Legal Privilege For Data Security Incident Investigation Reports

Data security incident response activities usually involve the creation of sensitive communications and documents that might be subject to legal disclosure obligations unless they are protected by legal privilege. The recent U.S. District Court decision in Re Experian Data Breach Litigation provides helpful guidance for establishing legal privilege over data security incident investigation reports prepared for use in connection with litigation.

Legal Privilege

Basic Rules

There are two kinds of legal privilege under Canadian law that might be relevant to data security incident activities – "legal advice" privilege and "litigation" privilege. Each kind of privilege is different in purpose, scope and duration. Communications and documents might be protected by either or both kinds of privilege, depending on the circumstances. An organization that asserts legal privilege over a communication or document has the burden of proving that the privilege applies.