Legal professional privilege

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?

Internal Investigations

Legal professional privilege applies in the context of civil proceedings, criminal investigations and in the context of regulatory investigations by authorities such as the office of the Australian Information Commission (the primary privacy regulator in Australia).

The test for legal professional privilege in each context (internal, criminal and data protection matters) in Australia is the same.

Legal professional privilege is derived from the common law and from legislation, such as the Evidence Act 1995 (Cth), at both a state and federal level. In Australia, legal professional privilege (which is often referred to as client privilege) is a fundamental right that vests in the client – not in or with the lawyer.

The test – in summary

Confidential communications:

between a lawyer and their client, one or more lawyers acting for the client, or lawyers acting for the client and a third person (such as an expert witness);

which are for the dominant purpose of providing legal advice or professional legal services; and

are in relation to a current or pending legal proceeding, are protected by legal professional privilege.

Legal professional privilege also extends to confidential documents prepared for the purpose of giving or obtaining legal advice and for the purpose of a legal proceeding. For example, a report/document prepared by a forensic IT consultant or an internal IT operative that is created to obtain legal advice will normally be privileged.

How is privilege lost?

Legal professional privilege may be abrogated by some common law exemptions and by the express and/or necessary implication of legislative provisions.

For example, if a client seeks legal advice in an attempt to further a crime or fraud, this advice and related communications will not be subject to legal professional privilege. Further, a claim of legal professional privilege is unlikely to be able to be maintained if it is being used to frustrate a process of law.

In the context of civil litigation, where the court may order documents to be produced during processes such as discovery, such orders will not require documents that are subject to a claim of legal professional privilege to be produced. However, the documents will need to be identified in a list of documents that is provided to the party seeking discovery.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

There is no limitation period placed on legal professional privilege in Australia.

c) Are communications to/by companies and in-house counsel protected by privilege?     

In Australia, courts have considered whether in-house lawyers are protected by legal professional privilege by assessing whether they are acting in their capacity as a lawyer and have the requisite independence to provide unfettered advice.

To attract legal professional privilege, communications or documents must be made in a lawyer's capacity as a lawyer in order to provide the client with legal advice or for the purpose of actual or anticipated litigation.

Communications made by in-house lawyers who act beyond their role as a legal advisor (for example by weighing in on operational matters) will fall outside the scope of legal professional privilege. This is also the case if a communication or document is found to have been made for mixed purposes.

Exercising independent professional judgement is a key factor that will be considered in establishing whether in-house counsel is acting in the capacity of a lawyer. Claims for legal professional privilege have been rejected on the basis that in-house counsel have not acted at sufficient arm's length from their client, such as when documents are produced by in-house lawyers who are subject to the directions of their managers and therefore giving rise to the impression that they lack necessary independence.

Legal professional privilege has also been denied in relation to communications where in-house lawyers have been involved in the commercial decision-making of a transaction.

Whether an in-house lawyer has a practising certificate has also been considered by courts in Australia when deciding whether legal professional privilege should apply to their advice. While failing to have a current practicing certificate is not necessarily fatal to a claim of legal professional privilege, it may lead to a court inferring that the communications made and documents created by the in-house lawyer are not for the purpose of providing legal advice or for the purpose of litigation.

In a data breach/cyber incident, it is important that any in-house counsel makes it clear when they are giving legal advice and when they are acting in an operational capacity – for example as an incident response coordinator which may involve giving commercial advice on how to respond to the incident.

d) Are there any specific requirements of a privileged incident response engagement letter?

Yes, it is recommended that external counsel engage any third parties required to assist with a response in order to best set up an ability to claim privilege over the work done.

All third-party engagement letters should include a statement that the third party is being involved for DLA Piper/in-house counsel to advise the affected entity.

b) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes.

Communications or documents must be confidential and have occurred or come into existence for the “dominant purpose” of obtaining legal advice or in relation to actual or anticipated litigation to attract legal professional privilege. The term “dominant” has been held to mean a “ruling, prevailing or most influential” purpose.

To avoid any later arguments as to what the dominant purpose of the document, it is recommended that a lawyer (internal or external) prepare the record of the interview if at all possible. If it is not possible for a lawyer to prepare the record of the interview, it should be clearly noted at the commencement of the interview that the purpose of the interview is to enable the affected entity to obtain legal advice.   

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

It does not matter whether the documents are located at the client or lawyer's premises.

c) How are seized documents put into evidence in a criminal/civil procedure?

Generally, privileged materials cannot be used in legal proceedings in Australia.

There are extremely limited circumstances where this general rule will not apply.

A party who claims privilege will generally have a right to object to use of privileged material. External counsel should be briefed as a matter of urgency if a government agency or third party attempts to use privileged materials.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

A client will be deemed to have waived legal professional privilege if the client acts in a way that is inconsistent with the confidentiality which the legal professional privilege is supposed to protect.

The waiver of legal professional privilege is available under several circumstances. Firstly, the privilege can be waived by disclosing the effect of the legal advice, regardless of whether the advice itself is disclosed. Accordingly, it reminds parties to think twice before voluntarily disclosing compliance material that has been prepared by lawyers.

Secondly, the privilege may be waived if a third party is copied into the communication. The principle endorsed by the Full Federal Court is that “for a client to deploy the substance or effect of legal advice for forensic or commercial purposes is inconsistent with the maintenance of the confidentiality that attracts legal professional privilege.”

The legal professional privilege will also not apply in circumstances where the communications are made for improper and/or illegal purposes, notwithstanding the fact that the lawyers involved were not necessarily aware of the illegality. The Federal Court in Aucare Dairy Pty Ltd v Huang emphasised that there is a risk that where there is evidence of illegality and/or improper purpose by a party, that party will not be entitled to legal professional privilege.

Additionally, legal professional privilege may only be claimed by a company director over documents containing legal advice if the documents are related in some way to the director in their personal capacity and not merely to the operations of the company. The Federal Court found in Equititrust Ltd (in Liq) (Receivers appointed) (Receivers and Managers Appointed) v Equititrust Ltd (in Liq) (Receiver appointed) (Receivers and Managers Appointed) (No.3) that the fact documents containing legal advice were addressed to a director or “the Directors,” or procured by a director did not mean that the director had personal concerns in the matters raised by the documents disputed or mean that the advice was provided on the basis of joint privilege.

The Court also held that commonality of interest is a prerequisite for common interest privilege to apply and that the mere fact the legal advice was communicated to Equititrust and that a company can only act through its directors did not mean that its directors had a common interest privilege in that advice.

Legal professional privilege was also dismissed in Hancock v Rinehart where the Supreme Court of New South Wales held that legal advice obtained by a trustee belongs to the trust and not the trustee personally. The Court noted that the costs of obtaining the legal advice were paid from the trust fund, and accepted the suggestion that the advice was obtained in behalf of the trust and not the trustee in her personal capacity.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

It may be possible that a company could wish to rely on a privileged report or documents created during an investigation. In those circumstances it will be necessary to waive privilege.

It may be possible to waive privilege only in that document but care must be taken.

External legal counsel should be engaged in any discussion about a decision to waive privilege as in Australia it is possible, through a concept called "issue waiver" to lose privilege over all materials relating to a particular topic.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

It will depend on the scope and nature of the information shared.

Again, care should be taken as to the contents of such notifications so as to not inadvertently waive privilege.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

We have not located any decisions on privilege that have arisen in the context of a data breach in the last five years.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

Australia is a federation. There is relevant legislation dealing with privilege at a federal and state level, as well as in the common law.

There are numerous courts cases that consider cross-border privilege issues.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Yes, that is the general approach.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

The critical element to maintaining privilege in Australia is to ensure that the privileged material remains confidential and that there is no express or implied (through conduct) wavier of that privilege.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?   

The lack of regulation for internal investigations includes legal professional protection, so the general rules set forth for lawyers are applied in internal investigation conducted by lawyers.

The engagement of a lawyer has historically been an effective way to create and maintain confidentiality in an internal investigation. In Brazil, having lawyers in charge of the investigation is crucial, considering the specificities of the local legal professional confidentiality treatment.

The Brazilian Bar Association Statute (“BBAS”) sets forth “the inviolability of the lawyer’s office or place of work, as well as their work tools, written, electronic, telephone and telematics correspondence, as long as they relate to the practice of law” as every lawyer’s right. Law Enforcement Agencies in charge of criminal investigations, therefore, cannot have access to evidence originating from the protected sources mentioned above, except in cases in which there is indication that the lawyer took part in a crime or keeps physical evidence of a crime in their office.

No special legal privilege rules for data protection matters.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

The legal professional protection applies throughout all criminal investigations.

c) Are communications to / by companies and in-house counsel protected by privilege?

The BBAS does not distinguish in-house lawyers from external counsel. The BBAS specifically sets forth the practice of “legal management” as a lawyer’s private activity. Unlike many European countries, in-house lawyers have the same rights and duties of external counsel, as long as their role exclusively relates to the practice of law. This means in-house lawyers who perform executive management roles or other activities not related to the practice of law do not have the same legal treatment. In addition, the Brazilian Bar Association Ethics Code (“BBAEC”) provides that in-house attorneys must also preserve their liberty and independence.

Foreign lawyers are not allowed to practice law in Brazil and are considered “Consultants” when acting in Brazil, as per Provision nº 91/200 of the Brazilian Bar Association. Therefore, considering that foreign lawyers are consultants when acting in Brazil, the local legal professional protection guarantee may have less strength for foreign lawyers.

d) Are there any specific requirements of a privileged incident response engagement letter?

No, there are no specific requirements in that sense.                      

2) Documents and Reports             

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Notes or transcripts of employee interviews: yes.

Expert reports prepared or obtained for the purpose of giving legal advice: yes, if the expert work was retained or requested by a lawyer.

b) Does it matter whether the documents are located at the premises of the client or the lawyer? 

Yes, as stated above, the BBAS sets forth “the inviolability of the lawyer’s office or place of work, as well as their work tools, written, electronic, telephone and telematics correspondence, as long as they relate to the practice of law” as every lawyer’s right. Law Enforcement Agencies in charge of criminal investigations, therefore, cannot have access to evidence originating from the protected sources mentioned above, except in cases in which there is indication that the lawyer took part in a crime or keeps physical evidence of a crime in their office.

c) How are seized documents put into evidence in a criminal / civil procedure?

Search and seizures are a precautionary measure set forth in the Brazilian Criminal Code of Procedure. Documents seized during the execution of search and seizures must be listed in a notice drafted by the responsible law enforcement agent and later presented in investigation files, usually in separated and specific records.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

The legal professional protection may not be recognized in the following situations:

If the communication is in furtherance of a crime, or to avoid a threat to someone’s life or honor.

For the attorney’s own protection in cases of “severe threat to life or honor” or when any action taken by the client against the attorney is regarded as an “affront” and the disclosure of confidential information is required in “self-defense against the client.”

If previously authorized by a client to disclose (waiver), except for the attorney to serve as witness.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so, does that mean privilege has been waived?

As the data protection law in Brazil is very recent and only became enforceable in August 2020, data breach class action is still not common in Brazil. In any case, legal professional protection will not be recognized following the same understanding to the above answer.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

Please refer to question 3a.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

Not that I am aware of.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?      

No, there are no specific rules or cases in Brazil in that sense.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

There is no specific legislation ruling data that holds a privileged nature in foreign countries.

