Source: https://globalinvestigationsreview.com/benchmarking/the-practitioner%E2%80%99s-guide-to-global-investigations-third-edition/1179093/production-of-information-to-the-authorities
Timestamp: 2019-04-26 04:18:24+00:00

Document:
There are many situations in which a company may face a choice, or a demand, to disclose documents and information to a law enforcement authority or regulator. These range from responding to a raid on corporate and individual premises, to compliance with a subpoena or other compulsory process, to the voluntary provision of information during a self-disclosure. The types of information and the circumstances in which a company is obliged – or even able – to produce relevant documents is circumscribed by various laws. For example, a company must address concerns regarding confidentiality, employee privacy, data protection and legal privilege (and, in certain jurisdictions, bank secrecy restrictions or blocking statutes). This becomes additionally complicated in cross-border cases where multiple legal regimes may apply and may conflict with one another. Add to this the not uncommon scenario of authorities from different countries seeking the same (or slightly different) information and it becomes a legal and practical minefield. This chapter cannot hope to cover the immense number of variables that a company may face in these circumstances, but it does seek to provide practical guidance on some of the most important points.
Most regulatory and enforcement authorities have formal powers to compel individuals and companies to produce documents and provide information.
In the area of financial crime and corruption involving the United Kingdom, the most likely authority to be seeking to investigate and prosecute will be the Serious Fraud Office (SFO). It has powers to seek the production of documents and information at both a pre-investigation stage in relation to bribery and corruption cases under section 2A of the Criminal Justice Act 1987, and, once it opens a formal investigation, under section 2 of the same Act. These powers can be exercised against companies and individuals to produce documents and information, including by way of compelled interview where there is no right to silence (although the individual cannot be later prosecuted regarding matters arising from the interview, unless the information is found to be false). A failure to provide the documents and information within the time specified in the production notice is a criminal offence, unless the recipient can show that it had a reasonable excuse not to comply (such as an injunction preventing production).
165 Regulators’ power to require information: authorised persons etc.
(b) to produce specified documents or documents of a specified description.
(b) at such place as may be specified.
(b) to produce to him specified documents or documents of a specified description.
(b) in relation to the exercise by the PRA of the powers conferred by subsections (1) and (3), information and documents reasonably required by the Bank of England in connection with the exercise by the Bank of its functions in pursuance of its financial stability objective.
(5) The regulator in question may require any information provided under this section to be provided in such form as it may reasonably require.
as it may reasonably require.
‘Authorised person’ is defined in section 31 of FSMA and means, very broadly, a person providing a regulated financial service.
The FCA has set out its policy in relation to its exercise of enforcement powers under the FSMA (and other legislation) in its Enforcement Guide. The Enforcement Guide is useful as it not only sets out the FCA’s approach to its task as the United Kingdom’s financial markets regulator, but also it reflects the general approach of UK regulators to their document production powers.
where the FCA has been asked by an overseas or EEA regulator to obtain documents on their behalf, in which case the FCA will discuss with the overseas regulator the most appropriate approach.
In the second scenario, it is important to consider the effect of regimes and jurisdictional protections colliding. For example, how might the US right to silence mesh with the UK compelled disclosure regime? The Enforcement Guide states that the FCA will make it clear to the company or individual concerned whether it requires him, her or it to produce information or answer questions under FSMA or whether the provision of information is voluntary.
Similar (but unique) powers also lie in the hands of the Competition and Markets Authority, the National Crime Agency, the police, Her Majesty’s Revenue and Customs, and the Health and Safety Executive. Many of these authorities may also apply for and obtain search warrants and use these powers more often than their US counterparts do.
The Commission or any member of the Commission or of its staff who, by order of the Commission, has been authorized to issue subpoenas in the course of a particular investigation may issue a subpoena directing the person named therein to appear before a designated person at a specified time and place to testify or to produce documentary evidence, or both, relating to any matter under investigation.
Additionally, state agencies and each state’s attorney general can compel the production of documents and testimony. As an example, Section 352 of the New York General Business Law permits the Attorney General to commence an investigation of an individual or corporation and to seek documents and testimony in connection with that investigation. The Securities Act, the Securities Exchange Act, the Investment Advisers Act and the Investment Company Act all permit the SEC to issue subpoenas in connection with an ongoing investigation of misconduct. Before a subpoena can be issued, the staff of the SEC must obtain a formal order of investigation.
Criminal offences for refusing to comply with a request, providing false or misleading statements, or concealing documents, generally supplement such powers.
In practice, a company can do little to resist complying with a formal request for disclosure without resorting to court proceedings to challenge the validity or scope of the request. However, it can likely negotiate with the relevant authority regarding the scope of documents responsive to the request and the production date to limit the scope of the request to what is proportionate and reasonable.
Broadly drawn requests are unfortunately not uncommon, as investigators seek to ensure the requests will capture all relevant information. Early engagement with the relevant authority will typically ensure that both parties can agree on scope and a timetable for production: a request looking back over a long period, or even without any time limit, could involve a time- and resource-intensive review and expensive production exercise. This may not be in the interests of the prosecuting agency or the company if a more targeted request could produce the information. Whether an agreement to narrow the scope of the request is possible is likely to depend, in large part, on factors outside the company’s control – such as the nature and scope of the authority’s investigation (which the authority may be unwilling to share and is likely to base on information and evidence outside the company’s knowledge). However, the company and its legal advisers should nonetheless seek a reasonable, proportionate and practically achievable production: for example, by seeking to agree to produce documents relating to X project, between Y–Z dates and if necessary to produce the documents in tranches.
It becomes increasingly difficult to manage the response to multiple authorities, particularly if they are in different countries and have different areas of focus. Similarly, a company must consider whether the production notice extends to materials held overseas.
Upon receipt of a document request, a company should – in most cases –immediately issue a document retention (or hold) notice (DRN) (if one is not already in place). A company should take care not inadvertently to tip off data custodians, who may also be suspects. In some cases, issuing a DRN is not appropriate; for example, where the company is investigating matters outside the public domain and needs to collect documents covertly at the outset. The issuing of a DRN will assist the company to demonstrate that it has taken steps to preserve all potentially relevant documents in existence at the date of the request. The DRN should track the terms of the production notice, and be sent to all personnel who may have responsive documents, including the IT department and records department. The term ‘document’ should be widely drawn to include any paper or electronic records present on any media belonging to the company or its employees, including corporate information located off-site. The company may also need to manage complicated issues around data privacy and personal media.
