Last July, Capital One announced that an outside individual gained unauthorized access to information belonging to 100 million individuals in the United States and approximately six million in Canada.[1] Within days, lawsuits were filed nationwide asserting an assortment of claims relating to the data breach.
Last week, in a class action filed in Virginia a federal magistrate ordered Capital One to provide its incident report for the data breach to counsel for the plaintiffs. Capital One had contended that the report is protected attorney work product and that it shouldn’t have to. The Virginia court disagreed, for reasons that are instructive.
When an Incident Report Is Not Attorney Work Product
Since 2015, Capital One had retained Mandiant to provide various cybersecurity services. The data breach occurred in March 2019, but it was not confirmed until July 19 of that year. A day later Capital One retained outside counsel which then retained Mandiant to assist with its investigation on July 24. Then, on July 29 the public was notified about the data breach.
The issue the court decided last week was whether the Mandiant incident report was privileged and therefore protected from disclosure by the work product doctrine.[2] This doctrine generally preserves the privacy of attorneys’ case materials, but it has limits. To guide its decision in Capital One the court stated:
In order to be entitled to protection, a document must be prepared “because of” the prospect of litigation and the court must determine “the driving force behind the preparation of each requested document” in resolving a work product immunity question.[3]
Applying this standard, the court believed the incident report would have been prepared anyway even if the data breach had not occurred and determined that it needed to be disclosed. In reaching this conclusion, after “considering the totality of the circumstances,” the court found these facts compelling:
Continue Reading Court Orders Disclosure of Capital One’s Incident Report