However, if a foreign lawyer is authorized by a license granted by the Brazilian Bar Association to practice law in Brazil, the individual has the same rights as Brazilian lawyers, including legal privilege.

In other circumstances, according to the rules set forth by the Civil and Criminal Procedure Codes, an individual may not be compelled to testify about facts that are protected by professional confidentiality. In that sense, foreign attorneys could decline to testify based on information obtained in the attorney-client relationship, considering it to be covered by legal privilege.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?     

Any data requested by foreign countries in the event of a civil / criminal investigation must be done through International Legal Cooperation.

In Brazil, the Ministry of Justice​ plays the role of central authority for the international legal cooperation system, being the recipient of demands usually made through diplomatic channels. One of the responsibilities of the central authority is to classify the requests received according to the nature of the claim and to give the proper guidance to the matter.

In the case of a data request, the request would be submitted to the Brazilian Superior Court of Justice (STJ), which will only grant authorization to fulfill the requested measure after examining the comprehensibility of the case and the possibility of offense to the national sovereignty, public order, or human dignity.

In situations where compliance with legal cooperation measures abroad is required by Brazilian authorities – whether they are investigative, administrative, or judicial – the procedure does not go through the STJ. In such cases, the dispatch of the magistrate's request is made directly by the Ministry of Justice, which also plays the role of central authority for active cooperation requests.

Based on that, the request for data protected by legal privilege would have a very low chance of being granted by the STJ, except in very exceptional cases that would follow the answer provided in Question 3a.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?

No. There is no legal principle or legislation on legal privilege in China. Therefore, there is no legal privilege in the context of internal or criminal investigations, and/or data protection matters. Under PRC law, a lawyer owes a general confidentiality obligation to the client that covers confidential information, state secrets and commercial secrets obtained from the client during the representation.

PRC law is silent on this issue. In practice, the instructions from the client does not need to come from in-house counsel for the confidentiality obligation to apply.

Confidentiality obligation applies in the context of criminal investigations. However, under certain scenarios, a lawyer has the obligation to report if the information is related to the preparation or commission of criminal acts.

Article 48 of PRC Criminal Procedure Law provides that “[a] defense lawyer has the right to keep confidential information of the client obtained during the professional practice. For information that involves any impending or ongoing criminal activity which would jeopardize state and public security or cause serious personal safety damage, a lawyer must inform PRC judicial authorities.”

For details, please refer to DLA Piper Legal Professional Privilege Global Guide, China – Legal professional privilege in the context of criminal investigations.

As discussed above, legal privilege is not recognized in China, hence there are no special rules addressing legal privilege in the context of data protection.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

As discussed above, legal privilege is not recognized in China. Instead, certain confidentiality obligations apply when a Chinese lawyer starts representing the client.

c) Are communications to / by companies and in-house counsel protected by privilege?     

The source of such information does not matter. As long as such information about the client is obtained during the lawyer’s professional representation and falls under the scope of confidential information, a defense lawyer should be entitled to rely on article 48 of the PRC Criminal Procedure Law (the content of which is set out in the answer to question 1a) to assert confidentiality.

d) Are there any specific requirements of a privileged incident response engagement letter?

No. However, an engagement letter should nonetheless cover the work to be carried out in China, at least, as an attempt to preserve privilege protection of the China-related work product and communication that might be afforded to the same in jurisdictions outside of China. For each case, this needs a deeper analysis of the scope of work, involvement of cross-border teams, what non-Chinese jurisdictions are involved, and the applicable privilege considerations for those non-China jurisdictions.

2) Documents and Reports  

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

As discussed above, legal privilege is not recognized in China. PRC law does not set out in detail various categories of documents that are protected by confidentiality obligation owed by a lawyer. The law generally provides three broad categories of information that are protected: confidential information, state secrets, and commercial secrets.

b) Does it matter whether the documents are located at the premises of the client or the lawyer? 

The location of where the documents are located does not matter. See further details in answer to question 2a) above.

c) How are seized documents put into evidence in a criminal / civil procedure?

Under PRC law, seized documents shall be clearly checked in the presence of a witness and the holder of such documents. A list must be made in two copies at the scene signed by the investigators, the witness and the holder of the documents. One copy of the list must be given to the holder, and the other copy must be attached to the collected documents and stored in the appropriate evidence archive. (Article 142 of the PRC Criminal Procedure Law)

Both the prosecution and the defendant are then entitled to present the seized documents to the court as part of their respective cases during the trial proceedings.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

Exceptions to the duty of confidentiality include:

any fact or information concerning the client or any other party who is about to or is in the process of committing a crime that may endanger state security or public security or cause serious personal safety damage;

information that the client agrees to disclose;

if disclosure is required by regulatory authorities during administrative investigations; or

if disclosure is required by judicial authorities in civil litigation proceedings.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

Data breach litigations are still relatively new in China and we are not aware of any such cases. In any event, the waiver point does not apply since legal privilege is not recognized in China.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

Data breach litigations are still relatively new in China and we are not aware of any such cases. As mentioned, the waiver point does not apply since legal privilege is not recognized in China.

4) Privacy Litigation  

a) Were there any data breach privilege cases in your jurisdiction in the last 5 years? If so, please provide details.

Legal privilege is not recognized in China. Therefore, there is no case precedent on this point.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?      

Legal privilege is not recognized in China. Hence, there are no specific rules or cases in China that deal with privilege. However, for work products and data originating from China as part of a cross-border scenario/case, attempts should be made (including having certain engagement arrangements and work and communication protocols in place) to preserve privilege protection of the China-related work product and data/communication that might be afforded to the same in jurisdictions outside of China. For each case, this needs a deeper analysis of the scope of work, involvement of cross-border teams, what non-Chinese jurisdictions are involved, and the applicable privilege considerations for those non-China jurisdictions.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Legal privilege is not recognized in China, therefore, the privileged data outside of China will not be treated as privileged data in China. A lawyer in China may rely on the lawyer’s confidentiality obligation as an attempt to resist disclosure of such data. However, there are exceptions to confidentiality as discussed in the answer to questions 3a) above.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?     

Legal privilege is not recognized in China. However, for work products and data originating from China as part of a cross-border investigation, attempts should be made (including having certain engagement arrangements and work and communication protocols in place) to preserve privilege protection of the China-related work product and data/communication that might be afforded to the same in jurisdictions outside of China. For each case, this needs a deeper analysis of the scope of work, involvement of cross-border teams, what non-Chinese jurisdictions are involved, and the applicable privilege considerations for those non-China jurisdictions.

Content to follow shortly.

Content to follow shortly.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?

N/A – already answered in the full legal professional privilege global guide. An attorney must follow all of the rules of the GDPR as any other processor of personal data.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

The litigation privilege commences at the moment, when the attorney has found out the fact, which is subject to the privilege.

c) Are communications to / by companies and in-house counsel protected by privilege?

Yes under the agreement.

d) Are there any specific requirements of a privileged incident response engagement letter?

2) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

The legal privilege includes all information the attorney has found out with regard to providing legal services.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?

Already answered in the Legal professional privilege - Global Guide.

c) How are seized documents put into evidence in a criminal / civil procedure?

Already answered in the Legal professional privilege - Global Guide.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

The legal privilege may be waived by the client or after hers/his death or termination its legal successor. The legal privilege also continues after the case is terminated or the attorney is deleted from the bar´s list.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

N/A.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

N/A

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last 5 years? If so, please provide details.

Yes.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?

No, we are not aware of any.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Most likely not, but there is no specific explanation to the privilege obligation under Czech law nor any useful case law yet.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?

This would be considered a legal privilege, if falling under its scope.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?     

There is no specific legal privilege arising in the context of internal investigations or data protection matters. General legal privilege is applicable to client-attorney communication also in the context of internal investigations and data protection matters.

Generally, a lawyer is required to maintain the confidentiality of the information which has become known to the lawyer in the provision of legal services. Communication between the client and legal counsel is protected from investigations by the authorities.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation? 

Generally, a provider of legal service has an obligation to keep the information related to the provision of legal services confidential indefinitely, including after the termination of the provision of legal services. The same rules applies to legal advice and litigation. Litigations are generally public and can be closed only in case of overriding reasons (eg private life and commercial secrecy). Information and documents disclosed in the course of the public litigation are not privileged.

c) Are communications to/by companies and in-house counsel protected by privilege? 

As stated above, the information related to the provision of legal services is protected by legal privilege. However, if a party to the communication in regard to the provision of legal services is not an independent outside counsel, such legal privilege does not apply. “In-house communications do not merit the protection afforded by legal professional privilege as it is not ultimately communicating with a neutral third party but with a person who is a member of its own staff.”

d) Are there any specific requirements of a privileged incident response engagement letter?

There are no specific requirements of a privileged incident response engagement as the principles of general legal liability apply.

2) Documents and Reports  

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

All the relevant documents and other information related to the provision of legal services by a provider of a legal service are intact under legal privilege. To assure the protection, gathering of such evidence should be performed by independent outside counsel, as in-house documents and communication generally are not privileged.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?    

No, the location of the documents does not affect the applicability of legal privilege, rather it is the nature of the communication. However, documents located in the premises of the lawyer are generally better protected, as conducting searches in the premises of lawyers is strictly regulated and possible only on exceptional grounds.

c) How are seized documents put into evidence in a criminal/civil procedure?

In general, artefacts reflecting legally privileged communication cannot be seized, collected or used as evidence in criminal procedure, unless the client consents to such disclosure. In the pre-court phase of the criminal procedure the prosecutors’ office together with the relevant investigative body collects evidence. Also, people under investigation or other interested parties may submit evidence supporting their position. In the court-phase of the criminal investigation, the prosecutors’ office submits the case file to the court, and other parties may submit additional evidence.

The Estonian pre-court criminal procedure introduces a vulnerability to strict client-attorney privileged. In seizures at the client’s premises, especially if e-evidence is gathered, the prosecutors’ office prefers to collect documents and evidence in bulk (eg coping of hard drives). In processing the evidence gathered this way, the authorities may accidentally review privileged documents and obtain information that can be later confirmed via non-privileged communication.

In Estonian civil procedure, the parties to the proceedings have to obtain the evidence themselves pursuant to the principle of adversarial court proceedings. Court orders on disclosure are exceptional, limited to specific documents and should not breach legal privilege. Discovery-type of evidence production processes are not recognised in Estonian legal proceedings. For these reasons, privileged documents are rarely encountered in litigations without express consent of the privileged communication.

3) Waiver of Privilege   

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?  

There are several exceptions prescribed by law which are not considered as a violation of legal privilege:

• a recipient of legal service exempts the provider of a legal service from the obligation to maintain confidentiality;
• to prevent a criminal offence in the first degree by submitting a reasoned application to the relevant authority for the exemption from the obligation;
• the obligation of confidentiality is not extended to the collection of costs for legal services provided by a lawyer who participated in the matter;
• by disclosing the information to the Board of the Estonian Bar Association in the exercise of supervision over the activities of a lawyer or to the court of honour concerning a disciplinary offence; and
• by disclosing information to the Ministry of Justice relating to supervision in the matters of acting as a trustee in bankruptcy.

