Legal professional privilege

What is protected by legal professional privilege?

The scope of protection is to some extent dependent on whether the information has been obtained in connection with legal proceedings or other advisory tasks. Subject to these prerequisites, there are no general limitations as to the types of documents and correspondence that fall within the scope of protection. Information which must be kept confidential covers nearly any piece of information that is not known to public.

Likewise, the point of time on which the documents were prepared or sent by the client is not as such relevant as long as there is a connection to legal proceedings (unlicensed non-advocate lawyers or licensed legal counsel and advocates) or other advisory tasks (licensed legal counsel and advocates only) and the information has been obtained in the lawyer’s capacity as a legal advisor.

Are communications with in-house counsel protected by legal professional privilege?

This is not entirely clear. The preparatory works of the Code of Judicial Procedure maintain that the above-described prohibition for advocates and licensed legal counsel to testify regarding information obtained in connection with other tasks than legal proceedings must be interpreted in line with the judgment of the European Court of Justice in case C-550/07 P, which clarified that only independent, non-employee lawyers are protected. However, it is unclear whether the same applies to information obtained by in-house lawyers in their capacity as attorney or counsel of the employer in legal proceedings.

In the field of competition law, section 38 subsection 3 of the Competition Act maintains that communications with in-house lawyers within a company or group do not fall within the scope of protection as section 38 subsection 3 only covers correspondence between an external counsel and the client. Furthermore, the preparatory works of the Competition Act specifically maintain that legal professional privilege does not cover advice provided by in-house counsel.

Does legal professional privilege apply to the correspondence of non-national qualified lawyers?

As far as information related to legal proceedings is concerned, Finnish legislation does not differentiate between national and non-national lawyers in terms of protection as long as the lawyer has obtained the information in their capacity as an attorney or counsel.

Protection of information obtained in connection with other advisory tasks is more equivocal as the rules are linked to the adviser’s professional status stipulated by Finnish legislation. According to the Advocates Act, anyone entitled to practice advocacy in one of the member states of the European Economic Area (EEA) is, when representing a client before a court of law or an authority or when pursuing other activities in Finland, bound to observe the rules of professional conduct in force in Finland, including its obligations relating to professional secrecy. Similarly, the provisions concerning advocates in Finnish law and the Decision of the Ministry of Justice on the by-laws of the Finnish Bar Association apply to an advocate registered in the EU register (see footnote 1). Therefore, legal professional privilege applies at least to non-national advocates registered in the EU register as well as other qualified EEA lawyers pursuing activities in Finland. For other situations the legal status is not as clear and the limits of the personal scope of privilege have not to our knowledge been tested in legal praxis.

Privilege of communications with a non-EEA adviser is likewise uncertain in Finland as applicable legislation only refers to an advocate in the meaning of a member of the Finnish Bar Association or an advocate qualified within the EEA.

Footnote 1: The EU register is administered by the Finnish Bar Association. A lawyer qualified to practice advocacy in another EU member state may enter the EU register to practice advocacy in Finland by using the professional title afforded by that other member state.

How is legal professional privilege waived?

The privilege may be waived by the client or another party, whose interests are protected by the rules. There are no requirements as to the form of the permission.

There are also certain statutory exceptions to the protection of legal professional privilege. Chapter 15, section 10 of the Finnish Criminal Code (39/1889) lays down a duty to report to authorities or to the person in danger a serious offence the preparation of which the person with the duty to report has knowledge of. Likewise, the Act on Detecting and Preventing Money Laundering and Terrorist Financing (503/2008) includes disclosure duties which may override lawyers' confidentiality obligations. Also, the Advocates Act provides that an advocate must openly and truthfully supply the information required by the Disciplinary Board of the Finnish Bar Association in supervisory matters regardless of the possible confidential nature of the information.

Legal professional privilege in the context of merger control

Everything stated in the section 'Legal professional privilege in the context of investigations by the antitrust / competition authority' applies also to merger control investigations.

In terms of legislative changes, the Finnish provisions regarding production of evidence were reformed during 2014 and 2015. Most importantly the amendments (which entered into force in the beginning of 2016), extended the prohibition on advocates and licensed legal counsel giving testimony. 

The Finnish Parliament approved a government bill implementing the European Union (EU) Directive on the mandatory disclosure and exchange of cross-border tax arrangements (referred to as DAC6 or the Directive) on 16 December 2019. The legislation entered into force on 1 January 2020 and is effective from 1 July 2020. The final Finnish legislation exempts certain intermediaries (attorneys, public legal aid counsels and licensed legal counsels) from applicable reporting obligations on the basis of legal professional privilege. However, the exemption only applies to certain categories of information, and intermediaries must comply with the requirements on reportable arrangements in respect of non-exempt information. Intermediaries that are exempt from reporting due to legal professional privilege are also required to inform other intermediaries or relevant taxpayers of their obligations to report.

There have been two recent Supreme Administrative Court decisions of significance. As noted above (see Legal professional privilege in the context of investigations by the antitrust / competition authority), the Supreme Administrative Court confirmed in its ruling KHO:2019:98 that in an unclear situation the undertaking’s right of defence should be interpreted in a broad manner. The FCCA had attached an e-mail chain from the undertaking responding to the FCCA’s penalty payment proposal, and one of the emails referred to a legal recommendation issued by a law firm. The message also contained a statement from a company representative regarding the recommendation. The e-mail had been forwarded both within the undertaking and to an external party. Despite the fact that the legal recommendation given by external legal counsel to the undertaking (with the purpose of using its right of defence) was forwarded to a third party, the Court concluded that it was protected by legal professional privilege. 