The DRN should confirm that employees must not delete, alter, conceal or otherwise destroy company documents. Simultaneously, the company should take steps to secure and preserve all relevant information held on the company’s servers and backup tapes, including through external providers. It should also immediately suspend routine document and data destruction processes.
Most authorities will have their own technical standards, which the collection and production of electronically stored information must meet. It is therefore likely that a company seeking to respond to a subpoena or production notice will want to consider instructing a forensic IT specialist company to assist with the collection and production efforts. This will have the added benefit of ensuring that a company can demonstrate the independence of this analysis, that it is taking clear co-operative steps, and protects employees, as far as possible, from having to give evidence in any subsequent proceedings.
A company may wish to consider voluntarily providing documents to an authority as part of a self-report or to demonstrate its co-operation with an investigation. Government investigators and investigating authorities regularly hold out the possibility of co-operation credit to companies to encourage them to provide information about their own misconduct.
From February 2014, deferred prosecution agreements (DPAs) have been available in the United Kingdom to the SFO and Crown Prosecution Service (CPS) for disposing of corporate criminal conduct relating broadly to economic crime (including, in particular, fraud, corruption and money laundering). The SFO and the English courts have emphasised that one of the most important factors for a DPA is early reporting and co-operation by the company. Co-operation should be ‘genuinely proactive’. This includes the voluntary production of relevant documents, the importance of which has been demonstrated in one of the early DPA cases of SFO v. Rolls-Royce PLC, discussed later in this chapter.
Timely preservation, collection, and disclosure of relevant documents and information relating to their provenance, including (a) disclosure of overseas documents, the locations in which such documents were found, and who found the documents, (b) facilitation of third-party production of documents, and (c) where requested and appropriate, provision of translations of relevant documents in foreign languages … .
Importantly, the Corporate Enforcement Policy does provide benefits to a company that does not voluntarily self-disclose misconduct but does fully co-operate with an investigation and implement timely and appropriate remediation.
Timing is important, both for a potential DPA and in relation to anti-cartel regimes, which often provide an amnesty only to the first discloser.
As has been noted above, the FCA’s standard practice is to rely on its statutory powers to require the production of documents. While there is merit in adopting this policy, and it does avoid the risks to companies of voluntarily disclosing documents to the FCA set out below, nothing prevents the FCA from seeking voluntary production. Principle 11 of the FCA’s Principles for Businesses states that: ‘A firm must deal with its regulators in an open and co-operative way, and must disclose to the appropriate regulator appropriately anything relating to the firm of which that regulator would reasonably expect notice.’ A materially identical provision is included in the PRA’s Rulebook as Fundamental Rule 7. While this chapter focuses on the approach of the FCA, it is worth remembering that the PRA has similar enforcement powers (and is using them with increasing frequency). Both regulators interpret these obligations to proactively bring matters to their attention widely, and are prepared to take enforcement action against firms and individuals for failures to discharge these obligations (even in the absence of other underlying failings). Prudential Group (fined £30 million for failing to inform the FSA of its proposed acquisition of AIA until after it had been leaked to the media), Goldman Sachs (fined £17.5 million for not disclosing an SEC investigation into its staff and members of The Goldman Sachs Group), and the Co-operative Bank (issued a final notice for failing to notify the PRA without delay of two intended personnel changes in senior positions) are recent examples. This places regulated firms in a different position from other corporates: it reduces the scope for the decision whether to self-report or not.
The FCA will not bring disciplinary proceedings against a person for failing to be open and co-operative with the FCA simply because, during an investigation, they choose not to attend or answer questions at a purely voluntary interview. However, there may be circumstances in which an adverse inference may be drawn from the reluctance of a person (whether or not they are a firm or individual) to participate in a voluntary interview. If a person provides the FCA with misleading or untrue information, the FCA may consider taking action against them.
The Enforcement Guide further provides that if a person does not comply with a requirement imposed by the exercise of statutory powers, he or she may be held to be in contempt of court. The FCA may also choose to bring proceedings for breach of Principle 11. Therefore, while there is no guidance indicating that a failure to produce documents voluntarily (as opposed to attending a voluntary interview) would result in an adverse inference being drawn, a decision by a company not to produce documents voluntarily in any particular case should not be made without careful forethought and proper advice on the potential consequences.
As this suggests, the Enforcement Guide recognises the importance of an open and co-operative relationship with the firms it regulates to the effective regulation of the UK financial system. When deciding whether to exercise its enforcement powers, the FCA considers, among a number of factors, the level of co-operation demonstrated by a firm. When weighing the level of co-operation, the FCA considers whether the firm has been open and communicative with it.
Voluntarily disclosing documents carries a risk that the authority may not give any meaningful credit and may nonetheless decide to prosecute or expand an investigation already under way. Therefore, the company should weigh the likelihood of the authority being able to serve a formal request for disclosure in the relevant jurisdiction.
In some instances, a formal notice for disclosure will be preferred: for example, where a company has obligations of confidentiality, preventing voluntary disclosure. The most common examples are lawyers and financial institutions, who could both face an action for breach of confidence for supplying documents or information without a formal regulatory request. In some self-reporting circumstances, it may be appropriate for a company to seek such a notice from the relevant authority to ensure that it does not open itself up to civil action. The notice should be narrowly drawn, in consultation with the regulator, and should not affect the company’s co-operation credit. Likewise, in some situations, the company may prefer to ask to be provided with a formal document request to demonstrate that they have been compelled to produce the documents to the authorities and have not done so voluntarily.
ensuring a system for Bates numbering for each authority.
