Can Any Data Breach Investigation Report Deserve Protection? Part II

Last week’s Privilege Point described a data breach victim’s latest losing effort to claim privilege protection for its consultant’s investigation report. Leonard v. McMenamins Inc., Case No. C22-0094-KKE, 2023 U.S. Dist. LEXIS 217502 (W.D. Wash. Dec. 6, 2023). Before bluntly rejecting McMenamins’ privilege claim, the court spent more time analyzing its work product claim before also denying that.

The court began its analysis by pointing to the determinative issue: “whether the report would have been prepared in a substantially similar form absent the anticipation of litigation.” Id. at *6. Like most losers, McMenamins cited one of the only few cases that seem to have succeeded on the work product side. The court first nixed the analogy to In re Target Corp. Customer Data Security Breach Litigation, MDL No. 14-2522 (PAM/JJK), 2015 U.S. Dist. LEXIS 151974 (D. Minn. Oct. 23, 2015), noting that “unlike here, Target had engaged in a two-track investigation” — one purely factual that was later disclosed, and one that supplied Target’s lawyers with the necessary facts (which had even used a “‘separate team from Verizon'” to provide technical input). 2023 U.S. Dist. LEXIS 217502, at *6-7 (citation omitted). The court pointedly noted that “the Stroz Friedberg report is the only internal investigation arising from the data breach.” Id. at *8-9. McMenamins also relied on one of the only other winning data breach work product claims: In re Experian Data Breach Litig., No. SACV 15-01592 AG (DFMx), 2017 U.S. Dist. LEXIS 162891 (C.D. Cal. May 18, 2017). In that case, Jones Day hired a consultant to investigate a data breach — but its “report was not provided to [client] Experian’s internal incident response team.” 2023 U.S. Dist. LEXIS 217502, at *8. In the McMenamins case, “Stroz Friedberg participated in many internal business discussions.” Id. at *9.

Few data breach victims’ investigations are ever very likely to parallel the successful Target scenario (involving two entirely separate investigations) or the Experian scenario (in which Jones Day did not share its consultant’s report with the client). The McMenamins court did identify an appropriate analogy — another loser. Next week’s Privilege Point will describe the court’s analysis, and some practical tips.