1) Privilege in Investigations
a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?
Legal professional privilege applies in the context of civil proceedings, criminal investigations and in the context of regulatory investigations by authorities such as the office of the Australian Information Commission (the primary privacy regulator in Australia).
The test for legal professional privilege in each context (internal, criminal and data protection matters) in Australia is the same.
Legal professional privilege is derived from the common law and from legislation, such as the Evidence Act 1995 (Cth), at both a state and federal level. In Australia, legal professional privilege (which is often referred to as client privilege) is a fundamental right that vests in the client – not in or with the lawyer.
The test – in summary
- between a lawyer and their client, one or more lawyers acting for the client, or lawyers acting for the client and a third person (such as an expert witness);
- which are for the dominant purpose of providing legal advice or professional legal services; and
- are in relation to a current or pending legal proceeding, are protected by legal professional privilege.
Legal professional privilege also extends to confidential documents prepared for the purpose of giving or obtaining legal advice and for the purpose of a legal proceeding. For example, a report/document prepared by a forensic IT consultant or an internal IT operative that is created to obtain legal advice will normally be privileged.
How is privilege lost?
Legal professional privilege may be abrogated by some common law exemptions and by the express and/or necessary implication of legislative provisions.
For example, if a client seeks legal advice in an attempt to further a crime or fraud, this advice and related communications will not be subject to legal professional privilege. Further, a claim of legal professional privilege is unlikely to be able to be maintained if it is being used to frustrate a process of law.
In the context of civil litigation, where the court may order documents to be produced during processes such as discovery, such orders will not require documents that are subject to a claim of legal professional privilege to be produced. However, the documents will need to be identified in a list of documents that is provided to the party seeking discovery.
b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?
There is no limitation period placed on legal professional privilege in Australia.
c) Are communications to/by companies and in-house counsel protected by privilege?
In Australia, courts have considered whether in-house lawyers are protected by legal professional privilege by assessing whether they are acting in their capacity as a lawyer and have the requisite independence to provide unfettered advice.
To attract legal professional privilege, communications or documents must be made in a lawyer's capacity as a lawyer in order to provide the client with legal advice or for the purpose of actual or anticipated litigation.
Communications made by in-house lawyers who act beyond their role as a legal advisor (for example by weighing in on operational matters) will fall outside the scope of legal professional privilege. This is also the case if a communication or document is found to have been made for mixed purposes.
Exercising independent professional judgement is a key factor that will be considered in establishing whether in-house counsel is acting in the capacity of a lawyer. Claims for legal professional privilege have been rejected on the basis that in-house counsel have not acted at sufficient arm's length from their client, such as when documents are produced by in-house lawyers who are subject to the directions of their managers and therefore giving rise to the impression that they lack necessary independence.
Legal professional privilege has also been denied in relation to communications where in-house lawyers have been involved in the commercial decision-making of a transaction.
Whether an in-house lawyer has a practising certificate has also been considered by courts in Australia when deciding whether legal professional privilege should apply to their advice. While failing to have a current practicing certificate is not necessarily fatal to a claim of legal professional privilege, it may lead to a court inferring that the communications made and documents created by the in-house lawyer are not for the purpose of providing legal advice or for the purpose of litigation.
In a data breach/cyber incident, it is important that any in-house counsel makes it clear when they are giving legal advice and when they are acting in an operational capacity – for example as an incident response coordinator which may involve giving commercial advice on how to respond to the incident.
d) Are there any specific requirements of a privileged incident response engagement letter?
Yes, it is recommended that external counsel engage any third parties required to assist with a response in order to best set up an ability to claim privilege over the work done.
All third-party engagement letters should include a statement that the third party is being involved for DLA Piper/in-house counsel to advise the affected entity.
2) Documents and Reports
a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?
Communications or documents must be confidential and have occurred or come into existence for the “dominant purpose” of obtaining legal advice or in relation to actual or anticipated litigation to attract legal professional privilege. The term “dominant” has been held to mean a “ruling, prevailing or most influential” purpose.