In the United Kingdom, sections 7 to 9 of the Crime (International Co-operation) Act 2003 (CICA) govern requests to obtain evidence from abroad in relation to a prosecution or investigation taking place in the United Kingdom, shaping the mutual legal assistance (MLA) powers of UK authorities. Under CICA, an MLA request can only be made if it appears to the investigating authority that an offence has been committed or there are reasonable grounds for suspecting that an offence has been committed, and either proceedings in respect of that offence have been instituted or the offence is being investigated. The request must relate to the obtaining of evidence ‘for use in the proceedings or investigation’. But, it could allow an investigating agency to have foreign law enforcement officers launch raids, arrest suspects or conduct interviews on its behalf. If the implementation of an MLA request in the requested state requires a court order, then the court in the requested state is likely to apply the relevant principles in its own jurisdiction to satisfy itself that the requested order is justified.
prioritises the necessity and proportionality of the measure as part of the rights of the defence.
EIOs were created by EU Directive 2014/41/EU, which came into force in the United Kingdom on 31 July 2017 (transposed through the Criminal Justice (European Investigation Order) Regulations 2017). The United Kingdom has opted into the EIO regime even though it has chosen to exit the European Union. In April 2018, the European Commission issued a proposal for a Regulation on European Production and Preservation Orders for electronic evidence in criminal matters. The proposal aims to reform cross-border access to electronic evidence and make mutual legal assistance across Member States more efficient. It would allow Member States to request electronic evidence directly from service providers established or represented in a Member State that provide services in the European Union (regardless of the location of the data requested). The regulation would require the service provider to respond within 10 days, or, in cases of emergency, six hours.
There is currently no timeline for the intended enactment of the regulation, but, most likely, any enactment will follow Brexit; the United Kingdom is therefore unlikely to be part of the new regime unless it opts in.
(d) whether it is otherwise appropriate in the public interest to give the assistance sought.
In an early decision on this section, Financial Services Authority v. Amro International, the Court of Appeal held that there was nothing in section 169 that required the FCA’s predecessor body to satisfy itself of the correctness of what it was being asked to investigate or gather by way of information. At the SEC’s behest, the FCA could seek any document that it reasonably considered relevant to the investigation the SEC was conducting. The Court of Appeal made clear that the only requirements the FCA must meet were contained in the statute. The Court of Appeal also noted that in exercising these powers, the stricter rules attaching to the drafting of a subpoena did not apply and the description of the documents sought would be acceptable provided the recipient could identify the documents he or she was required to produce.
In addition to the FCA’s statutory powers, a number of memoranda of understanding are in place between UK regulators and their overseas counterparts (most notably the SEC and other US regulators) concerning co-operation and information sharing. Recent years have seen significant co-operation between the SEC and the FCA and its cognate agencies.
Similarly, the United States has entered into mutual legal assistance treaties (MLATs) with various countries, which can be used for the sharing of information and taking of evidence abroad. Some US authorities also have memoranda of understanding in place with sister agencies outside the United States, which can allow for inter-agency sharing of documents.
Responding to an investigation (and conducting an internal investigation) will require data about individuals to be processed. Such an exercise will engage a number of data protection considerations. A company cannot assume that complying with the data protection requirements in the investigated jurisdiction will mean compliance with overseas data protection laws. And local law may restrict a company’s ability to transfer individual data overseas. The European Union’s General Data Protection Regulation (GDPR) came into force on 25 May 2018 and applies within the EU and to those data controllers and processors outside the EU who offer goods and services to EU consumers. Chapter 5 of the GDPR deals with transfers of data to third countries (and international organisations) and re-enacts existing restrictions on transferring data to countries that do not have adequate privacy protections in circumstances where other ‘appropriate safeguards’ are not in place. The GDPR introduces a limited derogation to its principles based on ‘compelling legitimate interests’, which could cover non-repetitive transfers to foreign regulators, but would require prior notification to the relevant data protection authority.
[I]t is prohibited for any person to request, to investigate or to communicate in writing, orally or by any other means, documents or information relating to economic, commercial, industrial, financial or technical matters leading to the establishment of proof with a view to foreign administrative or judicial proceedings or as a part of such proceedings.
There has historically been very little enforcement of the French Blocking Statute – with some companies choosing to ignore it completely. However, as a consequence of the Sapin II law, which was implemented in June 2017, the Parquet National Financier has begun to lead cases involving the enforcement of the Blocking Statute, signalling that the French authorities are considering the issues raised by the Blocking Statute in more depth. The French authorities have traditionally taken any derogation from the letter of the law seriously and insist on the use of mutual legal assistance requests and inter-agency communications. This can leave companies in the unenviable position of being caught between authorities (if the US authorities, for example, expect production direct from the corporate). In such circumstances, agency-to-agency communications should be encouraged. Similarly, Article 271 of the Swiss Criminal Code prohibits a person performing an ‘official act’ on behalf of a foreign authority on Swiss soil. This can block the collection of evidence located in Switzerland intended for use in proceedings outside the country.
A decision to refuse to disclose documents or information due to a blocking statute may not be respected by the requesting authority and could affect any co-operation credit available – leaving the company between a rock and a hard place. This demands early and detailed dialogue with the relevant authority alongside expert local counsel advice who can educate the regulators about the relevant laws and any potential workarounds for production of information.
Bank secrecy laws prohibit banking officials from releasing confidential information about a customer to third parties outside of financial institutions, unless compelled by law. Sometimes, such a disclosure is criminalised. A bank under investigation may seek to rely on this secrecy. It should also be cautious not to infringe this secrecy inadvertently in providing information to a regulator. Note, though, that a historic deference to the banking secrecy rules of foreign jurisdictions, premised on comity or respect for the acts of foreign governments, may slowly be eroding. Even Switzerland, in recent times, has stripped away a number of its many layers of secrecy through international agreements, and, in our experience, has become, in practice, more willing to co-operate with requests for information.
Sending data outside a jurisdiction may be contrary to state secrecy laws. Some jurisdictions, such as China, have wide definitions of what amounts to a state secret. The Law of the People’s Republic of China on Guarding State Secrets, at Article 8, defines state secrets to include ‘secrets in national economic and social development’ and ‘secrets concerning science and technology’. Similarly, Kazakhstan treats some geological data as a state secret. The consequences of violation can be serious. Article 111 of the Chinese Criminal Law makes violating state secrets a capital crime. In countries such as China, where many companies are state-owned, this is not straightforward. Again, locating expert local counsel is a must.
