Sri Lanka
1) Privilege in Investigations
a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?
No, there are no specific or additional legal privileges afforded to internal investigations. Under Rule 2 of the Supreme Court Rules and Section 2 of the Evidence Ordinance, legal professional privilege will be applicable in the same manner for both civil and criminal proceedings.
b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?
There are no specific time periods which apply to legal privilege, irrespective of whether the attorney is involved in litigation or providing legal advice.
As stated above, the duty of nondisclosure of privileged information conferred on an attorney will continue after their professional relationship with the client has ceased to exist and indefinitely thereafter, even after the death of the client.
c) Are communications to / by companies and in-house counsel protected by privilege?
Yes, as stated above, all communications with an attorney falling within the description of Rule 2 of the Supreme Court Rules will be protected by legal professional privilege. The fact that the attorney is acting in their capacity of an in-house counsel has no bearing on the protection afforded to the communications between the said attorney and their clients, provided the attorney in question is admitted and enrolled by the Supreme Court of Sri Lanka.
d) Are there any specific requirements of a privileged incident response engagement letter?
No.
2) Documents and Reports
a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?
If the notes, transcripts and reports were prepared by a third party, who does not fall within the description of an attorney as envisaged by the Supreme Court Rules, they will not be protected under privilege, even if the documents were subsequently used by an attorney for the purpose of giving legal advice. In other words, to benefit from the protection of privilege under Sri Lankan law, the relevant documents will need to be prepared by an attorney.
However, if the notes, transcripts of employee interviews (where it is retained by the attorney to carry out such interviews) and reports were prepared by the attorney for the client, they would be protected under legal professional privilege.
b) Does it matter whether the documents are located at the premises of the client or the lawyer?
No, for the purposes of privilege, it does not matter whether the documents are located at the premises of the client or the lawyer.
c) How are seized documents put into evidence in a criminal / civil procedure?
Documents may be seized in the manner provided for under the Code of Criminal Procedure Act No. 15 of 1979 or the Prevention of Terrorism Act No. 48 of 1979.
Objections against the admissibility of such documents can be made by making an application to the Sri Lankan courts under the Evidence Ordinance, under grounds such as privilege or irrelevance of the document to the case in question. The admissibility of the seized documents as evidence and the veracity of the objections will be determined by the presiding Judge.
3) Waiver of Privilege
a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?
See the answer to the above question “How is legal professional privilege waived?”
In order to ensure privilege is not lost, a client can make a stipulation within the Letter of Engagement or Non-Disclosure Agreement between himself and the attorney which states that no disclosure of information or documentation is to occur except with prior written consent from the client. This would preclude the attorney from relying on implied consent as a basis for privilege to be waived.
b) In data breach litigation does a company ever need to rely on the findings of internal investigations and, if so, does that mean privilege has been waived?
There is no mandatory requirement for a company to rely on the findings of an internal investigation in the course of a data breach litigation.
Note, however, that Sri Lanka does not currently have any specific laws or rules relating to data breaches, therefore, data breach litigation is rare in Sri Lanka. The Personal Data Protection Bill is currently pending enactment by Sri Lanka’s Parliament.
c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?
As mentioned above, internal investigations which are conducted by individuals who are not attorneys in Sri Lanka, will not be considered as privileged.
In the event the internal investigation is conducted by an attorney, notifying those affected only of the findings, as opposed to the contents or any extract of the internal investigation report, will not result in the loss of privilege of the internal investigation report.
4) Privacy Litigation
a) Were there any data breach privilege cases in your jurisdiction in the last 5 years? If so, please provide details.
There are no public court records (ie judgments issued by the Supreme Court and Court of Appeal of Sri Lanka) of any data breach privilege cases in Sri Lanka within the last five years.
b) In data breach litigation, does a company ever need to rely on the findings of internal investigations and, if so, does that mean privilege has been waived?
There is no mandatory requirement for a company to rely on the findings of an internal investigation in the course of a data breach litigation.
Note, however, that Sri Lanka does not currently have any specific laws or rules relating to data breaches, therefore, data breach litigation is rare in Sri Lanka. The Personal Data Protection Bill is currently pending enactment by Sri Lanka’s Parliament.
c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?
No, the fact that data is considered privileged outside the Sri Lankan jurisdiction would not necessarily make the data privileged within Sri Lanka, unless the elements of legal professional privilege under Sri Lankan law have been met.
d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?
If data is considered to be privileged under Sri Lankan law, then irrespective of whether the investigation takes place within or outside of Sri Lanka, legal professional privilege can be invoked by the party in question.
Practical steps, such as marking the privileged information as “Privileged and Confidential,” or the signing of a Non-Disclosure Agreement with the parties in question may assist in protecting the privilege afforded to the information in question.
This would be subject to the exceptions set out above relating to the disclosure of crime, fraud or furtherance of an illegal purpose, and subject to relevant local laws in the jurisdiction where the civil/criminal investigation takes place.