The requirements for waiver under the first exception above are not established, but it must be express and we recommend to obtain it in writing.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

In general, the findings of internal investigations are not protected by legal privilege. Use of evidence protected by legal privilege in open court process waives legal privilege. If a party wants to maintain the confidentiality of the privileged document, the party must try to declare the judicial review or specific document confidential. This is done on exceptional grounds.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

In general, the findings of internal investigations are not protected by legal privilege. If the findings are established in a manner which grants legal privilege (eg established by outside legal counsel), the information disclosed to affected or third parties is not privileged, unless such disclosure could be regarded as provision of privileged legal advice to same persons.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

In the last five years, there have not been any data breach privilege cases before the national courts; however, such cases have been discussed before the court of honour of the Estonian Bar Association. The court of honour identified one violation of legal privilege; however, no further proceedings were initiated as the lawyer did not disclose the data intentionally and apologised to the client.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?

There are neither rules nor cases that specifically deal with legal privilege in a multi-state scenario.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

It is not explicitly provided by the law. In principle, legally privileged data outside Estonia should be treated in the same manner as legally privileged data in Estonia. However, the scope of the legal privilege may vary.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

There are no specific national regulations on this matter. Generally, the courts and investigative bodies should not possess or demand disclosure of privileged data and thus the question of its transfer to other jurisdictions should not emerge.

Content to follow shortly.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?   

Internal investigations are generally not protected by attorney-client privilege in Finland and there are no directly applicable laws on internal investigation, except for the Finnish Auditing Act (1141/2015, as amended). Chapter 8, section 4 of the Auditing Act sets out a derogation from the provisions on the right to obtain information and carry out inspections concerning advocates, legal counsels, and attorneys. The Auditor Oversight Unit does not have the right to obtain information, documents, or records from the advocate concerning the advocate's client or inspect them. This covers both legal advice and litigation privilege. Notwithstanding the exception to preserve privilege in general, it is advisable that an external counsel is involved.

According to Chapter 15, section 17 of the Finnish Code of Judicial Procedure, an attorney or a legal council may not without permission disclose privileged information that they have obtained in providing legal advice on the legal position of their client in a criminal investigation or in other proceedings prior to legal proceedings.

The elements, as set above, to establish legal privilege also apply to civil matters.  

Chapter 6, section 35 of the Finnish Data Protection Act incorporates a separate professional secrecy obligation for information acquired in connection with processing that takes place under the authority of a data controller or data processors.

Furthermore, Chapter 6, section 36 of the Finnish Data Protection Act provides an obligation for the supervisory authority to keep the identity of a natural person, who has notified the authority on possible breaches of data protection laws, in secrecy where the circumstances warrant it.

Breach of either one of the sections in the Finnish Data Protection Act is punishable under the Finnish Criminal Code (39/1889, as amended). 

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

In principle, documents in the possession of outside counsel are protected by attorney-client privilege. For instance, documents and communications containing general advice provided by an outside counsel prior to any investigation by the authorities enjoy attorney-client privilege protection.

In general, legal privilege only applies to information disclosed after the establishment of an assignment between the client and the counsel. However, information provided by the client, prior to establishing an attorney-client relationship, may still be regarded as privileged information if the nature of such information warrants it. For example, information disclosed to a counsel per said counsel’s request to decide whether to accept an assignment, would be considered privileged information.

c) Are communications to / by companies and in-house counsel protected by privilege?     

Legal privilege only applies to documents in the possession of an outside counsel. Therefore, it is recommended that during criminal investigation, an outside counsel is sought to ensure the protection of legal privilege.

d) Are there any specific requirements of a privileged incident response engagement letter?

Not to our understanding.

2) Documents and Reports  

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

In general, documents are protected by legal privilege if the purpose of such documents relates to the provision of legal advice provided by an attorney. The content of legal professional privilege is in general determined by the prohibitions on evidence laid down in Chapter 17 of the Code of Judicial Procedure. Furthermore, the corresponding exceptions on the legal privilege are described in Chapter 7, section 3 and 4 of the Finnish Coercive Measures Act (806/2011, as amended). For example, under chapter 7, section 3, there is no prohibition on seizure or reproduction if the person in respect of whom the obligation of professional secrecy has been imposed consents to the seizure or reproduction. The other exceptions on prohibition on seizure or reproduction cover, for example, offences with a certain maximum term of imprisonment.

b) Does it matter whether the documents are located at the premises of the client or the lawyer? 

In general, it does not matter where the documents are located.

c) How are seized documents put into evidence in a criminal / civil procedure?

Conditions for seizing documents are set out in Chapter 7, section 1 of the Finnish Coercive Measures Act. Accordingly, documents may be seized if they can be used as evidence in a criminal procedure. The evidence (ie the seized document) is named by the party and if necessary, the court decides whether it can be used and whether it should be kept secret.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

Privilege may be waived in three different situations:

• The person whose privilege is at hand waives their right to privilege.
• Privilege yields to a provision of the law.
• Legal protection of the lawyer requires them to be released of privilege.

In addition, the protection of legal professional privilege is under statutory exception of Chapter 15, section 10 of the Finnish Criminal Code (39/1889, as amended), which establishes a responsibility to report to authorities or to the person in danger a serious offence the preparation of which the person with the duty to report has knowledge of.

Furthermore, the Act on Detecting and Preventing Money Laundering and Terrorist Financing (503/2008, as amended) includes disclosure duties which may override lawyers' confidentiality obligations. Also, section 7 d of the Advocates Act (496/1958, as amended) provides that an advocate must openly and truthfully supply the information required by the Disciplinary Board of the Finnish Bar Association in supervisory matters regardless of the possible confidential nature of the information.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?   

To our understanding, this has no effect on the confidentiality of the attorney or the legal counsel or the prohibitions on evidence laid down in Chapter 17 of the Code of Judicial Procedure. However, this issue has not been addressed in case law.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

In principle, no. However, there are no explicit rules on this and the question of whether a notification or sharing of the findings mean a waiver needs to be assessed on case-by-case basis.

4) Privacy Litigation  

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

Not to our understanding.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?

Not to our understanding.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

In general, it does not matter where the documents are located.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?     

This needs to be addressed on a case-by-case basis.

The concept of legal professional privilege as such does not exist in France because disclosure requirements in French litigation are extremely narrow. As a result, rules of legal professional privilege protecting documents from disclosure have not developed in France like they have in England and Wales, the US and other common law jurisdictions. Legal advice provided by a lawyer to their client is, instead, protected by professional secrecy.

Professional secrecy is a general obligation not to disclose secrets, imposed on all persons who, in light of their professional status, have access to such secrets. The obligation is sanctioned both by criminal law (art. 226-13 Criminal Code) and by disciplinary measures.

The question of whether a document is protected by professional secrecy in France is determined not by the content of the communication, but by the role of the author and/or of the recipient. In essence, a lawyer is prohibited from communicating information acquired in the course of assisting a client. This obligation is of public order. It is general, absolute and unlimited.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?

Professional secrecy applies to any information disclosed by client to their lawyer during an internal investigation. Even though the client may subsequently freely disclose the lawyer conclusions to third parties, such conclusions are covered when they relate to information communicated by the client to their attorney.

However, professional secrecy will not apply to information communicated by third parties to an attorney during an internal investigation. In this context, an attorney has to inform said third parties before any communication that their exchanges will not be covered by professional secrecy of the attorney and thus may be disclosed in all or part.

French professional secrecy applies in the context of criminal investigations. Moreover, Article 432 of the French Code of Criminal Procedure expressly forbids the use of correspondence exchanged between the defendants and their attorney(s) as evidence. However, if an attorney is suspected of committing a crime or being an accomplice to a crime, client exchanges may be used as evidence before the French criminal courts for the strict requirements of the attorney’s own defense.

Please note that the French law No. 2021-1729 of December 22, 2021 “for confidence in the judicial institution” has created exceptions to the French attorneys professional secrecy. Article 3 of that law provides that legal privilege is not opposable to the police and judicial investigations measures relating to offences of tax fraud, corruption and the financing of terrorism as well as the laundering of these offences. However, in such cases, the competent Bar Head (Bâtonnier), its representative or the person at whose premises the search of investigation measures take place may object to the seizure of a document and require that this objection be examined by the Judge of Liberty and Custody (Juge de la détention et des libertés). According to Articles 18 and 19 of Law No 78-17 on information technology, data files and freedom, professional secrecy can be opposed to a request from the French Supervisory Authority (Commission Nationale de l’Informatique et des Libertés (CNIL)) to provide information or documents that are covered by such professional secrecy.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

Professional secrecy applies from the beginning of the exchange between an attorney and the client.

Pursuant to Article 2 of the Réglement Intérieur National (RIN) of the French Bar Council, French professional secrecy applies in all matters, whether it be legal advice or litigation. Secrecy applies no matter when a document was created and regardless of the support, whether physical or electronic (eg paper, fax, email).

Professional secrecy covers, notably:

• legal opinions addressed or meant to be addressed by lawyers to their clients
• correspondence between lawyers and their clients, and between lawyers – except correspondence identified as “official”
• meeting notes and, in general, all the elements of lawyers’ files, including all information provided to lawyers in the exercise of their profession
• clients’ names and lawyers’ agendas
• payment of fees
• information required by statutory auditors

c) Are communications to / by companies and in-house counsel protected by privilege?

As a matter of French law, in-house counsel (juristes d’entreprise) are considered to be a separate profession and do not enjoy the same status as attorneys who are members of the Bar (avocats). Under French law, in-house counsel are subject to professional secrecy obligations regarding information that can be characterized as “business secrets” received within the framework of their position in the company. In-house counsel are also prohibited from voluntarily sharing with non-authorized third parties legal advice they provide to the company they work for. A breach of this obligation is deemed a criminal offence (Article 226-13 of the French Criminal Code).

Nonetheless, French courts do not extend the full professional secrecy coverage to communications between in-house counsel and employees, officers or directors of a company in the context of obtaining legal advice. The European Court of Justice confirmed this principle in the Akzo Nobel judgment in an EU competition context. As a result of the French courts' position and the Akzo Nobel judgment, French authorities investigating antitrust and competition law issues can make use of internal company legal advice.

Furthermore, in-house counsel (unlike external lawyers) are obliged to testify if called or to provide evidence regarding their employers.

Lastly, the French Cour de Cassation recently decided that French law will be applicable to determine whether legal professional privilege applies to communications with in-house counsel from other jurisdictions, not the local law of the country in which the communication was made.

d) Are there any specific requirements of a privileged incident response engagement letter?

In practice, to ensure professional secrecy applies, it should be made clear that the document has either been drafted by or is intended for a lawyer, and has been prepared in connection with the request for or provision of legal advice.

2) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, according to Article 2.2 of the National Rules of Procedure (Règlement Intérieur National (RIN) of the French Bar Council, professional secrecy applies to interview notes and more generally to each element of the file, information and confidence received by the attorney who is a member of the Bar (avocat) in the performance of their position.

Regarding experts, unlike attorneys who are members of the Bar (avocats), such third parties are not subject to professional secrecy. They may, however, be subject to professional secrecy obligations regarding information that can be characterized as “business secrets” received in the framework of their position. 

Furthermore, the client, not being bound by professional secrecy, can use exchanges or documents covered by professional secrecy. Therefore, any document, such as the final report, employee interviews or expert reports may be communicated by the client and will thus no longer be protected by professional secrecy.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?

No, the location of the documents does not affect the application of professional secrecy.

c) How are seized documents put into evidence in a criminal / civil procedure?