State secrecy laws may also restrict certain categories of documents to authorised eyes only. This is particularly pertinent for defence companies. Withholding production of such documents will require careful negotiation. Remember that the investigating agency is likely to have authorised persons of its own, who can review the documents. Finding a practical way for these to be produced by external lawyers (where prior authorisation is unlikely) will likely be more difficult and undoubtedly will increase the time it will take to respond to a request for documents and may require the review of documents ‘in country’ instead of producing the documents to the US authorities. Another potential workaround is production of information through MLATs and MOUs that allow a company to first produce documents to a local authority and thereby comply with the relevant regulations.
11.2.4.7 Whose rules of privilege apply?
It may not be clear whose rules of privilege apply when a company discloses in one jurisdiction documents created in another. English courts will generally apply English law to the question: theoretically, an unprivileged document in its country of origin could be privileged in England and vice versa. In the United States, there is no general rule, although government agencies will generally apply privilege principles broadly, although subject to certain procedural requirements, such as the production of privilege logs.
Companies should also be aware that some countries do not have developed principles of legal privilege and special care is required in creating or sending otherwise-privileged documents to such jurisdictions. Likewise, in some juris­dictions privilege does not extend to communications with in-house counsel and the role of internal counsel may be held by someone who is not an attorney, and therefore privilege may not be recognised in connection with their communications.
Further complications come when dealing with international regulatory bodies. In Akzo Nobel, for example, the European Court of Justice held that the law of the European Union superseded that of the relevant national jurisdictions; therefore, in competition cases internal counsel’s advice will not be privileged – nor will that of external legal advisers who are not EU-qualified lawyers.
Minimise the risk that LPP material is seen or seized by an SFO investigator or a lawyer involved in the investigation.
Ensure that any LPP material which is seized is properly isolated and promptly returned to the owner without having been seen by an SFO investigator or a lawyer involved in the investigation.
Ensure that any dispute relating to LPP is resolved in advance of the material being seen by an SFO investigator or a lawyer involved in the investigation.
Ensure that where an SFO investigator or a lawyer involved in the investigation inadvertently sees LPP material, measures are in place to ensure that the investigation and any subsequent prosecution is not adversely affected as a result. Care must always be taken that LPP material is not viewed by the SFO staff involved in the investigation.
The Operational Handbook then sets out a procedure for dealing specifically with electronic material that may be privileged. Under this procedure, the SFO will first notify the company’s lawyers if it believes that IT assets it has seized might contain privileged material (in practice, it is prudent for the company’s lawyers to advise the SFO of the potential existence of privileged material at an early stage). A list of search terms should be agreed (including names of lawyers, relevant firms, etc.) to enable the identification and isolation of the material for review by independent counsel. Independent counsel will review the material using search software and return only non-privileged material to the SFO investigative team to examine. It is normally possible to have productive discussions with investigators to determine the relevant search terms that might identify privileged material. It is then possible to make representations on the client’s behalf to independent counsel about the extent of privilege. This procedure updates and works alongside the well-established ‘blue-bagging’ approach used for hard-copy materials that may be privileged, by which authorities will send seized documents that may be potentially privileged, sealed in an opaque bag, to the custody of an independent legal adviser (usually a barrister) for review.
The DOJ has utilised three different procedures for reviewing potentially privileged information, each of which requires a ‘neutral’ third party to first review potentially privileged data. In certain instances the court may review the data on its own. A court may also appoint a ‘special master’ to handle the review of privileged information. In other instances, a team of individuals referred to as a ‘taint team’ may be used to review the files. When a taint team is used, an ethical wall will be placed between the individuals who review the documents and those who are actually participating in the investigation. Importantly, courts have had differing reactions to the use of taint teams and may not always conclude that the procedures implemented to screen materials were sufficient.
In most instances, a company will have to make expansive disclosures regarding its internal investigations to get full co-operation credit. The DOJ has issued guidance in the Justice Manual that explicitly states that companies will have to self-report on both the results of internal investigations and on individual misconduct to receive any co-operation credit. Whether such thorough disclosures are in the best interest of the company is something that will need to be determined in a timely manner.
A company’s decision as to whether to self-report is often complicated. There may be opportunities for a company to internally address misconduct without it coming to light. However, it can be very difficult for a company to keep its misdeeds from being disclosed to the relevant authorities. Whistleblower rewards provide incentives for employees to report misconduct. Federal statute provides protections for whistleblowers, and in 2017 the SEC imposed financial penalties on financial institutions that attempt to prohibit employees from seeking those bounties. Disgruntled employees can report corporate misconduct as retaliation, to attempt to prevent prosecution of themselves or simply because they do not feel that the corporate is handling the issue appropriately via its internal process. In the United Kingdom, broadly speaking, those working in the field of financial services are subject to suspicious activity reporting obligations. This means that banks, accountants and transactional lawyers must make reports to the authorities of suspicions of money laundering (including acquiring assets which may be tainted by fraud or corruption). A failure to make a report is a criminal offence – as is tipping off the subject of the report (which in some instances may be the individual’s own client). Investigative journalism and NGOs also continue to be important sources of information for regulators – as the recent ‘Panama Papers’ scandal has shown.
Even in the absence of a formal program, prosecutors may consider a corporation’s timely and voluntary disclosure, both as an independent factor and in evaluating the company’s overall cooperation and the adequacy of the corporation’s compliance program and its management’s commitment to the compliance program. However, prosecution may be appropriate notwithstanding a corporation’s voluntary disclosure. Such a determination should be based on a consideration of all the factors set forth in these Principles.
As we have already noted, under the FCPA Corporate Enforcement Policy (which has been incorporated into the Justice Manual), full co-operation requires, among other things, prompt disclosure of ‘all facts related to involvement in the criminal activity by the company’s officers, employees, or agents; and all facts known or that become known to the company regarding potential criminal conduct by all third-party companies (including their officers, employees, or agents’. Moreover, the company will have to disclose ‘on a timely basis of all facts relevant to the wrongdoing at issue, including: all relevant facts gathered during a company’s independent investigation; attribution of facts to specific sources where such attribution does not violate the attorney–client privilege, rather than a general narrative of the facts; timely updates on a company’s internal investigation, including but not limited to rolling disclosures of information’.
