by Bret Cohen, Jillian Hart, and Matthew Brown
Case Focus
The Supreme Judicial Court (“SJC”) recently issued its anticipated decision in Attorney General v. Facebook, Inc., 487 Mass. 109 (2021), addressing the extent to which the work product doctrine or the attorney-client privilege protects internal investigations from disclosure.
The decision affirmed in part and reversed in part a Superior Court decision (Attorney General v. Facebook, Inc., 2020 WL 742136 (Jan. 17, 2020) (Davis, J.)) that held that the work product doctrine did not apply to documents the Massachusetts Attorney General (“AG”) sought from social media giant Facebook, Inc.’s (“Facebook”) internal investigation into a data privacy breach.
The SJC’s decision provides an important reminder for companies to tread carefully and always consult with counsel before launching an internal investigation to understand what may be discoverable in future litigation.
Facts and Background
After a widely publicized data breach incident involving one of its third-party applications (“apps”), Facebook undertook an internal investigation, led by outside counsel, to determine the extent to which the platform’s apps misused user data and to evaluate associated liability. Facebook intended for the app developer investigation (“ADI”) to identify any other apps that misused user data and to assess Facebook’s potential liability from the incident. Both in-house and outside counsel “designed, managed, and overs[aw]” the ADI and “devised and tailored the ADI’s methods, protocols, and strategies to address the specific risks posed by these legal challenges.” Outside counsel also retained third-party technical experts and investigators to assist in the ADI.
As a result of the data breach incident, the AG opened its own investigation into whether Facebook misrepresented the extent to which it protected or misused user data. In accordance with its authority under M.G. L. c. 93A, the AG issued a series of civil investigative demands to Facebook. Facebook complied in part, but refused on privilege grounds to honor six of the AG’s requests. The first five requests sought information related to the identities of certain apps and app developers that Facebook identified and reviewed during its ADI. The sixth request, in contrast, sought Facebook’s internal communications and correspondence regarding certain apps.
The AG filed a petition to compel compliance with its demands in the Superior Court’s Business Litigation Session. The Superior Court sided with the AG, holding that the work product doctrine did not cover Facebook’s ADI and, even if it did, the AG made the required showing of a substantial need for the information that it could not obtain without undue hardship. As to Facebook’s asserted attorney-client privilege, the Superior Court held that the privilege did not cover the information sought by the AG’s first five requests, and ordered the production of responsive documents. Regarding the sixth request, however, the Superior Court held that it did seek the disclosure of potentially privileged material, and accordingly ordered Facebook to provide the AG with a detailed privilege log.
Facebook appealed and the SJC heard the case on direct appellate review.
Decision
The SJC affirmed in part and reversed in part the Superior Court’s decision.
Work Product Doctrine: Addressing the first five requests, the SJC held that the work product doctrine did apply, because Facebook conducted the ADI in anticipation of litigation. The Court, however, carefully distinguished fact work product from opinion work product. It held that as to documents constituting fact work product, the AG demonstrated substantial need and undue hardship requiring production. At the same time, the SJC held that remand was necessary to determine whether any of the responsive documents that Facebook withheld constituted opinion work product. The SJC held that, if any of the withheld documents constituted opinion work product, such documents are only “discoverable, if at all, in rare or extremely unusual circumstances.” Facebook, 487 Mass. at 128 (internal quotations omitted).
Attorney Client Privilege: Addressing the sixth request, the SJC agreed with the Superior Court that to the extent Facebook objected on the basis of attorney-client privilege, Facebook must produce a detailed privilege log so that the AG could assess (and potentially contest) the privilege assertions. The SJC reasoned that the request sought information dating back years before the ADI began, as well as communications that did not involve attorneys, both of which might fall outside the scope of the attorney-client privilege. The SJC held that the attorney-client privilege did not cover the first five requests as they merely sought underlying facts rather than attorney-client communications. In doing so, the SJC emphasized that “the attorney-client privilege only protects communications between attorneys and a client about factual information, not the facts themselves,” noting that “this distinction is important and somewhat collapsed by the advocacy in the instant case.” Facebook, 487 Mass. at 123.
Key Issues
In its decision, the SJC identified and discussed three important issues pertaining to employers contemplating or conducting internal investigations.
First, the SJC considered whether the work product doctrine applies to an internal investigation. In the instant case, the SJC held that the work product doctrine applied to the ADI because: (1) documents were prepared; (2) by or for Facebook for its agents; and (3) in anticipation of litigation. The SJC specifically found that, although Facebook had an ongoing compliance program, the ADI was “meaningfully distinct” from the compliance program, with its own distinct methodology focused on past violations, rather than improving ongoing operations in the normal course of business. In short, the mere fact that the ADI also served Facebook’s business purposes did not mean that the work product doctrine was inapplicable.
Second, the SJC discussed whether the information sought by the AG constituted fact work product or opinion work product. As the SJC stated, “the line between fact work product and opinion work product is not always clear.” In this regard, the SJC noted that although Facebook made multiple public statements about the ADI and the investigatory process (which Facebook could not then claim to constitute opinion work product), any “undisclosed strategic decision-making by counsel, including the assessment of legal risk or liability [] revealed by the factual analysis” might qualify as opinion work product.
Third, the SJC considered whether, in relation to fact work product, the party seeking disclosure established a substantial need for and undue hardship from denied access to the work product sufficient to warrant its discovery. The SJC held that the AG met its burden by demonstrating both. With respect to the AG’s substantial need, the SJC found that the app-related information sought was central to the statutorily authorized c. 93A investigation. Likewise, with respect to the AG’s asserted undue hardship, the SJC distinguished the ADI from a routine internal investigation that “involved simply interviewing key employees and other witnesses or reviewing a manageable number of documents, tasks that can be easily replicated by third parties or government investigators.” Here, the ADI was a years-long investigation involving a vast quantity of information and included analysis of millions of apps by hundreds of outside experts. Therefore, the SJC ruled that the enormous costs and time required to duplicate the ADI was sufficient to demonstrate undue hardship.
Implications
Although this area of law is far from settled, the Facebook decision provides helpful guidance for companies contemplating and conducting internal investigations. Key guideposts include:
- Engage counsel in advance of an internal investigation to discuss the objective and parameters of such investigation.
- Any outside experts involved in the investigation should be retained by outside counsel and should be bound by confidentiality agreements.
- Review what records and files the company develops in the regular course of business and be mindful that these records may be discoverable if not created in anticipation of litigation.
During the internal investigation, consider carefully what information and documents may be characterized as fact (versus opinion) work product and, therefore, may be discoverable. As the SJC cautions, the line between the two is “not always clear” and, consequently, aspects of internal investigations, especially fact work product, may be discoverable.
Bret Cohen chairs the Labor & Employment and Trade Secrets & Employee Mobility Practice Groups at Nelson Mullins Riley & Scarborough LLP. His practice covers a wide range of areas, including the enforcement of non-compete and employment agreements, complex commercial and trade secrets litigation, and advice and counsel on termination and transition of high-level executives.
Jillian Hart is an associate in the Labor & Employment Group at Nelson Mullins Riley & Scarborough LLP. Jillian focuses her practice on employment and trade secrets litigation and also advises clients on a variety of employment matters, including restrictive covenants and wage and hour issues.
Matthew Brown is an associate in the Labor & Employment Group at Nelson Mullins Riley & Scarborough LLP. Matthew focuses his practice on trade secrets and non-compete litigation and advice and counsel on a variety of issues, including worker classification and employment agreements.