Documents covered by professional secrecy cannot be seized during a criminal procedure, unless such seizure is expressly authorized by a judge (for instance, when the documents concerned reveal the participation from an attorney to a criminal activity).

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

Response to the first question regarding the waiver:

A client can opt to use a document covered by professional secrecy, but the client cannot release the attorney from their professional secrecy obligations. Professional secrecy may, however, be waived in the interest of the defense of the client or in the interest of the defense of the attorney where they are personally facing judicial proceedings.

In the latter circumstance, the production of protected documents must be essential to the attorney’s defense.

Response to the second question:

The client should make sure to inform its employees (if any) of the confidential nature of the document. The concerned file(s) on the client’s computer (if any) should indicate that the information contained in it is covered by professional secrecy.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

A company cannot be required to disclose the content of an internal investigation in civil litigation if this investigation is protected by professional secrecy.

A company may, however, choose to disclose the content of an internal investigation that is protected by professional secrecy. In this case, the disclosed content of the internal investigation will no longer be protected by professional secrecy.

In addition, it must be noted that where information covered by professional secrecy (in the specific case, medical secrecy) might be disclosed during a public hearing, the CNIL has already granted a request for a closed hearing (Deliberation of the CNIL No SAN-2020-015 of 7 December 2020).

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

The sharing of the content of an internal investigation that is protected by professional secrecy to third parties or affected individuals means the company waives professional secrecy in regards to the disclosed content of the investigation. Thus, the disclosed content of the internal investigation will no longer be protected by professional secrecy but the remaining information that was not disclosed remains covered by professional secrecy.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

To the best of our knowledge, there has not been any published case of civil litigation in regards to GDPR in France as of the date of this report.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?

Communications between French lawyers and foreign lawyers will be subject to professional secrecy only if certain precautions are taken (Article 3 RIN).

For EU lawyers, such precautions may consist of clearly marking communications as “confidential” and/or entering into a confidential agreement covering any, or specified types of, communication (Article 5.3.1 of the Code of Conduct for Lawyers in the EU).

The French Cour de Cassation has ruled that whether professional secrecy covers communications between lawyers registered in two different countries will depend on an analysis of the provisions of the applicable foreign laws.

From a data protection standpoint, to the best of our knowledge, there has not been any rules and/or cases in France that deal specifically with privilege in a multi-state/cross-border scenario.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Communications between French lawyers and foreign lawyers will be subject to lawyer’s professional secrecy only if certain precautions are taken (Article 3 of the RIN), as applicable provisions in other jurisdictions regarding lawyer’s professional secrecy may not be enforced before French courts.

As already mentioned, for communication between EU lawyers, the precautions must include the sender clearly expressing their wish for the communication to remain confidential or without prejudice before communicating the first documents. If the prospective recipient of the communications is unable to ensure their status as confidential or without prejudice they should inform the sender accordingly without delay (Articles 3.3 of the RIN and 5.3 of the Code of Conduct for Lawyers in the EU). Then, the lawyers’ communications should be marked as “confidential” or “without prejudice.”

For communication with non-EU lawyers, the precaution must include the sender making sure that, before exchanging confidential information, the country where the foreign fellow lawyer practices has rules that ensure the confidentiality of the correspondence. If not, the lawyer must enter into a confidential agreement covering any, or specified types of, communication with the non-EU lawyer or ask their client if they accept the risk of exchanging non-confidential information (Article 3.4 of the RIN).

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?

The French notion of lawyer’s professional secrecy might not be enforced before courts of another country. It is then crucial for a lawyer to make sure of the rules applicable in every jurisdiction to control the scope of each national lawyer’s professional secrecy.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

The attorney-client/legal professional privilege (LPP) exists in internal investigations in the same manner as in civil and criminal investigations, that is in relation to investigations by any authority (including but not limited to Competition Authority, Prosecution’s Office). This LPP is based on the Sections 9-13 of Act LXXVIII of 2017 – on Legal Practice.

As a general rule, LPP in Hungary applies to qualified lawyers and junior lawyers, European Community jurists, foreign legal counsels, bar association registered in-house counsel, as well as those persons who assist these people in their work.

The Act on Legal Practice defines LPP as any and all facts, information and data about which the legal practitioner gains knowledge during the course of carrying out their professional duties.

(Section 9-13 of Act LXXVIII of 2017 – on Legal Practice)           

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

No, legal privilege is not affected by any time periods. (Section 9 (4) of Act LXXVIII of 2017 – on Legal Practice)

c) Are communications to/by companies and in-house counsel protected by privilege?     

Yes, communications with bar association registered in-house counsel are protected by LPP. (Section 4 of Act LXXVIII of 2017 – on Legal Practice)

d) Are there any specific requirements of a privileged incident response engagement letter?

No, there are there no specific requirements since LLP also applies to bar association registered in-house lawyers in Hungary. However, it is advised to always clearly mark documents sent to clients and bar association registered in-house counsel from external law firms as legally privileged.

(Section 9 of Act LXXVIII of 2017 – on Legal Practice)

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, as the LPP extends to all types of documents, parts of document, emails and other data carriers containing such LPP information. (Section 9 (2) of Act LXXVIII of 2017 – on Legal Practice)         

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

As regards the legal status of the document, it does not matter whether it is located at the premises of the client or the lawyer. However, in case of an official investigation, different procedures may be applied based on where the document is located. For details, please see question 6. (Section 13 of Act LXXVIII of 2017 – on Legal Practice)

c) How are seized documents put into evidence in a criminal/civil procedure?

On the premises of the lawyer:

The lawyer may not disclose the documents and data containing privileged information, may not be obliged to testify and provide data concerning privileged information during the authority’s revision, inspection, or onsite search.

On the premises of the client:

If the documents containing LPP are considered as “made for the purposes of defence” then those may not be examined, may not be seized and may not be copied by public authority bodies; their presentation, handing them over, giving access to them may be refused.

The law describes the term made for the purposes of defence as: documents or part of documents that were created for the sake or within the frameworks of exercising the client’s right to defence in public authority proceedings, during the communication between the legal practitioner and their client or a record of what was said during such communication, and this character is evident from the document itself. Documents that are not in the possession of the client or the legal practitioner shall not be deemed as documents made for the purposes of defence, except when they prove that the document has been removed from their possession unlawfully or under a criminal procedure.

The authority is entitled to have access to the document – without infringement of the right to LPP, and to the extent absolutely necessary – to establish whether reference to classification as a document made for the purposes of defence is obviously groundless or not.

If the classification of the document is disputed between the client and the authority, during the inspection or onsite search the authority may take possession of the document concerned, providing the document is placed on a storage device that excludes access to the data and the possibility to make subsequent changes.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

The person concerned may waive their rights to LPP, except when the document is connected with the defence in a criminal case where such waiver cannot be made.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

In the case of data breach investigations, the authority must be given access to all documents of the data controller, and may request copies thereof, and is entitled to inspect all such documents – including those stored on electronic data medium – which are presumed to have any bearing on the case at hand, and may request copies of such documents. The data controller and the organisation or person involved in the case at hand must comply with the authority’s request within the time limit prescribed by the authority.

If the findings of such internal investigation falls under LPP, then giving access to the authority may be refused. In such cases it is highly recommended to engage external legal counsel for advice in advance.

(Section 51(1)-(2) of Act CXII of 2011 – on the Right of Informational Self-Determination and on Freedom of Information)

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

This will depend on the scope and nature of the information to be shared. Referring to question 3b, in such cases it is highly recommended to engage external legal counsel for advice in advance.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

We are not aware of such specific cases.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?

We are not aware of such specific case law.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Yes, but only if it complies with Hungarian legal requirements.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

In Hungary there is no specific law on this.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

No. In general, there is no system of privilege or other system similar to discovery procedures. Therefore, in Japanese litigation, each party is able to select the evidence which will be submitted to the court (except in limited circumstances, parties will not be forced to disclose its documents. The exception is detailed in question 6 below). Accordingly, even though there is no privilege system, the risk that documents relating to legal advice are disclosed to the other party is quite low.

In addition, we are not aware of any specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters.

Please note that lawyers may refuse to give testimony in court about the issue related to their client.

Please also note that the privilege is also not introduced in the investigation by Japan Fair Trade Commission regarding violation of anti-trust law. There are currently, however, ongoing moves to introduce such a system.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

No. Please refer to our answer to question 1a above.

c) Are communications to/by companies and in-house counsel protected by privilege?     

No. Please refer to our answer to question 1a above.

d) Are there any specific requirements of a privileged incident response engagement letter?

No. Please refer to our answer to question 1a above.

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

No. As mentioned in the answer to question 1a above, there is no privilege system in Japan. As such, none of these documents are protected by privilege.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

No.

c) How are seized documents put into evidence in a criminal/civil procedure?

Criminal Procedure

Prosecutors can submit the seized documents to court as evidence. There is no privilege system in criminal procedures so legal advice provided by an attorney to a client could be seized and be submitted to the court as evidence.

Civil Procedure

As mentioned in question 1 above, there is no system similar to discovery procedures. Therefore, in Japanese litigation, each party is able to select the evidence which will be submitted to court (except in limited circumstances, parties will not be forced to disclose their documents). In other words, each party must generally acquire evidence by itself.

The exception, however, is that a party can file a petition for submission of documents to court. The court may order the other party to submit the documents if the petition has reasonable grounds. However, if the documents include information which any attorney knows in the course of its business and is subject to the confidentiality duty imposed to the attorney, the court shall not issue such order.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

No. Please refer to our answer to question 1a above.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

No.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

No.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

No.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

No.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

No.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

As no such system of privilege exists, there are no such regulations under Japanese law.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?   

There is no specific legal privilege applicable within the context of internal investigations, save for legal advice privilege under Section 126 of the Evidence Act and litigation privilege under common law.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?     

No. Privilege is absolute unless waived.

c) Are communications to / by companies and in-house counsel protected by privilege?

No. As described above, Malaysian law has yet to specifically recognise that communications to/by companies and in-house counsel are protected by privilege.

d) Are there any specific requirements of a privileged incident response engagement letter?

No.

b) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, if these notes, transcripts, or expert reports were considered as part of the provision of legal advice, or if the documents were prepared with litigation in mind. In order to preserve privilege over such work product, there should be explicit directions from the advocate and solicitor to the third parties before the third parties commence work.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?    

No.

c) How are seized documents put into evidence in a criminal / civil procedure?

If privileged documents are seized, subject to an objection being taken, those documents must be sealed and brought before the court to determine if those documents are protected by privilege.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

Legal privilege can be waived in Malaysia if the right to privilege is not asserted or enforced. To prevent this from occurring, the privilege holder ought to make an objection and make the relevant applications to the courts in order to protect the document. In addition, it is important to clearly label and mark the relevant documents as “legally privileged” to avoid any ambiguity.

b) In data breach litigation, does a company ever need to rely on the findings of internal investigations, and if so, does that mean privilege has been waived?

Yes. If the company relies on the findings of an internal investigation in court proceedings, then privilege in respect of the findings is waived. 

4) Privacy Litigation

a)  Were there any data breach privilege cases in your jurisdiction in the last 5 years? If so, please provide details.

 No.

b) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Generally, no. However, if the data meets the standards for legal privilege under Malaysian law, then it may be treated as privileged regardless of the approach taken outside the jurisdiction.

c) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?         