The Deferred Prosecution Agreements Code of Practice (DPA Code) issued by the SFO and CPS indicates that, to be eligible for a DPA, a company will likely have to report voluntarily any misconduct within a reasonable time of becoming aware of it – and prior to it becoming known to the authorities. In fact, in both of the previous DPA cases, the companies self-reported their misconduct to the SFO in circumstances where the SFO had no prior knowledge of the misconduct and, in all likelihood, would not have learnt about the misconduct if the company had not self-reported.
But, in the Rolls-Royce case, which was concluded by a DPA in January 2017, the company did not self-report to the SFO the conduct that led to the SFO’s investigation. Instead, the SFO became aware of the need for an investigation through internet postings by a whistleblower. The fact that Rolls-Royce did not self-report weighed against the SFO offering a DPA; yet, Rolls-Royce chose to co-operate fully with the investigation after the SFO approached the company, and undertook its own internal investigation (in close consultation with the SFO). In total, Rolls-Royce collected over 30 million documents and subjected them to electronic document review as part of this investigation. One of the main features of Rolls-Royce’s co-operation was that it provided all materials requested by the SFO voluntarily, without the SFO having to compel it to provide information. Rolls-Royce also chose not to perform any legal professional privilege review over the documents (instead allowing independent counsel to resolve issues of privilege) and worked with the SFO as the SFO used sophisticated artificial intelligence searches to interrogate the data. This process led to the SFO uncovering information that may not have otherwise come to its attention. Ultimately, SFO counsel described the extent of Rolls-Royce’s co-operation with the investigation as ‘extraordinary’.
While the decision to provide documents voluntarily to the SFO was one of a number of measures taken by Rolls-Royce to demonstrate its co-operation with the investigation, this decision was of fundamental importance to the court when deciding to approve the DPA. Rolls-Royce’s voluntary disclosure of investigation documents therefore mitigated its failure to voluntarily disclose misconduct.
Careful consideration should be given to the manner of disclosure of information. In the United States, the consideration for credit is that the relevant facts are disclosed. The format of the disclosure is irrelevant. The Justice Manual makes clear that a company does not have to waive privilege to receive co-operation credit. If a company chooses not to waive relevant privileges, it is unlikely to be able to share the investigative reports prepared by counsel conducting the investigation. Instead, it will have to carefully craft presentations that disclose only non-privileged facts. Preparation of such reports can be time-consuming and costly. Further, in preparing any written presentation materials the company will have to ensure that neither the mental impressions nor advice of counsel are included. Because there can be no claim that the materials are privileged, a company should also expect that they will have to produce presentation materials in any related civil litigation.
In the United Kingdom, there is currently much debate over the production of the first accounts of witnesses, which may have been taken by investigating attorneys. The SFO’s preference is that these are taken so that legal privilege does not apply. It also indicates that it does not consider all privilege claims over interview materials to be made out under English law and until the Court of Appeal’s decision in The Director of the Serious Fraud Office v. Eurasian Natural Resources Corporation (ENRC), was actively challenging such assertions. Where a valid claim for privilege exists, co-operation credit will be given for the disclosure of interview memoranda. A failure to disclose will be considered co-operation neutral. As Alun Milford, then SFO General Counsel, has previously said, ‘[i]f a company’s assertion of privilege is well-made out, then we will not hold that against the company: to do otherwise would be inconsistent with the substantive protection privilege offers.’ In two of the UK cases in which the court has approved DPAs, the company made oral disclosure only of the content of witness interviews. However, Rolls-Royce chose to provide the interview memoranda to the SFO – even though it considered the memoranda to be privileged – on the basis of a limited waiver of privilege. This was another way Rolls-Royce used the voluntary disclosure of documents to counterbalance its failure to voluntarily disclose the misconduct. Other materials voluntarily provided to the SFO by Rolls-Royce included regular reports on the findings of the internal investigations; unfiltered access to the ‘digital repositories or email containers’ for over 100 past and present employees; general access to hard-copy documents at Rolls-Royce; and key documents identified by the internal investigations. Finally, Rolls-Royce held off interviewing potential witnesses until the SFO had the chance to do so. How a company makes its employees available to investigating authorities is important, and this chapter will now turn to this issue.
In connection with its initial assessments of whether to co-operate with authorities, companies will have to consider the implications of disclosing information about key employees. As noted above, US and UK authorities have indicated that co-operation will require disclosure of facts relevant to the misconduct of individual employees.
These principles have been incorporated into the FCPA Corporate Enforcement Policy. Additionally, the ‘unequivocal co-operation’ necessary to be eligible for a DPA in the United Kingdom includes identifying relevant witnesses, disclosing their accounts of the alleged misconduct and any documents shown to them and, where practicable, making those witnesses available for interviews by investigators – together with ongoing co-operation with the authorities.
When seeking a DPA, a corporate should consider liaising closely with the SFO, which may wish to undertake witness, or interviews, under caution, with individuals prior to corporate counsel doing so. Once the individuals have been identified to the government or prosecuting authorities it may be difficult, if not impossible, for those individuals to continue working for the company. A company may feel pressure to terminate the employee or place that individual on leave, which could have a significant impact on the operations of a business unit. Even if the company does not terminate an employee under investigation, targets of a government investigation are likely to engage their own counsel who may advise the employee to stop co-operating with its employer – leading to a ‘walk or talk’ decision. Depending on the nature of any employment agreement, a company may have to advance the individual the fees and costs associated with individual representation. Also, since 2004, the United Kingdom has imposed an extensive Code of Practice for Disciplinary and Grievance Procedures on employers, which sets out standards of procedural fairness that a UK employer should comply with if it takes action that will detrimentally affect an employee’s employment.
In the United States, certain portions of internal investigations are protected by the attorney–client privilege and the work-product doctrine, and courts routinely uphold those privileges. This can be true even where the purpose of an investigation is to ensure regulatory compliance, or where non-lawyers are involved in key parts of the investigation.
