Court Rules Target Data Breach Internal Investigation Documents Largely Protected by Attorney-Client Privilege/Work Product Doctrine

The Minnesota magistrate judge presiding over discovery in the litigation seeking to hold Target Corp. liable for the retailer's 2013 data breach issued an order denying the motion by a plaintiff class of about 9,000 banks to compel production of certain documents relating to Target's internal investigation that were withheld on privilege grounds.

The banks argued that Target could not avoid disclosure of the details of its investigation conducted by a "Data Breach Task Force" (DBTF) under the attorney-client privilege or work product doctrine, because the investigation of the breach and the planning process for remediation constitute regular business functions. The banks claimed that Target's use of outside counsel to direct the DBTF did not transform factual communications into requests for legal advice. Rather, the plaintiffs argued that those communications were "regular" business discussions Target would have conducted "regardless of any litigation, to appease