If an investigation is commenced outside Malaysia, and if the relevant authorities from that jurisdiction attempt to seize the privileged data, the laws of to the jurisdiction in question are likely to apply as to whether the data is considered privileged or otherwise.

However, where there is ambiguity about whether the data would be considered privileged under Malaysian law, the privilege holder may consider making an application to the Malaysian court to make the relevant determination on this, including to obtain any relevant injunctions to prevent disclosure, as required.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?

In the Netherlands, there is no specific legal privilege applicable in the context of internal investigations, criminal investigations and/or data protection matters.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

There are no specific time periods applying to legal privilege.

c) Are communications to/by companies and in-house counsel protected by privilege?

In-house counsels who are admitted to the Dutch bar (Cohen advocaten or advocaten-in-dienstbetrekking) also fall within the scope of legal professional privilege when they act in the capacity of an attorney (advocaat), provided that they comply with all the requirements set out by the Dutch bar and that their independent position vis-à-vis their employer is confirmed by a signed professional statute. This was confirmed by a judgement of the Dutch Supreme Court on March 15, 2013 (ECLI:NL:HR:2013:BY6101). The requirement of having a processional statute in place that guarantees the in-house lawyer’s independence was reiterated in the judgement of the Rotterdam District Court of 7. October 2019 (ECLI:NL:RBROT:2019:7856).  There can also be other reasons for an in-house lawyer to be considered insufficiently independent, for example if the head of the company's legal department is on the executive board and therefore responsible for the management of the company, presenting a potential conflict of interest.

In-house lawyers based outside the Netherlands can also rely on professional legal privilege if it is afforded to them by national law of their home jurisdiction. However, if the in-house lawyers are too embedded in the company, independence may not be properly safeguarded and professional legal privilege may not apply.

d) Are there any specific requirements of a privileged incident response engagement letter?

No, the general rules apply: documents specifically prepared for the purpose of seeking legal advice or to be used in the context of providing legal advice fall under the scope of legal professional privilege.

2) Documents and reports

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, the general rules apply: documents specifically prepared for the purpose of seeking legal advice or to be used in the context of providing legal advice fall under the scope of legal professional privilege. In principle, any type of information is covered by legal professional privilege, including letters, emails, phone calls and digital data. Third parties that are assigned by an attorney to provide (expert) advice on the legal issue for which the client has approached the attorney can claim (derived) privilege.

In 2015, the District Court of The Hague (ECLI:NL:RBDHA:2015:248) ruled that a report about a housing corporation drafted by a law firm following an internal investigation, which only contained factual findings and no legal findings, qualifications or conclusions did not fall within the scope of legal privilege. The Court decided that the defendants in the civil law procedure needed to be provided with a copy of the report. A relevant consideration of the Court was that the report had been given to the defendants in draft form in an earlier stage.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?

In principle, all communications between a lawyer (admitted to the Dutch bar) and their clients are protected by legal privilege, if the lawyer acts in their professional capacity. It does not matter where the communications are stored.

c) How are seized documents put into evidence in a criminal/civil procedure?

Legal professional privilege applies to a search for seizure.

Any search and/or seizure at a lawyer's premises needs to be pre-authorised by an examining judge and must be executed in the least burdensome manner.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

Legal professional privilege can be waived by the client or by the lawyer. As lawyers have an obligation to maintain confidentiality, they  should not waive legal privilege without their client’s consent. Lawyers may be subject to disciplinary action of the bar, or even be held criminally liable if they do not fulfil this obligation.

A practical step to ensure that privilege is not lost: always indicate clearly that the correspondence between a lawyer and their client is confidential (for instance mark the document with “legal professional privilege” or “client-attorney privilege”).

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

It may be necessary in litigation to produce a privileged document as evidence. If so, Dutch law makes it possible to share this information only with the court (subject to the court’s and the counterparty’s approval). If the counterparty does not approve, however, the court may not involve the document in its deliberations. As an alternative, it may be agreed to share a document only between lawyers or only within a ‘confidentiality ring’.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

Yes, however see the answer above at question 3 b) for alternatives.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

No.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?

Yes, see answer to question 1 c) above.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Yes, if the conditions for privilege are satisfied, the physical location of the data is not determinative.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?

There are no specific rules on this. Whether local privilege is respected depends on the privilege regulations of the country where the investigation takes place.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

No, there is no specific privilege for investigations, but the usual privilege rules will apply.

In New Zealand, privilege applies to:

• communications with legal advisors for the purpose of requesting or obtaining legal services and providing such services;
• communications made or prepared for the dominant purpose of preparing for a proceeding or apprehended proceeding;
• communications made in connection with an attempt to settle or mediate a dispute.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

No.

c) Are communications to/by companies and in-house counsel protected by privilege?     

Yes, communications with in-house counsel are protected by privilege if the communication is for the purpose of requesting, obtaining or providing legal services.

d) Are there any specific requirements of a privileged incident response engagement letter?

No.

2) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, if prepared for the purpose of obtaining legal advice or for the purpose of preparing for a proceeding.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

No.

c) How are seized documents put into evidence in a criminal/civil procedure?

There are different procedural rules for criminal and civil proceedings. Usually they will be entered into evidence by being introduced by a witness, or by agreement.

When documents are seized it is usual for a process to be put in place to isolate privileged documents and exclude these from review.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

Yes. A party who holds the privilege can waive that privilege. Privilege can also be waived inadvertently by reference to privileged communications in other documents.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

If a company wishes to rely on privileged documents in litigation, it would be required to waive privilege. Your lawyer can advise on whether you should waive privilege and the implications of the waiver.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

Sharing privileged documents with third parties may amount to a waiver of privilege and careful thought should be given before sharing privileged documents.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

No.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

No.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Yes, if it is within one of the categories above.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

Privileged information does not have to be provided in court or disclosed to any party.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

The legal basis for the attorney-client/legal professional privilege (LLP) exist in internal investigations in the same manner as in civil and criminal investigation, that is in relation to investigations by the Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime (Økokrim) or the Competition Authority and other authorities with similar investigation powers. This LLP is based on a mix of case law and the Sections 119, 204, and 205 of the Criminal Procedural Code and Section 22-5 of the Civil Procedural Act.

As a main rule, LLP in Norway applies to qualified lawyers and junior lawyers, as well as those persons who assist the lawyer in their work.

There are some exceptions/caveats to the LLP, such as in criminal investigations where it leads to an innocent person being convicted or a serious crime being committed, where waivers can be made.

In addition, the LLP does not apply to information a lawyer receives when acting in another capacity, for instance as a member of a company’s Board of Directors.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

There are, to our knowledge, no time period limits or differences as such between litigation and legal advice with respect to the LLP.

c) Are communications to/by companies and in-house counsel protected by privilege?     

Under Norwegian national law, communications with in-house counsel are protected by LLP.

Under EEA/EU law, however, information given to in-house counsel is not protected by LLP. The result of this is, for instance, that if a dawn raid is undertaken by the EFTA Surveillance Authority (ESA), which falls within the scope of EEA/EU law, any in-house counsel at the company in question cannot invoke LLP. However, while in-house counsel may not be able to claim that their communications are protected by LLP in the context of investigations by the ESA, they may seek to do so in the context of an investigation by the Norwegian Competition Authority.

d) Are there any specific requirements of a privileged incident response engagement letter?

No, there are no specific legal requirements, since LLP also applies to in-house lawyers in Norway. However, it is advised to always clearly mark documents sent to clients and in-house counsel from external law firms with “legally privileged”.

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

The LLP in Norway applies to all types of documents, including parts of documents and emails where the lawyer is copied in, provided that they satisfy the criteria mention in question 1 above.

LLP also applies regardless of the lawyer’s nationality. In a case where an in-house counsel of a US corporation had prepared certain strategy documents in connection with a dispute, it was held that sections containing legal considerations and assessments of litigation risk were to be considered as privileged information, cf. decision by the Appeals Selection Committee of the Supreme Court, 22 December 2000. The Supreme Court clarified the duty to produce legally privileged material (in this case a lawyer's annual accounts) in a redacted version as evidence in a law suit. In other words, parts of a document may be legally privilege and other parts not.

In December 2010, the Supreme Court concluded that information regarding money transfers as part of the lawyer's legal practice, as well as the client's identity in a specific instruction for legal advice, was privileged information.

In 2012, the Supreme Court stated that even when a lawyer is subject to bankruptcy proceedings, information on names of clients and on money transfers between lawyer and client will be subject to LLP, and supersede any duty of disclosure unless otherwise provided by a clear statutory provision. In 2013, the Supreme Court concluded that evidence in the form of email correspondence will be considered privileged information if it is sent as a copy to the lawyer, regardless of whether the lawyer has had access to its content. However, taxation and VAT legislation was for posterity amended so that a lawyer is under obligation, regardless of LLP, to give transaction data, and balance and debt information, inclusive of parties to the transaction, to the government. The Supreme Court has also found concerning the Tax Authorities' right of access to email correspondence between a taxpayer and his lawyer to be exempt from the review without further examination. In 2018 the Supreme Court also rejected Økokrim's request to get access to a lawyer’s time sheets. The Supreme Court in addition clarified the duty to produce legal privilege material (in this case a lawyer’s annual accounts) in a redacted version as evidence in a law suit.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

No.

c) How are seized documents put into evidence in a criminal/civil procedure?

Seized documents are first "cleared of LLP" before they become part on an ongoing investigation and are used as evidence. Clearance is done with forensic tools which filters out any legal privilege document by a search of lawyers’ email addresses and other search terms such as “legally privileged”. When the relevant data material is collected and mirror-copied for an investigation, the entity should ensure that the IT or technical personnel together with the lawyer reviews all the material that is identified as privileged, and such documents are excluded from the material.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

LLP may be waived by the party receiving the advice and/or having submitted the privileged information. Such waiver should be made in writing.

If a lawyer is sued by a client for alleged malpractice, the lawyer is free to disclose privileged information to the extent that this disclosure is necessary for their defence. However, information received under a specific confidentiality agreement cannot be divulged even in such cases.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

Documents protected by the LLP cannot be seized by either external or internal investigators, unless the company representative with the necessary authority release the document from the privilege.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

With reference to the question above, there is no reliance on internal investigation with respect to LLP.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

There are several examples of fines for "general data breach" in Norway; however, we are not aware of any data breach privilege cases.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?

LLP applies regardless of the lawyer’s nationality. In a case where an in-house counsel of a US corporation had prepared certain strategy documents in connection with a dispute, it was held that sections containing legal considerations and assessments of litigation risk were to be considered as privileged information, cf. decision by the Appeals Selection Committee of the Supreme Court, 22 December 2000.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

Yes, but only if it complies with Norwegian legal requirements, as it does not matter if the advice is provided by a lawyer/in-house counsel of a different jurisdiction.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

We do not have specific case law on this apart from the fact that an in-house lawyer would have to provide LLP documentation to ESA even if under Norwegian law it is covered by the LLP exemption.

Content to follow shortly.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

Lawyers are obliged by a duty to keep confidential all information which they became aware of in the course of providing legal services. In accordance with Polish law, lawyers are bound by the professional secrecy of lawyers, which means that they must keep all information concerning their provision of legal services confidential.