Generally, the attorney–client privilege entitles a party to withhold from production (1) communications, (2) with an attorney, his or her subordinate or agent, (3) made in confidence, (4) for the primary purpose of securing an opinion of law, legal services or assistance in a legal proceeding. It applies to corporations as well as individuals, and therefore protects communications between corporate employees and a corporation’s in-house and external legal counsel on matters within the scope of the employees’ corporate responsibilities. Communications between non-legal corporate employees can also be privileged where an attorney neither authors nor receives the communication, if the communication contains or refers to previously transmitted legal advice or identifies specific legal advice that the non-attorneys will seek from attorneys in the near future. Additionally, the work-product doctrine protects documents and tangible things, otherwise discoverable, prepared in anticipation of litigation and in connection with a threatened or pending government investigation. The doctrine can apply to documents prepared by both attorneys and non-attorneys. Attorney notes, research, and compilations of background materials, memoranda, investigative reports, witness statements; and materials prepared by non-legal personnel such as investigators are examples of the types of documents that may be protected. Work-product containing an attorney’s mental impressions is referred to as ‘opinion’ work-product and is afforded greater protection than other ‘ordinary’ work-product.
[W]e are not sure that every SFO manifestation of concern would properly be regarded as adversarial litigation, but when the SFO specifically makes clear to the company the prospect of its criminal prosecution … and legal advisers are engaged to deal with that situation, as in the present case, there is a clear ground for contending that criminal prosecution is in reasonable contemplation.
But, the Court went on to say that no particular action in the course of engagement with a regulator will allow a company to say that at a particular date it contemplated a criminal prosecution and privilege crystallised. Every case will turn on its own facts, and the evidence will be assessed in the round.
Although a reputable company will wish to ensure high ethical standards in the conduct of its business for its own sake, it is undeniable that the ‘stick’ used to enforce appropriate standards is the criminal law and, in some measure, the civil law also. Thus, where there is a clear threat of a criminal investigation, even at one remove from the specific risks posed by the SFO should it start an investigation, the reason for the investigation of whistle-blower allegations must be brought into the zone where the dominant purpose may be to prevent or deal with litigation.
So, litigation privilege may well cover a significant proportion of documents created in the course of an internal investigation into possible criminal activity after the regulator has made clear there is a prospect of prosecution. Again, though, why the corporate created particular documents is important. If a corporate creates documents specifically to disclose to the regulator, then it seems unlikely that a claim to litigation privilege against that same regulator will succeed: at least in relation to the final versions of these documents.
It is, however, obviously in the public interest that companies should be prepared to investigate allegations from whistle blowers or investigative journalists, prior to going to a prosecutor such as the SFO, without losing the benefit of legal professional privilege for the work product and consequences of their investigation. . . . The remedy for the SFO is not to allow prevarication and delay . . . to prevent a timeous investigation, when it becomes clear that the company is not wholeheartedly reporting its own conduct and making appropriate waivers of privilege.
It went on to make clear that determining the extent of co-operation by a company (in an analysis of whether a DPA was in the public interest) included determining ‘whether the company was willing to waive any privilege attaching to documents produced during internal investigations, so that it could share those documents with the SFO’. But, as noted above, past practice in both the United Kingdom and the United States suggests that a corporate does not need to waive privilege over all its investigation documents to receive co-operation credit.
On 2 October 2018, the SFO announced that it would not appeal the ENRC decision further to the Supreme Court.
In presenting the underlying facts of an internal investigation, a company must be mindful of the inherent risk that such a presentation will be deemed a privilege waiver in any subsequent proceedings. If a disclosure of privileged information to a federal office or agency is deemed intentional, the privilege will be waived in any federal or state proceeding. However, if a disclosure of privileged information is unintentional, it will not create a broad waiver so long as the holder of the privilege took steps to prevent the disclosure and then promptly took reasonable steps to seek return of any inadvertently disclosed information. Accordingly, if a company decides that it does not intend to waive privilege, it should devise reasonable steps that highlight the company’s decision not to waive privilege, including providing written notice of the intention not to produce privileged materials in any letter or other correspondence that accompanies a document production. Courts in England and Wales have held that a company can share the contents of a privileged communication with a regulator or other third party, keeping the privilege intact, so long as this desire is made clear, the disclosure is confidential, and the communication is not proliferated widely.
Companies producing information to the government should take steps to protect the confidentiality of that information. Although information produced in response to a grand jury subpoena must be kept confidential, in the absence of a formal request, documents and testimony provided to the DOJ, SEC or other government authority can be shared with others. In many instances, documents under the control of a government agency can be subject to requests made pursuant to the Freedom of Information Act (FOIA). Further, documents typically shielded from disclosure by the FOIA and other regulations are not exempt from production to the United States Congress, which can, in turn, make the information public.
The procedures necessary to shield confidential information from disclosure can be quite complex. Each regulatory body has its own procedures for seeking confidential treatment of information. The SEC, for example, requires that each page of a document containing confidential information be stamped with a specific legend and that a request for confidential treatment go to the individual receiving the documents and the Office of Freedom of Information and Privacy Act Operations. Many states have their own versions of the FOIA governing the treatment of information provided to, among others, state attorneys general. Further, while some congressional committees may implement their own procedures for seeking confidential treatment of information, an entity producing documents will have to consider what regulations apply to the information sought and whether the specific regulations prohibit disclosure in response to the request.
In the United Kingdom, the High Court confronted these issues in Standard Life Assurance v. Topland Col. The SFO had disclosed information it had obtained through its section 2 powers to a Standard Life employee that it wished to interview. The SFO later discontinued the related investigation. Standard Life then used some of this information as part of civil proceedings against Topland. The court noted that the SFO was not entitled to disclose any material obtained by it during an investigation except for the purpose of its investigation (which was the original purpose of the disclosure in this case). A person who wished to prevent disclosure of genuinely confidential information, either by the SFO or by a person it had disclosed documents to, would need to rely on judicial review proceedings or seek an injunction to prevent a breach of confidence. This suggests that, to avoid relying on these indirect remedies, a company should agree with the SFO before disclosure how the SFO might control the further dissemination of confidential or sensitive documents. Safeguards may include the SFO returning the documents following a short time or notifying a disclosing party before the SFO intended to disseminate documents further. On the other hand, a company may also wish to construct potential safeguards around material produced to it during DPA negotiations and that may otherwise be discoverable in subsequent civil proceedings against it.