To avoid any later arguments as to what the dominant purpose of the document, it is recommended that a lawyer (internal or external) prepare the record of the interview if at all possible. If it is not possible for a lawyer to prepare the record of the interview, it should be clearly noted at the commencement of the interview that the purpose of the interview is to enable the affected entity to obtain legal advice.
b) Does it matter whether the documents are located at the premises of the client or the lawyer?
It does not matter whether the documents are located at the client or lawyer's premises.
c) How are seized documents put into evidence in a criminal/civil procedure?
Generally, privileged materials cannot be used in legal proceedings in Australia.
There are extremely limited circumstances where this general rule will not apply.
A party who claims privilege will generally have a right to object to use of privileged material. External counsel should be briefed as a matter of urgency if a government agency or third party attempts to use privileged materials.
3) Waiver of Privilege
a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?
A client will be deemed to have waived legal professional privilege if the client acts in a way that is inconsistent with the confidentiality which the legal professional privilege is supposed to protect.
The waiver of legal professional privilege is available under several circumstances. Firstly, the privilege can be waived by disclosing the effect of the legal advice, regardless of whether the advice itself is disclosed. Accordingly, it reminds parties to think twice before voluntarily disclosing compliance material that has been prepared by lawyers.
Secondly, the privilege may be waived if a third party is copied into the communication. The principle endorsed by the Full Federal Court is that “for a client to deploy the substance or effect of legal advice for forensic or commercial purposes is inconsistent with the maintenance of the confidentiality that attracts legal professional privilege.”
The legal professional privilege will also not apply in circumstances where the communications are made for improper and/or illegal purposes, notwithstanding the fact that the lawyers involved were not necessarily aware of the illegality. The Federal Court in Aucare Dairy Pty Ltd v Huang emphasised that there is a risk that where there is evidence of illegality and/or improper purpose by a party, that party will not be entitled to legal professional privilege.
Additionally, legal professional privilege may only be claimed by a company director over documents containing legal advice if the documents are related in some way to the director in their personal capacity and not merely to the operations of the company. The Federal Court found in Equititrust Ltd (in Liq) (Receivers appointed) (Receivers and Managers Appointed) v Equititrust Ltd (in Liq) (Receiver appointed) (Receivers and Managers Appointed) (No.3) that the fact documents containing legal advice were addressed to a director or “the Directors,” or procured by a director did not mean that the director had personal concerns in the matters raised by the documents disputed or mean that the advice was provided on the basis of joint privilege.
The Court also held that commonality of interest is a prerequisite for common interest privilege to apply and that the mere fact the legal advice was communicated to Equititrust and that a company can only act through its directors did not mean that its directors had a common interest privilege in that advice.
Legal professional privilege was also dismissed in Hancock v Rinehart where the Supreme Court of New South Wales held that legal advice obtained by a trustee belongs to the trust and not the trustee personally. The Court noted that the costs of obtaining the legal advice were paid from the trust fund, and accepted the suggestion that the advice was obtained in behalf of the trust and not the trustee in her personal capacity.
b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?
It may be possible that a company could wish to rely on a privileged report or documents created during an investigation. In those circumstances it will be necessary to waive privilege.
It may be possible to waive privilege only in that document but care must be taken.
External legal counsel should be engaged in any discussion about a decision to waive privilege as in Australia it is possible, through a concept called "issue waiver" to lose privilege over all materials relating to a particular topic.
c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?
It will depend on the scope and nature of the information shared.
Again, care should be taken as to the contents of such notifications so as to not inadvertently waive privilege.
4) Privacy Litigation
a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.
We have not located any decisions on privilege that have arisen in the context of a data breach in the last five years.
b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?
Australia is a federation. There is relevant legislation dealing with privilege at a federal and state level, as well as in the common law.
There are numerous courts cases that consider cross-border privilege issues.
c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?
Yes, that is the general approach.
d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?
The critical element to maintaining privilege in Australia is to ensure that the privileged material remains confidential and that there is no express or implied (through conduct) wavier of that privilege.