australia, legal professional privilege (which is often referred to as client privilege) is a fundamental right that vests in the client – not in or with the lawyer.

The test – in summary

Confidential communications:

  • between a lawyer and their client, one or more lawyers acting for the client, or lawyers acting for the client and a third person (such as an expert witness);
  • which are for the dominant purpose of providing legal advice or professional legal services; and
  • are in relation to a current or pending legal proceeding, are protected by legal professional privilege.

Legal professional privilege also extends to confidential documents prepared for the purpose of giving or obtaining legal advice and for the purpose of a legal proceeding. For example, a report/document prepared by a forensic IT consultant or an internal IT operative that is created to obtain legal advice will normally be privileged.

How is privilege lost?

Legal professional privilege may be abrogated by some common law exemptions and by the express and/or necessary implication of legislative provisions.

For example, if a client seeks legal advice in an attempt to further a crime or fraud, this advice and related communications will not be subject to legal professional privilege. Further, a claim of legal professional privilege is unlikely to be able to be maintained if it is being used to frustrate a process of law.

In the context of civil litigation, where the court may order documents to be produced during processes such as discovery, such orders will not require documents that are subject to a claim of legal professional privilege to be produced. However, the documents will need to be identified in a list of documents that is provided to the party seeking discovery.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

There is no limitation period placed on legal professional privilege in Australia.

c) Are communications to/by companies and in-house counsel protected by privilege?     

In Australia, courts have considered whether in-house lawyers are protected by legal professional privilege by assessing whether they are acting in their capacity as a lawyer and have the requisite independence to provide unfettered advice.

To attract legal professional privilege, communications or documents must be made in a lawyer's capacity as a lawyer in order to provide the client with legal advice or for the purpose of actual or anticipated litigation.

Communications made by in-house lawyers who act beyond their role as a legal advisor (for example by weighing in on operational matters) will fall outside the scope of legal professional privilege. This is also the case if a communication or document is found to have been made for mixed purposes.

Exercising independent professional judgement is a key factor that will be considered in establishing whether in-house counsel is acting in the capacity of a lawyer. Claims for legal professional privilege have been rejected on the basis that in-house counsel have not acted at sufficient arm's length from their client, such as when documents are produced by in-house lawyers who are subject to the directions of their managers and therefore giving rise to the impression that they lack necessary independence.

Legal professional privilege has also been denied in relation to communications where in-house lawyers have been involved in the commercial decision-making of a transaction.

Whether an in-house lawyer has a practising certificate has also been considered by courts in Australia when deciding whether legal professional privilege should apply to their advice. While failing to have a current practicing certificate is not necessarily fatal to a claim of legal professional privilege, it may lead to a court inferring that the communications made and documents created by the in-house lawyer are not for the purpose of providing legal advice or for the purpose of litigation.

In a data breach/cyber incident, it is important that any in-house counsel makes it clear when they are giving legal advice and when they are acting in an operational capacity – for example as an incident response coordinator which may involve giving commercial advice on how to respond to the incident.

d) Are there any specific requirements of a privileged incident response engagement letter?

Yes, it is recommended that external counsel engage any third parties required to assist with a response in order to best set up an ability to claim privilege over the work done.

All third-party engagement letters should include a statement that the third party is being involved for DLA Piper/in-house counsel to advise the affected entity.

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes.

Communications or documents must be confidential and have occurred or come into existence for the “dominant purpose” of obtaining legal advice or in relation to actual or anticipated litigation to attract legal professional privilege. The term “dominant” has been held to mean a “ruling, prevailing or most influential” purpose.

To avoid any later arguments as to what the dominant purpose of the document, it is recommended that a lawyer (internal or external) prepare the record of the interview if at all possible. If it is not possible for a lawyer to prepare the record of the interview, it should be clearly noted at the commencement of the interview that the purpose of the interview is to enable the affected entity to obtain legal advice.   

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

It does not matter whether the documents are located at the client or lawyer's premises.

c) How are seized documents put into evidence in a criminal/civil procedure?

Generally, privileged materials cannot be used in legal proceedings in Australia.

There are extremely limited circumstances where this general rule will not apply.

A party who claims privilege will generally have a right to object to use of privileged material. External counsel should be briefed as a matter of urgency if a government agency or third party attempts to use privileged materials.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

A client will be deemed to have waived legal professional privilege if the client acts in a way that is inconsistent with the confidentiality which the legal professional privilege is supposed to protect.

The waiver of legal professional privilege is available under several circumstances. Firstly, the privilege can be waived by disclosing the effect of the legal advice, regardless of whether the advice itself is disclosed. Accordingly, it reminds parties to think twice before voluntarily disclosing compliance material that has been prepared by lawyers.

Secondly, the privilege may be waived if a third party is copied into the communication. The principle endorsed by the Full Federal Court is that “for a client to deploy the substance or effect of legal advice for forensic or commercial purposes is inconsistent with the maintenance of the confidentiality that attracts legal professional privilege.”

The legal professional privilege will also not apply in circumstances where the communications are made for improper and/or illegal purposes, notwithstanding the fact that the lawyers involved were not necessarily aware of the illegality. The Federal Court in Aucare Dairy Pty Ltd v Huang emphasised that there is a risk that where there is evidence of illegality and/or improper purpose by a party, that party will not be entitled to legal professional privilege.

Additionally, legal professional privilege may only be claimed by a company director over documents containing legal advice if the documents are related in some way to the director in their personal capacity and not merely to the operations of the company. The Federal Court found in Equititrust Ltd (in Liq) (Receivers appointed) (Receivers and Managers Appointed) v Equititrust Ltd (in Liq) (Receiver appointed) (Receivers and Managers Appointed) (No.3) that the fact documents containing legal advice were addressed to a director or “the Directors,” or procured by a director did not mean that the director had personal concerns in the matters raised by the documents disputed or mean that the advice was provided on the basis of joint privilege.

The Court also held that commonality of interest is a prerequisite for common interest privilege to apply and that the mere fact the legal advice was communicated to Equititrust and that a company can only act through its directors did not mean that its directors had a common interest privilege in that advice.

Legal professional privilege was also dismissed in Hancock v Rinehart where the Supreme Court of New South Wales held that legal advice obtained by a trustee belongs to the trust and not the trustee personally. The Court noted that the costs of obtaining the legal advice were paid from the trust fund, and accepted the suggestion that the advice was obtained in behalf of the trust and not the trustee in her personal capacity.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

It may be possible that a company could wish to rely on a privileged report or documents created during an investigation. In those circumstances it will be necessary to waive privilege.

It may be possible to waive privilege only in that document but care must be taken.

External legal counsel should be engaged in any discussion about a decision to waive privilege as in Australia it is possible, through a concept called "issue waiver" to lose privilege over all materials relating to a particular topic.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

It will depend on the scope and nature of the information shared.

Again, care should be taken as to the contents of such notifications so as to not inadvertently waive privilege.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

We have not located any decisions on privilege that have arisen in the context of a data breach in the last five years.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

Australia is a federation. There is relevant legislation dealing with privilege at a federal and state level, as well as in the common law.

There are numerous courts cases that consider cross-border privilege issues.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Yes, that is the general approach.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

The critical element to maintaining privilege in Australia is to ensure that the privileged material remains confidential and that there is no express or implied (through conduct) wavier of that privilege.