Generally, professional secrecy exists in all kinds of proceedings, including civil, criminal and competition law. However, under some circumstances, strictly provided by law, the secrecy obligation may be waived in criminal and competition proceedings.

There are no specific rules on secrecy regarding data protection matters, ie the general obligation of professional secrecy applies.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

No.

c) Are communications to/by companies and in-house counsel protected by privilege?     

There is no separate law concerning the secrecy of in-house lawyers. Therefore, the abovementioned comments apply to in-house lawyers, provided that in-house lawyers are qualified lawyers (if the in-house lawyer is not a qualified lawyer, ie they are not admitted to the Bar, the professional secrecy rule does not apply to them).

Generally, the abovementioned rules will apply to non-national qualified lawyers (who obtained a professional title in a Member State of the EU or third country and are admitted to the Bar) in the event that they provide services in the territory of Poland. Polish law specifies the scope and limitation of legal services provided by foreign qualified lawyers in the territory of Poland. However, general rules applicable to lawyers will be applicable to foreign qualified lawyers, including the professional secrecy rule.

d) Are there any specific requirements of a privileged incident response engagement letter?

No.

2) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, if they are prepared or obtained for the purpose of giving legal advice.        

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

Yes, generally we recommend to store all such documents at the premises of external lawyers.

c) How are seized documents put into evidence in a criminal/civil procedure?

Documents are seized, analysed by prosecution agency and put in the case files if they are relevant for the proceedings. In civil cases there are no discovery rules.

3) Waiver of Privilege   

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

Professional privilege is an obligation of lawyers towards clients. If a client wants to use document that is privileged, they can do so. Clients may also waive the privilege for the lawyer. It needs to be done expressly.

The most important exception to professional secrecy is covered by the Polish Code of Criminal Procedure. Under its regulation, a judge, after a prosecutor’s motion, can lift the confidentiality obligation and allow a lawyer to be examined as a witness. It could happen for the purpose of justice and in the absence of any other proper evidence. This regulation is highly criticised in Polish legal society and it is used in very limited cases. Furthermore, a lawyer is obliged to disclose information which refers to money laundering or terrorist activities regulated under a separate statute.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

There are no specific rules on this matter related to data protection regulations, general rules apply.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

N/A

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

As mentioned in the answer to question 1, there is no legal privilege under Polish and professional secrecy rules apply instead, therefore there is no relevant case law on data breach privilege to reference.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

The professional secrecy rules are regulated in local law and applicable to lawyers acting in Poland. There are no specific rules or case law we can identify which pertains to cross-border scenario.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

As mentioned above, there is no legal privilege under Polish and professional secrecy rules apply instead. Therefore, there are no clear rules on cross-border applicability of legal privilege and it is unclear whether foreign data would be treated as privileged in Poland.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

As mentioned above, in the case of proceedings on the territory of Poland, lawyers are bound by the professional secrecy of lawyers, which means they must keep all information concerning their provision of legal services confidential. For exceptions applicable to criminal proceedings, please refer to question 3a.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?

No, legal privilege legal framework applies regardless of the type of investigation.

In Portugal, legal professional privilege is recognized as a fundamental right and duty of the lawyer, safeguarded both in the constitution of the Portuguese Republic and in secondary legislation (civil and penal legal frameworks).

Under the Statute of the Portuguese Bar Association (EOA), the broad definition of legal professional privilege covers a broad spectrum of information and documentation, applying to general legal advice, representation in litigation proceedings and covering all facts that a lawyer becomes aware during or as a result of their professional activity. Every fact and/or document (in any format) related to professional matters disclosed to a lawyer by a client, its associated parties, co-defendants, counterparties, and other, is covered.

Legal professional privilege is binding regardless of whether the lawyer is remunerated or has agreed to carry out the representation or service.

This obligation is applicable to every lawyer that has had, directly or indirectly, any intervention in the matter. In the case of a law firm, this duty is extended to every lawyer and support staff of the firm and in practice, anyone who assists the lawyer is obliged to maintain the same professional privilege, compliance with which should be ensured by a written statement drawn up to that effect before the beginning of the collaboration, and any violation of that duty is a disciplinary infraction.

A lawyer may refuse to testify about facts covered by legal professional privilege. Any acts practiced by a lawyer in breach of legal professional privilege cannot be used as evidence in court. Moreover, breach of legal professional privilege rules can give rise to a disciplinary procedure, as well as civil and/or criminal liability.

Nonetheless, legal professional privilege does not cover facts:

• known to the public;
• previously proven in court;
• deemed a crime in which the lawyer is a suspect of having played an active role;
• described in public documents/deeds; and
• absolutely necessary to defend the dignity, rights and legitimate interests of the lawyer or of the client, the authorization of the Bar Association (exceptional cases).

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

No. There are no specific types or categories of legal professional privilege, thus it does not vary depending on whether the privilege relates to legal advice or litigation. The obligation to maintain professional secrecy is not limited in time and exists regardless of whether the act required from the lawyer involves judicial or extra-judicial representation, is paid or free, and even if the lawyer has not accepted the service.

c) Are communications to / by companies and in-house counsel protected by privilege?

Yes, to the extent in-house counsels are members of the Portuguese Bar Association. In-house counsels have the same rights and are bound by the same duties as independent lawyers, notably as regards legal professional privilege. In fact, under Opinion No. E-07/07 of the General Council of the Bar Association, the search and seizure by the Competition Authority of documents in the office and computer of an in-house lawyer should be considered not only void but may also constitute a criminal act.

d) Are there any specific requirements of a privileged incident response engagement letter?

Under Portuguese law, there are no specific requirements for privileged incident response engagement letters. However, the engagement letter should be concluded in writing, directly between the lawyer and the third party prior to starting the cooperation and should include language making clear that the purpose is to assist the lawyer in the scope of its professional activity and the obligation of the third party to comply with secrecy obligation.

2) Documents and Reports  

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, legal professional privilege extends to any document or data directly or indirectly related to the facts revealed to the lawyer in the course of their professional activity.

If a client suspects a data breach and contacts a lawyer to assist them in clarifying the situation, and consequently the lawyer requests a third-party forensic expert to investigate and prepare a report, we understand that this report will be covered by legal professional privilege.

The engagement letter shall be concluded, in writing, directly between the lawyer and the third party prior to starting the cooperation and should include language making clear that the purpose is to assist the lawyer in the scope of its professional activity and the obligation of the third party to comply with secrecy obligation.

b) Does it matter whether the documents are located at the premises of the client or the lawyer? 

No, it doesn’t matter where the documents are located. Regarding raids, searches and seizures carried out in a law firm (or in any other archive location), please see the answer to Question 2c.

c) How are seized documents put into evidence in a criminal/civil procedure?

Regarding raids, searches, and seizures, those carried out in a law firm, or any other archive location, as well as the interception and recording of conversations or communications (telephone or email registered in the Bar Association) of a lawyer in the exercise of the legal profession, may only be ordered and presided over by a judge in accordance with the EOA. The concerned lawyer, the president of the Regional Council, the president of the delegation or a delegate of the Bar Association, as applicable, should be present.

In the course of a raid, a lawyer may file a complaint for breach of legal professional privilege, in which case the judge must interrupt the investigation of the documents, seal them and wait for the president of the court of appeals to decide whether the documents can be accessed, according to the EOA.

Notwithstanding the above, no correspondence concerning the exercise of the legal profession can be seized, except where such correspondence is related to a criminal fact in relation to which the lawyer has been formally charged, pursuant to the Code of Criminal Procedure and the EOA.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

A lawyer can be authorized by the Portuguese Bar Association to disclose facts covered by professional privilege if it is absolutely necessary for the defense of the dignity, rights and legitimate interests of the lawyer or their clients or representatives. However, even after authorization, lawyers may choose to maintain secrecy.

The waiver must be made by means of a request, signed by the lawyer, and addressed to the President of the District Council to whose geographic area the lawyer’s professional domicile belongs. The request should identify, in an objective, concrete and exact manner, the fact or facts in relation to which the waver is sought, contain the complete identification of the requesting lawyer, be accompanied by the documents necessary for examination of the request and, where the request concerns a proceeding in progress, be accompanied by the relevant procedural documents.

Professional legal privilege can be lifted by order of the court under the Criminal Procedure Code. Although the Bar Association is heard before the court’s decision to waive professional privilege, it is highly discussed whether its opinion is binding or not. Consequently, it is also disputed whether a lawyer that refuses a court order to waive professional privilege incurs a crime of disobedience under the Criminal Code.

It should be noted that professional privilege cannot be waived regarding correspondence between lawyers, as it is considered that this absolutely confidential as long as it is identified as such.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

Legal professional privilege is fully applicable to litigation. This means a lawyer can refuse to disclose facts that are subject to legal privilege. However, a lawyer can be authorized by the Portuguese Bar Association to disclose facts covered by professional privilege if that is absolutely necessary for the defense of the dignity, rights and legitimate interests of the lawyer or their clients or representatives.

In the context of the Data Protection Law (ensuring the implementation of the General Data Protection Regulation in Portugal) anyone who is subject to legal privilege, without cause and the respective consent, reveals or discloses personal data is punished with imprisonment up to one year or a fine up to 120 days. The fine is increased in double in its limits in case of:

• a worker in public office or equivalent, under the terms of the criminal law;
• a Data Protection Officer;
• intention to obtain any patrimonial advantage or other illegitimate benefit;
• endangering the reputation, honor, or privacy of third parties.

The legal duty of cooperation of public and private entities with the local Data Protection Authority cannot affect the legal privilege duty imposed to the Controller.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

Please refer to our answer b) above.

4) Privacy Litigation  

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

In 2018, the IT systems of some Portuguese law firms were hacked. The documents and information disclosed were almost all subject to legal professional privilege and included clients’ personal data, from their addresses, citizen card numbers, mobile phone number and social security and taxpayer numbers. This case is still on trial.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?       

Yes, the Code of Conduct for European Lawyers contains provisions regulating the legal privilege in the scope of cross-border/multi-state activities, notably, establishing that a lawyer of a Member State may be obliged to respect the professional rules of other Member States’ Bar Associations.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

In the EU, the Code of Conduct for European Lawyers sets forth that it is subject to legal privilege the information that a Lawyer gains knowledge in the scope of their professional activity.

Thus, in general terms, the legal professional privilege extends to lawyers who are admitted to a Bar Association in an EU Member States. The Code of Conduct for European Lawyers sets forth that while acting in other Member States, a lawyer may be bound to comply with the professional rules of the Bar or Law Society of the host Member State, which means that non-national lawyers acting in Portugal must comply with the Portuguese Lawyers’ Bar Statutes and, in general, with Portuguese Law. Hence, in these circumstances they are subject to the same guidelines and code of conduct as Portuguese lawyers, notably the rules of legal professional privilege.

In the case of communications, a lawyer of a Member State who sends a communication to a lawyer in other Member State must indicate that the communication is “confidential.”

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?     

Please refer to our answer above in relation to investigations outside Portugal in an EU Member State.

Content to follow shortly.

Content to follow shortly.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

Russian law does not in general recognise the concept of legal professional privilege. However, the concept of legal professional privilege is still expressed in certain ways. The most similar concept is advocate secrecy. An advocate secret is any information connected with an advocate providing legal services to their client. Such information may include:

• the fact of an advocate being contacted by a client;
• the information obtained by an advocate from their client;
• the evidence and documents collected by an advocate while preparing for a case; and
• the content of legal advice provided to the client.

