Focusing on the primary purpose: Protecting the attorney–client privilege and work product doctrine in incident response

Ashley Taylor, Ron Raether, Sadia Mirza, Sam Hatcher and Bonnie Gill
Additional contact information
Ashley Taylor: Troutman Pepper, USA
Ron Raether: Troutman Pepper, USA
Sadia Mirza: Troutman Pepper, USA
Sam Hatcher: Troutman Pepper, USA
Bonnie Gill: Troutman Pepper, USA

Cyber Security: A Peer-Reviewed Journal, 2022, vol. 5, issue 4, 324-334

Abstract: Organisations responding to cyber security incidents must manage their incident response efforts while maintaining two critical legal protections: the attorney–client privilege and the work product doctrine. This paper analyses how the attorney–client privilege and the work product doctrine, when properly maintained, prevent information regarding an organisation’s thoughts and discussions from being disclosed or used in subsequent proceedings. It discusses how recent judicial decisions analysing the application of these two doctrines have emphasised the importance of seemingly minor details that may be overlooked during incident response efforts that can have significant consequences in subsequent legal actions when asserting protections. In particular, courts will focus on the stated purpose for any step in the incident response process (eg business versus legal), and any discrepancies between the stated purpose and conduct can have disastrous effects on future claims of protection in legal proceedings. This paper puts forward that organisations should craft incident response plans with the maintenance of these protections in mind. Practical steps organisations can take include carefully scrutinising the language in retainer agreements, involving in-house or outside counsel at the earliest opportunity, limiting the disclosure of privileged materials, and exercising caution when documenting during incident response. After-the-fact attempts to shield the results of any investigation from opposing parties in litigation are rarely successful, so organisations should take affirmative steps to ensure the vitality of these two critical legal protections from the earliest stages of incident response, which start with the planning and preparation.

Keywords: attorney–client privilege; work product doctrine; privacy; disclosure; incident response; protection (search for similar items in EconPapers)
JEL-codes: M15 (search for similar items in EconPapers)
Date: 2022
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/7007/download/ (application/pdf)
https://hstalks.com/article/7007/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:csj000:y:2022:v:5:i:4:p:324-334

Access Statistics for this article

More articles in Cyber Security: A Peer-Reviewed Journal from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().