Data Dive

In ongoing multidistrict litigation concerning Capital One’s 2019 data breach, Capital One succeeded in defeating a motion to compel disclosure of a privileged root cause analysis conducted by PwC. In contrast to an earlier ruling requiring Capital One to turn over a similar root cause analysis conducted by cybersecurity expert Mandiant, the court found that Capital One’s general counsel engaged PwC through a distinct and legally privileged representation to assist the company with its fiduciary and legal duties in anticipation of litigation. Last month, a federal court in D.C. ordered Clark Hill, PLC to produce a forensic report that was prepared following a data breach, finding that Clark Hill had not met its burden to show that the report would not have been prepared in the ordinary course of business, and rejecting Clark Hill’s reliance on a two-tracked approach to the forensic investigation to support its privilege claims because there was little evidence in the record that it had actually taken such an approach. As these rulings show, privilege determinations vary widely, but adhering to best practices can maximize the chance of avoiding disclosure.