An advocate secret is protected by law and there is no need to enter into a special agreement (ie a confidential agreement).

Information considered an advocate secret cannot be requested to be provided to any state bodies (either in the context of civil or criminal litigation or upon the request of the antimonopoly authority). Advocates cannot be questioned as a witness regarding circumstances that became known to them while rendering legal services to their clients.

Under Russian law, not every lawyer is considered an advocate. To gain the status of an advocate, a candidate must meet the special requirements set out in the federal law and pass a special exam.

If a lawyer does not have the status of an advocate, the information they receive from their clients can be protected by a regime of commercial secrecy. This regime differs from the concept of legal professional privilege.

Commercial secrecy is a specific regime for protecting confidential information. Commercial secrecy covers information of any character (production, technical, economic, organisational, etc, including the results of intellectual activity in the scientific and technical area, as well as information on the methods for performing a professional activity) which has an actual or a potential commercial value because it is unknown to third parties. A regime of commercial secrecy is deemed to have been established if the holder of commercially secret information has adopted the set of measures listed in federal law to protect the confidentiality of the information.

A commercial secret cannot be disclosed to third parties unless it is officially requested by an authorised state body (investigating agencies, agencies in charge of a pre-trial inquests, judicial authorities and antimonopoly bodies). A commercial secrecy regime cannot be applied to certain types of data specifically excluded by law (for example, constituent documents, documents confirming entries in the relevant state registers, etc). This means that the commercial secrecy regime does not provide immunity against document requests or seizure during inspections conducted by any competition authority (including dawn raids).

Russian competition law specifies that commercial secrecy cannot be established in relation to information provided by a party to a competition investigation on its own initiative to the regulatory authority. This means that commercial secrecy can only be applied to information that has been provided in response to a request from the competition authority, or obtained by the competition authority during an inspection.

The competition authority should not disclose any commercial secret obtained in the course of the exercise of its powers, except in specific circumstances permitted by law (eg upon the request of a court, investigation agency, etc). Therefore, the commercial secrecy regime does not necessarily protect information or documents from disclosure to the competition authority, but it does serve to protect it from further disclosure by the competition authority to third parties (including other parties to the antimonopoly case).

If a commercial secret is wrongfully disclosed. the relevant employees of the competition authority may be subjected to civil, administrative and/or criminal liability. Damage caused by the disclosure of a commercial secret may be compensated by the state.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

N/A

c) Are communications to/by companies and in-house counsel protected by privilege?     

In-house counsel cannot disclose to third parties (except authorised state bodies) commercial secrets which they obtained during the performance of their employment. Authorised state bodies have a right to seize documents or question an in-house counsel as part of a special inspection of the company or criminal prosecution of the head of the company or other employees, as well as in other special cases.

There is a general human and constitutional right for the secrecy of correspondence, telephone calls, etc (Article 23 of the Russian Constitution). This right can be limited if the information is officially requested by authorised state bodies. However, this applies only to private correspondence and not to official/business correspondence.

d) Are there any specific requirements of a privileged incident response engagement letter?

N/A

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Those documents can be protected if they fall under an advocate secret or commercial secret, as described above.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

No, the key consideration is whether this falls under an advocate secret or commercial secret, as described above.

c) How are seized documents put into evidence in a criminal/civil procedure?

No specific rules apply in this regard.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

Advocate secrecy is unlimited in time and can only be waived by the client. There are certain exceptions to this rule stated in the law.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

N/A

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

N/A

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

N/A

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

N/A

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

N/A

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

N/A

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?

There are no express provisions regarding attorney-client privilege in Korean law, including with regard to any definition, scope, or applicability.

However, under various laws, there are provisions relating to attorneys’ obligations of confidentiality and the right to refuse to give testimony that may be detrimental to a client. These include:

• the constitutional right to assistance of counsel (Article 12(4) of Constitution of the Republic of Korea)
• attorneys’ duty of confidentiality (Article 26 of the Attorney-at-Law Act)
• attorneys’ right to resist searches and seizures (Article 112 of the Criminal Procedure Act)
• attorneys’ right to refuse testimony (Article 315, Paragraph 1 of the Civil Procedure Act )
• attorneys’ right to refuse to testify in respect of secrets of other persons of which they obtained knowledge in consequence of a mandate they received in the course of their profession (Article 149 of Criminal Procedure Act)
• attorneys’ right to refuse production of documents (Article 344, Paragraph 1, Subparagraph 3, Item C of the Civil Procedure Act)

The Foreign Legal Consultant Act has codified the rule of confidentiality as applied to communications with non-national qualified attorneys (Article 30 of the Foreign Legal Consultant Act).

Some practitioners therefore take the view that the concept of legal professional privilege is recognized under Korean law as a by-product of those confidentiality obligations.

There have been continuous legislative attempts to introduce attorney-client privilege into the Korean legal system. In fact, a group of members of the National Assembly introduced two separate bills concerning attorney-client privilege during the 20th National Assembly (2016~2020). These bills suggested amendments to the current Attorney-at-Law Act to include a provision expressly granting the right to refuse disclosure of documents containing privileged communications between an attorney and their client, unless there is a special exception permitting disclosure or the client consents to its disclosure. But these bills were not passed by the National Assembly and subsequently discarded with the end of the 20th National Assembly’s term. Currently in the 21st National Assembly (2020-2024), a proposed amendment to the Attorney-at-Law Act would expand Article 26 on the attorney’s duty of confidentiality to include the protection of clients’ rights via attorney-client privilege. The amended Article 26 would prevent the disclosure of:

• confidential communications between an attorney and a client relating to a matter;
• any material provided by a client to an attorney relating to a matter; and
• any material prepared by an attorney relating to a matter, unless
• the client consents to such disclosure;
• there is significant public interest for disclosure, such as the client obtaining legal advice for criminal purposes; or
• the attorney must disclose such material or communications to defend themself in a dispute with the client.

Further, the amendment would prohibit such protected communications and materials from being used as evidence in any judicial or administrative proceeding. However, whether the proposed bill will be passed by the National Assembly and ultimately enacted is yet to be seen.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

As mentioned above, there are no express provisions regarding attorney-client privilege in Korean law.

The proposed amendment to the Attorney-at-Law Act providing for such privilege does not stipulate any particular time period for asserting privilege.

c) Are communications to / by companies and in-house counsel protected by privilege?

Correspondence between an in-house counsel and their clients is not expressly denied protection by legal professional confidentiality. In the case of in-house counsel, the existence of privilege is subject to stricter examination. In other words, one would have to consider that there is a strong opinion against protecting attorney-client privilege between in-house counsel and the company because in-house counsel has a dual position as an employee and counsel at the same time.

The proposed amendment to the Attorney-at-Law Act providing for such privilege does not differentiate between outside and in-house counsel with respect to asserting privilege.

d) Are there any specific requirements of a privileged incident response engagement letter?

The proposed amendment to the Attorney-at-Law Act providing for such privilege does not provide for any specific requirements regarding a privileged incident response engagement letter. However, should the proposed amendment become law, it would be advisable for such letters to include statements that the third party is involved for the attorney to advise the affected entity, to maximize the chance of protecting any communications and material with privilege.

2) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

The proposed amendment to the Attorney-at-Law Act providing for such privilege may protect such material, as long as it is provided to or prepared by the attorney. However, the proposed amendment is silent on the scope of such privilege, such as whether the copy of the material provided to the attorney still in the client’s possession is also protected by privilege, or whether material prepared by third parties who are retained by the attorney for a matter is also protected by privilege.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?

Please see our response to question 2a above.

c) How are seized documents put into evidence in a criminal / civil procedure?

Pursuant to Article 112 of the Criminal Procedure Act, a person who is or was a licensed attorney may resist search or seizure of articles entrusted to them by their clients on the basis that they are confidential.

In practice, however, when a search or seizure is conducted against a corporation, any legal opinions/advice from in-house counsel are not protected by legal professional confidentiality, and may be used and investigated by the investigative authorities. The Korean courts do not sanction such practice.

Therefore, documents obtained via seizure by investigative agencies can be used as evidence in the same manner as other evidence according to the relevant evidentiary laws in either the Civil Procedure Act or the Criminal Procedure Act.

The proposed amendment to the Attorney-at-Law Act providing for such privilege would prevent such documents from being used as evidence. One of the exceptions to privilege ((a) the client consents to disclosure, (b) there is significant public interest for disclosure, such as the client’s obtaining legal advice for criminal purposes, or (c) the attorney must disclose such material or communications to defend him/herself in a dispute with the client) would have to be met for such material to be used as evidence in any judicial or administrative proceeding.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

There are a number of situations in which legal professional confidentiality may not apply or may be waived. For example, legal professional confidentiality can be waived if necessary steps were not taken to ensure that the communications, both written and oral, were undertaken in confidence, or if the client or the attorney voluntarily discloses confidential information during an investigation.

The proposed amendment to the Attorney-at-Law Act providing for such privilege provides for limited exceptions to such privilege, ie:

• the client consents to disclosure;
• there is significant public interest for disclosure, such as the client obtaining legal advice for criminal purposes; or
• the attorney must disclose such material or communications to defend themself in a dispute with the client.

In addition, communications between attorneys and clients must be confidential to be protected (the same condition is not stipulated for material provided by the client to the attorney, or material prepared by the attorney in the current amendment). Therefore, under the proposed amendment, the client would have to ensure that communications with the attorney are confidential to maximize the scope of privilege.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

If a company needs to rely on the findings of internal investigations and use them in a data breach litigation as favorable evidence, such reliance and use can be deemed as consenting to disclosure under the proposed amendment to the Attorney-at-Law Act. Yet, it is unclear as to whether a concept called “issue waiver” would apply under the current version of the amendment.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

The amendment to the Attorney-at-Law Act does not have express provisions. However, whether notification to or sharing of the information constitutes a waiver will depend on the scope and nature of the information being shared with affected individuals or third parties in individual cases. Therefore, to avoid being deemed as an inadvertent waiver, one should exercise prudence and care when sharing the contents of such information.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

We have not located any court decision in which the issue of data breach privilege was addressed.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/ cross-border scenario?

South Korea is not a multi-state nation, so the question would be inapplicable. The proposed amendment does not expressly contemplate cross-border scenarios.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

The proposed amendment does not have express provisions governing the situation above. Therefore, whether the privileged data in another jurisdiction would be treated as privileged in our jurisdiction is up to judicial determination through case laws.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?

The proposed amendment does not have express provisions governing the situation above. In a similar vein, it also remains to be seen what (additional) elements our courts would require so privileged data in a foreign jurisdiction would remain privileged in our jurisdiction.

Spanish Data Protection Laws (including both EU General Data Protection Regulation 2016/679 “GDPR” and Spanish Fundamental Act 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights “NLOPD”) include some provisions regarding “legal and professional obligations of secrecy”. Sometimes, professional secrecy is considered a safeguard of the rights and freedoms of the data subject, operating as a limit to the processing of sensitive personal data (e.g. Article 9.2.(i) of the GDPR). In other cases, professional secrecy operates in the opposite direction: processing may be lawful only if the data are processed by professionals under a secrecy obligation (e.g. Article 9.3 of the GDPR). In some cases, professional secrecy obligations may act as an exception to reporting obligations(e.g. Article 14.5 (d) of the GDPR).