Companies have an incentive to co-operate with a government investigation, especially if co-operation credit does not necessarily require self-reporting of the misconduct. But self-reporting will assist companies alongside the voluntary provision of relevant materials. The additional advantages of co-operation – control of the investigation process, orderly production of materials and managing press intrusion – are likely to be great when weighed against the disruption and publicity of formal actions including raids, arrests and prosecutions. In cross-border investigations, companies will need to devise due process safeguards to protect the rights of individuals and respect local law requirements. Ensuring local law specialists are instructed to work as part of a multidisciplinary team will be key.
1 Hector Gonzalez, Rebecca Kahan Waldman and Caroline Black are partners, and William Fotherby is a senior associate, at Dechert LLP.
2 Financial Conduct Authority, Enforcement Guide (January 2016).
3 Whether the FCA compels testimony from an individual can have an impact on whether that information can be used in connection with a criminal proceeding in the United States. The Second Circuit Court of Appeals has held that testimony compelled by the FCA cannot be used against a defendant in a criminal prosecution. See United States v. Allen, 864 F.3d 63 (2d Cir. 2017).
4 Other federal agencies such as the Consumer Financial Protection Bureau and the Federal Trade Commission are authorised to issue subpoenas. Other agencies are required to seek the assistance of the United States Attorney’s Office in seeking documents and testimony. For a discussion of the use of administrative subpoenas, see https://www.justice.gov/archive/olp/rpt_to_congress.htm#f23.
5 For information regarding criminal matters, see Section 9-13 of the Justice Manual. The Civil Division is authorised to issue subpoenas by a number of statutes.
6 17 C.F.R. § 11.4(a).
7 Section 19(c) of the Securities Act of 1933, 15 U.S.C. § 77s(c); Section 21(b) of the Securities Exchange Act of 1934, 15 U.S.C. § 78u(b); Section 209(b) of the Investment Advisers Act of 1940, 15 U.S.C. § 80b–9(b); and Section 42(b) of the Investment Company Act of 1940, 15 U.S.C. § 80a–41(b).
8 For information regarding procedures for obtaining a formal order of investigation, see sections 2.2.3-2.3.4 of the Enforcement Manual of the Securities and Exchange Commission Division of Enforcement, available at https://www.sec.gov/divisions/enforce/enforcementmanual.pdf (4 June 2015).
10 DPAs were introduced by s.45 and Sch. 17 of the Crime and Courts Act 2013.
11 Crown Prosecution Service and Serious Fraud Office, Deferred Prosecution Agreements Code of Practice – Crime and Courts Act 2013, 11 February 2014, at para. 2.8.2(i).
12 Serious Fraud Office v. Rolls-Royce PLC and Rolls-Royce Energy Systems Inc (U20170036). Rolls-Royce first came to the attention of the SFO in early 2012, when a whistleblower raised concerns about Rolls-Royce’s business in China and Indonesia. After a lengthy investigation, Rolls-Royce accepted responsibility for criminal offending over 24 years, across seven different countries. Ultimately, Rolls-Royce was granted a DPA, and paid approximately £800 million in financial penalties to authorities in the UK, US and Brazil.
13 See e.g. memorandum dated 5 July 2007 from Paul J. McNulty re Principles of Federal Prosecution of Business Organizations available at https://www.justice.gov/sites/default/files/dag/legacy/2007/07/05/mcnulty_memo.pdf.
16 See the Justice Manual, § 9-47.120 – FCPA Corporate Enforcement Policy, available at https://www.justice.gov/jm/jm-9-47000-foreign-corrupt-practices-act-1977#9-47.120.
34th-international-conference-foreign; United States Attorneys’ Manual, § 9-47.120 – FCPA Corporate Enforcement Policy, available at https://www.justice.gov/criminal-fraud/file/838416/download.
18 See e.g. European Commission Notice on Immunity from Fines and Reduction of Fines in Cartel Cases, Official Journal C 298, 8 December 2006, p. 17.
19 See Enforcement Guide, at para. 4.7.3.
20 Ibid. at para. 4.7.4.
21 In 2015, Deutsche Bank AG entered into a DPA with the DOJ and settlements with the US Commodity Futures Trading Commission, the Department of Financial Services and the FCA, in connection with its role in manipulating LIBOR rates. DB Group, a subsidiary of Deutsche Bank, also pleaded guilty to wire fraud for its role. Together, Deutsche Bank and its subsidiary agreed to pay over US$2 billion in penalties to US authorities and US$344 million to the FCA – then the second-largest fine in the FCA’s history.
22 Bates numbering is a method of indexing legal documents for easy identification and retrieval.
23 Production notices seeking documents held outside the jurisdiction of the investigating authority are complicated. For example, the authors take the view that a request made under s.165 of FSMA captures documents in a company’s custody or control outside the United Kingdom. In respect of requests made under s.2 of the Criminal Justice Act, the High Court’s decision in R (on the Application of KBR Inc) v. The Director of the Serious Fraud Office  EWHC 2368 (Admin) held that, to issue a notice to a non-UK company in respect of documents held outside the United Kingdom, there must be a ‘sufficient connection’ between the overseas company and the United Kingdom. Overseas companies should assess the factual connection to the United Kingdom (in terms of its connection to the subject matter of the SFO’s investigation), rather than how it is connected to the United Kingdom from a business perspective.
24 For the United Kingdom see Lonrho v. Shell Petroleum  1 WLR 627.
25 See United States Attorneys’ Manual, § 9-47.120 – FCPA Corporate Enforcement Policy, available at https://www.justice.gov/criminal-fraud/file/838416/download.
26 Crime (International Co-operation) Act 2003, s.7(5).
30 Financial Services Authority v. Amro International  EWCA Civ 123.
32 The United States does not have a comprehensive, federal data protection law. There are, however, numerous state and federal laws that govern the treatment of personal data. At the federal level, there are protections for, among other things, data collected from children, from financial institutions and that includes medical information. See, e.g., Federal Trade Commission Act, 15 U.S.C. §§ 41-58; Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506; Financial Services Modernization Act (Gramm-Leach-Bliley Act), 15 U.S.C. §§ 6801-6827; Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. § 1301 et. seq (and the rules and regulations promulgated thereunder); Fair Credit Reporting Act, 15 U.S.C. § 1681.
33 Despite its very protective wording, the French Blocking Statute has received a very limited application – only one criminal conviction (under art. 1, bis) has ever been recorded (Cass. Crim, 12 Dec. 2007, n°07-83.228).