Another recent ruling by the Supreme Administrative Court (KHO:2019:83) concerns legal professional privilege in the context of state-owned companies. Despite the importance placed on right of access to documents, the Court concluded that the National Audit Office of Finland could refuse to grant access to an audit memorandum concerning a state-owned company to the extent that it contained business secrets. The memorandum contained information on assessments and views given by attorneys acting as the company’s legal advisers. The Court considered these parts of the memorandum to be covered by legal professional privilege under section 5c of the Advocates Act as the company had not waived its privilege. Therefore, the information also constituted a business secret under section 23 subsection 1 paragraph 20 of the Act on the Openness of Government Activities and access could be refused.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?   

Internal investigations are generally not protected by attorney-client privilege in Finland and there are no directly applicable laws on internal investigation, except for the Finnish Auditing Act (1141/2015, as amended). Chapter 8, section 4 of the Auditing Act sets out a derogation from the provisions on the right to obtain information and carry out inspections concerning advocates, legal counsels, and attorneys. The Auditor Oversight Unit does not have the right to obtain information, documents, or records from the advocate concerning the advocate's client or inspect them. This covers both legal advice and litigation privilege. Notwithstanding the exception to preserve privilege in general, it is advisable that an external counsel is involved.

According to Chapter 15, section 17 of the Finnish Code of Judicial Procedure, an attorney or a legal council may not without permission disclose privileged information that they have obtained in providing legal advice on the legal position of their client in a criminal investigation or in other proceedings prior to legal proceedings.

The elements, as set above, to establish legal privilege also apply to civil matters.  

Chapter 6, section 35 of the Finnish Data Protection Act incorporates a separate professional secrecy obligation for information acquired in connection with processing that takes place under the authority of a data controller or data processors.

Furthermore, Chapter 6, section 36 of the Finnish Data Protection Act provides an obligation for the supervisory authority to keep the identity of a natural person, who has notified the authority on possible breaches of data protection laws, in secrecy where the circumstances warrant it.

Breach of either one of the sections in the Finnish Data Protection Act is punishable under the Finnish Criminal Code (39/1889, as amended). 

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

In principle, documents in the possession of outside counsel are protected by attorney-client privilege. For instance, documents and communications containing general advice provided by an outside counsel prior to any investigation by the authorities enjoy attorney-client privilege protection.

In general, legal privilege only applies to information disclosed after the establishment of an assignment between the client and the counsel. However, information provided by the client, prior to establishing an attorney-client relationship, may still be regarded as privileged information if the nature of such information warrants it. For example, information disclosed to a counsel per said counsel’s request to decide whether to accept an assignment, would be considered privileged information.

c) Are communications to / by companies and in-house counsel protected by privilege?     

Legal privilege only applies to documents in the possession of an outside counsel. Therefore, it is recommended that during criminal investigation, an outside counsel is sought to ensure the protection of legal privilege.

d) Are there any specific requirements of a privileged incident response engagement letter?

Not to our understanding.

2) Documents and Reports  

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

In general, documents are protected by legal privilege if the purpose of such documents relates to the provision of legal advice provided by an attorney. The content of legal professional privilege is in general determined by the prohibitions on evidence laid down in Chapter 17 of the Code of Judicial Procedure. Furthermore, the corresponding exceptions on the legal privilege are described in Chapter 7, section 3 and 4 of the Finnish Coercive Measures Act (806/2011, as amended). For example, under chapter 7, section 3, there is no prohibition on seizure or reproduction if the person in respect of whom the obligation of professional secrecy has been imposed consents to the seizure or reproduction. The other exceptions on prohibition on seizure or reproduction cover, for example, offences with a certain maximum term of imprisonment.

b) Does it matter whether the documents are located at the premises of the client or the lawyer? 

In general, it does not matter where the documents are located.

c) How are seized documents put into evidence in a criminal / civil procedure?

Conditions for seizing documents are set out in Chapter 7, section 1 of the Finnish Coercive Measures Act. Accordingly, documents may be seized if they can be used as evidence in a criminal procedure. The evidence (ie the seized document) is named by the party and if necessary, the court decides whether it can be used and whether it should be kept secret.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

Privilege may be waived in three different situations:

• The person whose privilege is at hand waives their right to privilege.
• Privilege yields to a provision of the law.
• Legal protection of the lawyer requires them to be released of privilege.

In addition, the protection of legal professional privilege is under statutory exception of Chapter 15, section 10 of the Finnish Criminal Code (39/1889, as amended), which establishes a responsibility to report to authorities or to the person in danger a serious offence the preparation of which the person with the duty to report has knowledge of.

Furthermore, the Act on Detecting and Preventing Money Laundering and Terrorist Financing (503/2008, as amended) includes disclosure duties which may override lawyers' confidentiality obligations. Also, section 7 d of the Advocates Act (496/1958, as amended) provides that an advocate must openly and truthfully supply the information required by the Disciplinary Board of the Finnish Bar Association in supervisory matters regardless of the possible confidential nature of the information.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?   

To our understanding, this has no effect on the confidentiality of the attorney or the legal counsel or the prohibitions on evidence laid down in Chapter 17 of the Code of Judicial Procedure. However, this issue has not been addressed in case law.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

In principle, no. However, there are no explicit rules on this and the question of whether a notification or sharing of the findings mean a waiver needs to be assessed on case-by-case basis.

4) Privacy Litigation  

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

Not to our understanding.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?

Not to our understanding.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

In general, it does not matter where the documents are located.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?     

This needs to be addressed on a case-by-case basis.