Malaysia
1) Privilege in Investigations
a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?
There is no specific legal privilege applicable within the context of internal investigations, save for legal advice privilege under Section 126 of the Evidence Act and litigation privilege under common law.
b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?
No. Privilege is absolute unless waived.
c) Are communications to / by companies and in-house counsel protected by privilege?
No. As described above, Malaysian law has yet to specifically recognise that communications to/by companies and in-house counsel are protected by privilege.
d) Are there any specific requirements of a privileged incident response engagement letter?
No.
b) Documents and Reports
a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?
Yes, if these notes, transcripts, or expert reports were considered as part of the provision of legal advice, or if the documents were prepared with litigation in mind. In order to preserve privilege over such work product, there should be explicit directions from the advocate and solicitor to the third parties before the third parties commence work.
b) Does it matter whether the documents are located at the premises of the client or the lawyer?
No.
c) How are seized documents put into evidence in a criminal / civil procedure?
If privileged documents are seized, subject to an objection being taken, those documents must be sealed and brought before the court to determine if those documents are protected by privilege.
3) Waiver of Privilege
a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?
Legal privilege can be waived in Malaysia if the right to privilege is not asserted or enforced. To prevent this from occurring, the privilege holder ought to make an objection and make the relevant applications to the courts in order to protect the document. In addition, it is important to clearly label and mark the relevant documents as “legally privileged” to avoid any ambiguity.
b) In data breach litigation, does a company ever need to rely on the findings of internal investigations, and if so, does that mean privilege has been waived?
Yes. If the company relies on the findings of an internal investigation in court proceedings, then privilege in respect of the findings is waived.
4) Privacy Litigation
a) Were there any data breach privilege cases in your jurisdiction in the last 5 years? If so, please provide details.
No.
b) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?
Generally, no. However, if the data meets the standards for legal privilege under Malaysian law, then it may be treated as privileged regardless of the approach taken outside the jurisdiction.
c) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?
If an investigation is commenced outside Malaysia, and if the relevant authorities from that jurisdiction attempt to seize the privileged data, the laws of to the jurisdiction in question are likely to apply as to whether the data is considered privileged or otherwise.
However, where there is ambiguity about whether the data would be considered privileged under Malaysian law, the privilege holder may consider making an application to the Malaysian court to make the relevant determination on this, including to obtain any relevant injunctions to prevent disclosure, as required.
