Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 11 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Silicon Valley

Washington, D.C.

<img style="max-width: 100%;height: auto;max-width: 100%;height: auto" loading="lazy" class="alignright size-medium wp-image-4547" src="https://www.thelawforlawyerstoday.com/wp-content/uploads/sites/754/2019/08/Cyber-crime-2-300x300.jpg" alt="" width="300" height="300">The outlines of the attorney-client privilege and work-product doctrine are well-established. But how should they apply when an organizational client suffers a cybersecurity event or other intrusion that results in a data breach?&nbsp; Should information about the company&rsquo;s security policies pre-breach and its post-breach response be given any enhanced protection? Under what circumstances?
The questions are burning ones, given recent data-security catastrophes that have exposed financial, health and other data of millions of people.&nbsp; After each event, claimants quickly line up to file suit, and discovery demands for information inevitably follow.
Sedona Conference recommendations
The <a href="https://thesedonaconference.org/">Sedona Conference</a>, a non-profit, non-partisan institute whose working groups have been influential in e-discovery and other cutting-edge issues, recently published draft commentary recommending adoption of a qualified stand-alone protection for information prepared in a cybersecurity context, even when not involving communication with an organization&rsquo;s lawyer.
The <a href="https://thesedonaconference.org/wgs">Working Group on Data Security and Privacy Liability</a> noted in its 65-page Commentary (available for free download <a href="https://thesedonaconference.org/publication/Commentary_on_Application_of_Attorney-Client_Privilege_and_Work-Product_Protection_to_Documents_and_Communications_Generated_in_the_Cybersecurity_Context">here</a>) that cybersecurity and cybercrime are uniquely important, given that &ldquo;American businesses and government agencies are under cyberattack twenty-four hours a day, seven days a week from criminal third parties,&rdquo; and that &ldquo;the federal government has declared this global cyber-crime wave a compelling national security concern, particularly in the area of critical infrastructure.&rdquo;
Based on evaluating and balancing the competing interests, the Working Group proposed what it calls a &ldquo;stand-alone cybersecurity privilege modeled on the work-product doctrine&rdquo; that would extend to all documents and tangible things reflecting &ldquo;mental impressions, conclusions, opinions, assessments, evaluations or theories&rdquo; regarding a cyberattack, as well as &ldquo;actual or potential actions in anticipation or response to a cyberattack.&rdquo;
The proposed model would protect pre-breach cybersecurity information (&ldquo;CI&rdquo;) (and not just CI developed &ldquo;in anticipation of litigation&rdquo;), and information developed without participation of the organization&rsquo;s counsel.
Lawyer involvement not needed?
The Working Group acknowledged that the expanded &ldquo;qualified privilege&rdquo; would protect a greater range of CI, although not all CI.&nbsp; The proposal&rsquo;s advantages, according to the Working Group:
<ul>
<li>it &ldquo;would enable parties to take robust actions to protect themselves against and respond to third-party cyberattacks with greater (though not absolute) assurance that the CI they generate in the course of those efforts will not be used against them&rdquo; later;</li>
<li>it &rdquo;would enable parties to obtain significant (though not absolute) protection against the discoverability of CI without using attorneys to lead their efforts to protect themselves against, and respond to, third-party cyberattacks,&rdquo; lessening &ldquo;the incentive ... for putting attorneys in charge of efforts to address being victimized by such criminal activities and/or taking other measures to avoid creating a discoverable record concerning those efforts (such as not conducting certain assessments that are not otherwise legally required, conducting such assessments less thoroughly, or not reducing them to writing).&rdquo;</li>
</ul>
Room for skepticism
The Working Group&rsquo;s efforts are a welcome addition to the debate on the complex issues surrounding CI and what protection it should receive. (Law360 has comments <a href="https://www.law360.com/articles/1182446/push-to-expand-cybersecurity-info-privilege-gains-steam">here</a>.)&nbsp; Case-law guidance in this context is sparse, and rulings have tended to be very fact-specific.
But there is room for skepticism about whether CI merits its own stand-alone privilege, even as limited and qualified as the Sedona Conference Working Group proposes.
There is some validity in the adage that the ultimate motivation for cybersecurity is good security. In other words, clients should and do establish robust cybersecurity policies and practices in order to protect data, not just with an eye on protecting CI in the event of a lawsuit following a breach event.
And while the data-protection stakes, including the national security implications, have never been higher, it seems difficult to argue that cybersecurity is so different from other compliance regimes &ndash; such as antitrust &ndash; that it merits its own stand-alone privilege.
Caution can be called for here, because creating a new privilege might come back and bite in unintended ways.&nbsp; For instance, in the event of a cybersecurity event, the company&rsquo;s own search for causes can extend to outside provider entities; would those entities be justified in invoking an expanded CI privilege to resist turning over information that the company needs to identify and resolve a threat or investigate a breach?
The comment period on the Working Group&rsquo;s proposal closed in June, and the final report will issue after analysis of the comments.&nbsp; The debate will undoubtedly continue.

core/freeform

Ethics

Partner

Thomas F. Zych

Legal Ethics, Professional Responsibility and the Business of Law

Do we need a new “data-breach privilege”?  Thoughts on the Sedona Conference proposal