The Data Protection Officer is made subject herself/himself to a duty of professional secrecy (Article 38.5 of the GDPR) when conducting her/his activities but this does not prevent the officer from investigating the data processing activities of a controller who objects on the basis of  professional secrecy owed to company employees or representatives (Article 36.3 of the NLOPD). The same applies to the staff of the Spanish data protection supervisory authorities.

Article 90 of the GDPR allows Spanish authorities to issue new legal provisions harmonizing data protection laws and legal or professional secrecy duties. In addition to the points discussed above, Spain has made intense use of this delegation, clarifying that data protection and professional secrecy obligations are separate and compatible (Article 5 of the NLOPD) or requiring processing by external data processors to apply enhanced professional secrecy rules (Article 28.2 of the NLOPD), for example. Other harmonization rules that are specific to certain professions, (e.g. the medical profession), are also contained in the NLOPD.  

Due to the relatively recent date of entry into force of both the GDPR and the NLOPD, case law on these matters still remains limited.   

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/ or data protection matters? If yes, what are the elements required for these categories of investigation?     

No, there are no specific or additional legal privileges afforded to internal investigations.  Under Rule 2 of the Supreme Court Rules and Section 2 of the Evidence Ordinance, legal professional privilege will be applicable in the same manner for both civil and criminal proceedings.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?

There are no specific time periods which apply to legal privilege, irrespective of whether the attorney is involved in litigation or providing legal advice.

As stated above, the duty of nondisclosure of privileged information conferred on an attorney will continue after their professional relationship with the client has ceased to exist and indefinitely thereafter, even after the death of the client.

c) Are communications to / by companies and in-house counsel protected by privilege?

Yes, as stated above, all communications with an attorney falling within the description of Rule 2 of the Supreme Court Rules will be protected by legal professional privilege. The fact that the attorney is acting in their capacity of an in-house counsel has no bearing on the protection afforded to the communications between the said attorney and their clients, provided the attorney in question is admitted and enrolled by the Supreme Court of Sri Lanka.

d) Are there any specific requirements of a privileged incident response engagement letter?

No.

2) Documents and Reports

a) Does privilege protect notes or transcripts of employee interviews, third-party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

If the notes, transcripts and reports were prepared by a third party, who does not fall within the description of an attorney as envisaged by the Supreme Court Rules, they will not be protected under privilege, even if the documents were subsequently used by an attorney for the purpose of giving legal advice. In other words, to benefit from the protection of privilege under Sri Lankan law, the relevant documents will need to be prepared by an attorney.

However, if the notes, transcripts of employee interviews (where it is retained by the attorney to carry out such interviews) and reports were prepared by the attorney for the client, they would be protected under legal professional privilege.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?

No, for the purposes of privilege, it does not matter whether the documents are located at the premises of the client or the lawyer.

c) How are seized documents put into evidence in a criminal / civil procedure?

Documents may be seized in the manner provided for under the Code of Criminal Procedure Act No. 15 of 1979 or the Prevention of Terrorism Act No. 48 of 1979.

Objections against the admissibility of such documents can be made by making an application to the Sri Lankan courts under the Evidence Ordinance, under grounds such as privilege or irrelevance of the document to the case in question. The admissibility of the seized documents as evidence and the veracity of the objections will be determined by the presiding Judge.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?

See the answer to the above question “How is legal professional privilege waived?”

In order to ensure privilege is not lost, a client can make a stipulation within the Letter of Engagement or Non-Disclosure Agreement between himself and the attorney which states that no disclosure of information or documentation is to occur except with prior written consent from the client. This would preclude the attorney from relying on implied consent as a basis for privilege to be waived.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and, if so, does that mean privilege has been waived?

There is no mandatory requirement for a company to rely on the findings of an internal investigation in the course of a data breach litigation.

Note, however, that Sri Lanka does not currently have any specific laws or rules relating to data breaches, therefore, data breach litigation is rare in Sri Lanka. The Personal Data Protection Bill is currently pending enactment by Sri Lanka’s Parliament.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

As mentioned above, internal investigations which are conducted by individuals who are not attorneys in Sri Lanka, will not be considered as privileged. 

In the event the internal investigation is conducted by an attorney, notifying those affected only of the findings, as opposed to the contents or any extract of the internal investigation report, will not result in the loss of privilege of the internal investigation report. 

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last 5 years? If so, please provide details.

There are no public court records (ie judgments issued by the Supreme Court and Court of Appeal of Sri Lanka) of any data breach privilege cases in Sri Lanka within the last five years.

b) In data breach litigation, does a company ever need to rely on the findings of internal investigations and, if so, does that mean privilege has been waived?

There is no mandatory requirement for a company to rely on the findings of an internal investigation in the course of a data breach litigation.

Note, however, that Sri Lanka does not currently have any specific laws or rules relating to data breaches, therefore, data breach litigation is rare in Sri Lanka. The Personal Data Protection Bill is currently pending enactment by Sri Lanka’s Parliament.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

No, the fact that data is considered privileged outside the Sri Lankan jurisdiction would not necessarily make the data privileged within Sri Lanka, unless the elements of legal professional privilege under Sri Lankan law have been met.

d) How is privileged data in your jurisdiction treated in the event of a civil/ criminal investigation outside the jurisdiction to ensure privilege is maintained?

If data is considered to be privileged under Sri Lankan law, then irrespective of whether the investigation takes place within or outside of Sri Lanka, legal professional privilege can be invoked by the party in question. 

Practical steps, such as marking the privileged information as “Privileged and Confidential,” or the signing of a Non-Disclosure Agreement with the parties in question may assist in protecting the privilege afforded to the information in question. 

This would be subject to the exceptions set out above relating to the disclosure of crime, fraud or furtherance of an illegal purpose, and subject to relevant local laws in the jurisdiction where the civil/criminal investigation takes place.

1) Privilege in Investigations

a) Is there a specific legal privilege arising in the context of internal investigations, criminal investigations and/or data protection matters? If yes, what are the elements required for these categories of investigation?       

The general rule on legal privilege in Sweden is the following: An advocate has a duty of confidentiality in respect of matters disclosed to the advocate within the framework of the legal practice or which in connection therewith becomes known to the advocate. Exceptions from the duty of confidentiality apply if the client consents thereto or where a legal obligation to provide the information is at hand.

An exception also applies if disclosure is necessary to enable the advocate to avert complaints by the client or to pursue a justified claim for compensation in respect of the mandate concerned.

This general rule also applies in the contexts mentioned and there is thus no specific legal privilege arising in the contexts mentioned.

"Matters disclosed" is given a wide interpretation and includes everything disclosed to the advocate, including but not limited to correspondence, notes and reports made/prepared by the advocate, the client, the opponent or a third party.

b) Are there specific time periods which apply to legal privilege? Do they vary depending on whether the privilege relates to legal advice or litigation?  

No there are no specific time periods and the legal privilege applies also after a specific matter/instruction has been concluded and ended.

c) Are communications to/by companies and in-house counsel protected by privilege?     

Yes, all communications to/by an advocate within the framework of the legal practice is protected by privilege including communications to/by companies and in-house legal counsel.

d) Are there any specific requirements of a privileged incident response engagement letter?

No.

2) Documents and Reports 

a) Does privilege protect notes or transcripts of employee interviews, third party expert reports or expert reports prepared or obtained for the purpose of giving legal advice?

Yes, all communications to/by an advocate within the framework of the legal practice is protected by privilege.

b) Does it matter whether the documents are located at the premises of the client or the lawyer?        

No, if the documents are subject to legal privilege this should not matter. Having said this, there are cases in Sweden in which the legal privilege has in fact been broken when the documents are located at the premises of the client or a third party, especially in connection with seizures and investigations carried out by Swedish public authorities/agencies. On a related note, Stockholm District Court has ruled (T 7678-18) that mirroring of a hard drive at a parent company's address, where two defendants that were board members of the subsidiary subjected to seizure, also had their workplaces, did not mean that the mirroring occurred with a third party. Furthermore, Stockholm District Court stated that legal privilege should not be considered broken as a consequence of information being available both with the subsidiary and the parent company.

c) How are seized documents put into evidence in a criminal/civil procedure?

If documents in possession of an advocate or the client lawfully have been seized in connection with criminal or some types of administrative proceedings, then the public prosecutor or the public authority /agency concerned may rely on and present the documents in Swedish criminal or administrative proceedings. Depending on the content in the seized documents, the court may decide that the content of the seized documents should be treated as confidential in the court proceedings.

There are no means available for carrying out and executing a forced seizure of documents within the framework of Swedish civil proceedings. Instead, a party in civil proceedings may ask the court to order the other party to present certain specified documents, an Edition Order. If an Edition Order is issued and the documents are not presented, the other party may be called to a hearing and under oath declare that the party is not in possession of the documents. However, an Edition Order may not be granted against an advocate or concern documents that are subject to legal privilege.

3) Waiver of Privilege

a) Are there exceptions to the legal privilege rules in your jurisdiction, such as waiver? If yes, what are the elements required to establish these and are there practical steps that can be taken to ensure that privilege is not lost?        

Yes, waiver of legal privilege is always possible by the party or parties protected by the legal privilege. If a waiver is given it is pertinent to consider what the waiver should encompass and to document this in clear language.

b) In data breach litigation does a company ever need to rely on the findings of internal investigations and if so does that mean privilege has been waived?

Yes, we can envisage that there might be situations in which a company needs or wants to rely findings of internal investigations and if so, this could be construed as that privilege being waived by the company concerning the findings revealed/disclosed.

c) If reliance means a waiver, does notification to affected individuals of the findings of internal investigations or a sharing of the findings with third parties mean a waiver, too?

It is difficult to provide a general answer to this. The company notifying affected individuals or sharing findings with third parties could, if the company wants to mitigate the risk for this being construed as a waiver, state to the individuals/third parties that the findings of internal investigations disclosed are strictly confidential and that they may not be disclosed by them to any one unless there is a legal obligation to do so such as a binding court order to this effect or if express consent hereto is obtained.

4) Privacy Litigation

a) Were there any data breach privilege cases in your jurisdiction in the last five years? If so, please provide details.

No.

b) Are there any rules and or cases in the jurisdiction that deal specifically with privilege in a multi-state/cross-border scenario?         

Not that we are aware of. However, the Swedish Bar Association position is that the laws and regulations on legal privilege that apply for non-Swedish advocates should be recognised and upheld in Sweden.

c) Would privileged data outside your jurisdiction be treated as privileged data in your jurisdiction?

It is difficult to provide a general answer to this. We trust that if the privileged data deriving from outside Sweden would also classify as privileged data in Sweden, then the answer should generally be yes. Other situations are difficult to assess without knowing and considering the specific circumstances and facts.

d) How is privileged data in your jurisdiction treated in the event of a civil/criminal investigation outside the jurisdiction to ensure privilege is maintained?    

A non-Swedish court or a non-Swedish public authority/agency cannot enforce an order to disclose privileged data directly against a Swedish advocate or a person residing in Sweden or a Swedish legal entity. They can possibly seek assistance from Swedish courts and/or authorities/agencies to do so, if there is a treaty on legal aid in place that deals with privileged data. Even if so, material Swedish laws and regulations concerning privileged data will in all likelihood be upheld.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.

Content to follow shortly.