1) Privilege in Investigations
a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?
Internal investigations are generally not protected by attorney-client privilege in Finland and there are no directly applicable laws on internal investigation, except for the Finnish Auditing Act (1141/2015, as amended). Chapter 8, section 4 of the Auditing Act sets out a derogation from the provisions on the right to obtain information and carry out inspections concerning advocates, legal counsels, and attorneys. The Auditor Oversight Unit does not have the right to obtain information, documents, or records from the advocate concerning the advocate's client or inspect them. This covers both legal advice and litigation privilege. Notwithstanding the exception to preserve privilege in general, it is advisable that an external counsel is involved.
According to Chapter 15, section 17 of the Finnish Code of Judicial Procedure, an attorney or a legal council may not without permission disclose privileged information that they have obtained in providing legal advice on the legal position of their client in a criminal investigation or in other proceedings prior to legal proceedings.
The elements, as set above, to establish legal privilege also apply to civil matters.
Chapter 6, section 35 of the Finnish Data Protection Act incorporates a separate professional secrecy obligation for information acquired in connection with processing that takes place under the authority of a data controller or data processors.
Furthermore, Chapter 6, section 36 of the Finnish Data Protection Act provides an obligation for the supervisory authority to keep the identity of a natural person, who has notified the authority on possible breaches of data protection laws, in secrecy where the circumstances warrant it.
Breach of either one of the sections in the Finnish Data Protection Act is punishable under the Finnish Criminal Code (39/1889, as amended).
b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?
In principle, documents in the possession of outside counsel are protected by attorney-client privilege. For instance, documents and communications containing general advice provided by an outside counsel prior to any investigation by the authorities enjoy attorney-client privilege protection.
In general, legal privilege only applies to information disclosed after the establishment of an assignment between the client and the counsel. However, information provided by the client, prior to establishing an attorney-client relationship, may still be regarded as privileged information if the nature of such information warrants it. For example, information disclosed to a counsel per said counsel’s request to decide whether to accept an assignment, would be considered privileged information.
c) Are communications to / by companies and in-house counsel protected by privilege?
Legal privilege only applies to documents in the possession of an outside counsel. Therefore, it is recommended that during criminal investigation, an outside counsel is sought to ensure the protection of legal privilege.
d) Are there any specific requirements of a privileged incident response engagement letter?
Not to our understanding.
2) Documents and Reports
a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?
In general, documents are protected by legal privilege if the purpose of such documents relates to the provision of legal advice provided by an attorney. The content of legal professional privilege is in general determined by the prohibitions on evidence laid down in Chapter 17 of the Code of Judicial Procedure. Furthermore, the corresponding exceptions on the legal privilege are described in Chapter 7, section 3 and 4 of the Finnish Coercive Measures Act (806/2011, as amended). For example, under chapter 7, section 3, there is no prohibition on seizure or reproduction if the person in respect of whom the obligation of professional secrecy has been imposed consents to the seizure or reproduction. The other exceptions on prohibition on seizure or reproduction cover, for example, offences with a certain maximum term of imprisonment.
b) Does it matter whether the documents are located at the premises of the client or the lawyer?
In general, it does not matter where the documents are located.
c) How are seized documents put into evidence in a criminal / civil procedure?
Conditions for seizing documents are set out in Chapter 7, section 1 of the Finnish Coercive Measures Act. Accordingly, documents may be seized if they can be used as evidence in a criminal procedure. The evidence (ie the seized document) is named by the party and if necessary, the court decides whether it can be used and whether it should be kept secret.
3) Waiver of Privilege
a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?
Privilege may be waived in three different situations:
- The person whose privilege is at hand waives their right to privilege.
- Privilege yields to a provision of the law.
- Legal protection of the lawyer requires them to be released of privilege.
In addition, the protection of legal professional privilege is under statutory exception of Chapter 15, section 10 of the Finnish Criminal Code (39/1889, as amended), which establishes a responsibility to report to authorities or to the person in danger a serious offence the preparation of which the person with the duty to report has knowledge of.
Furthermore, the Act on Detecting and Preventing Money Laundering and Terrorist Financing (503/2008, as amended) includes disclosure duties which may override lawyers' confidentiality obligations. Also, section 7 d of the Advocates Act (496/1958, as amended) provides that an advocate must openly and truthfully supply the information required by the Disciplinary Board of the Finnish Bar Association in supervisory matters regardless of the possible confidential nature of the information.
b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?
To our understanding, this has no effect on the confidentiality of the attorney or the legal counsel or the prohibitions on evidence laid down in Chapter 17 of the Code of Judicial Procedure. However, this issue has not been addressed in case law.
c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?
In principle, no. However, there are no explicit rules on this and the question of whether a notification or sharing of the findings mean a waiver needs to be assessed on case-by-case basis.
4) Privacy Litigation
a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.
Not to our understanding.
b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?
Not to our understanding.
c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?
In general, it does not matter where the documents are located.
d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?
This needs to be addressed on a case-by-case basis.