34 For an English case dealing with the French Blocking Statute, see Secretary of State for Health v. Servier Laboratories; National Grid Electricity Transmission v. ABB  WLR 4383.
35 See most famously Article 47 of the Swiss Federal Act on Banks and Savings Banks (1934).
36 See e.g. Switzerland’s entrance, in October 2013, to the Multilateral Convention on Mutual Administrative Assistance on Tax Matters, and agreement to increase transparency and exchange financial information with approximately 60 other countries.
37 Akzo Nobel Chemicals v. European Commission (Case C-550/07, European Court of Justice, 14 September 2010). Here, the Court held that internal company communications with in-house lawyers subject to a European Commission investigation were not covered by legal professional privilege, as, for the purposes of such an investigation, an in-house lawyer was not sufficiently independent.
38 For the United Kingdom, see s.50 of the Criminal Justice and Police Act 2001.
39 See s.19(5) of the Police and Criminal Evidence Act 1984.
40 See In re Warrant to Search a Certain E-Mail Account Controlled & Maintained by Microsoft Corp., F893 F.3d 197 (2d Cir. 2016) (finding that the government could not compel Microsoft to collect data held outside of the United States that was requested in a warrant issued pursuant to the Stored Communications Act).
41 Cited in R (on the application of Colin McKenzie) v. The Director of the Serious Fraud Office  EWHC 102, at  (original emphasis). In this unsuccessful challenge to this procedure the essential question was whether, as a matter of law, the process for isolating files that may contain LPP material into an electronic folder for review by an independent lawyer must itself be carried out by individuals who are independent of the seizing body. The court held that the procedure set out in the SFO’s Handbook for isolating material potentially subject to LPP, for the purpose of making it available to an independent lawyer for review, was lawful.
42 See Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations available at https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ssmanual2009.pdf.
43 The Value of Cooperation, Justice Manual §9-28.700; Cooperation: Disclosing the Relevant Facts, Justice Manual §9-28.720; FCPA Corporate Enforcement Policy, Justice Manual § 9-47.120, available at https://www.justice.gov/criminal-fraud/file/838416/download (full cooperation requires, among other things, prompt disclosure of ‘all facts related to involvement in the criminal activity by the company’s officers, employees, or agents; and all facts known or that become known to the company regarding potential criminal conduct by all third-party companies (including their officers, employees, or agents’).
44 See Section 922(h) of the Dodd-Frank Wall Street Reform and Consumer Protection Act, 15 U.S.C.A. § 78u-6(h)(1)(A) (2010).
45 See https://www.sec.gov/news/pressrelease/2017-14.html (announcing penalty imposed on Blackrock Inc. based on its inclusion of language in separation agreements requiring former employees to waive any incentives they might be entitled to for reporting the company’s misconduct); https://www.sec.gov/news/pressrelease/2017-24.html (announcing penalty imposed on HomeStreet Inc. for improper accounting and steps taken to impede whistleblowers).
46 The Panama Papers are available through the ICIJ’s (The International Consortium of Investigative Journalists) dedicated website: https://panamapapers.icij.org/.
47 Justice Manual 9-28.900 (internal citations omitted).
48 FCPA Corporate Enforcement Policy, United States Attorneys’ Manual, § 9-47.120, available at https://www.justice.gov/criminal-fraud/file/838416/download.
49 FCPA Corporate Enforcement Policy, United States Attorneys’ Manual, § 9-47.120, available at https://www.justice.gov/criminal-fraud/file/838416/download.
50 Para. 2.8.2(i) DPA Code.
51 SFO v. Standard Bank plc (U20150854) and SFO v. XYZ Ltd (U20150856).
52 See Justice Manual 9-28.720 (‘Cooperation: Disclosing the Relevant Facts’).
53 Para. 2.8.2(i) DPA Code.
54 See Justice Manual 9-28.720. The FCPA Corporate Enforcement Policy, refers to Justice Manual 9-28.720 and states that a company will not have to waive privilege in order to receive full co-operation credit.
58 The Value of Cooperation, Justice Manual §9-28.700; see also Cooperation: Disclosing the Relevant Facts, Justice Manual § 9-28.720.
59 DPA Code, para. 2.8.2(i).
60 Where a defendant in the United Kingdom is suspected of committing a criminal offence, and is questioned in relation to it (whether while under arrest or voluntarily), the questioner must administer a ‘caution’ for any evidence provided in the interview to be admissible in subsequent proceedings. The caution sets out interviewees’ rights and how any evidence they provide at interview may be used against them in a trial. An organisation or company can be interviewed under caution through a nominated spokesperson, who will attend the interview to answer questions on its behalf.
61 ACAS ‘Code of Practice on Disciplinary and Grievance Procedures’ (2015) available at www.acas.org.uk/media/pdf/f/m/Acas-Code-of-Practice-1-on-disciplinary-and-grievance-procedures.pdf.
62 See In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014).
70 Kirstin Ridley, ‘UK fraud office backs down in ENRC privilege battle’, Reuters (2 October 2018), available at https://uk.reuters.com/article/uk-britain-enrc-sfo/uk-fraud-office-backs-down-in-enrc-privilege-battle-idUKKCN1MC1N0.
71 See Fed. R. Evid. 502(a).
72 See Fed. R. Evid. 502(b).
73 See Gotha City v. Sotheby’s  1 WLR 114 (CA).
74 Fed. R. Crim. Pro. 6(e).
75 5 U.S.C. § 552.
77 See, e.g., New York Freedom of Information Law, Public Officer’s Law §§ 84-90.
78 Standard Life Assurance Ltd v. Topland Col (Rev 1)  1 WLR 2162.

References: v. 
 v. 
 v. 
 v. 
 v. 
 § 11
 § 77
 § 78
 § 80
 § 80
 v. 
 § 9
 § 9
 v. 
 v. 
 § 9
 v. 
 EWCA 
 § 1301
 § 1681
 art. 1
 v. 
 v. 
 v. 
 v. 
 §9
 §9
 § 9
 § 78
 § 9
 § 9
 v. 
 v. 
 §9
 § 9
 v. 
 § 552
 v.