Can Any Data Breach Investigation Report Deserve Protection? Part II

Last week's Privilege Point described a data breach victim's latest losing effort to claim privilege protection for its consultant's investigation report. Leonard v. McMenamins Inc., Case No. C22-0094-KKE, 2023 U.S. Dist. LEXIS 217502 (W.D. Wash. Dec. 6, 2023). Before bluntly rejecting McMenamins' privilege claim, the court spent more time analyzing its work product claim before also denying that.

The court began its analysis by pointing to the determinative issue: "whether the report would have been prepared in a substantially similar form absent the anticipation of litigation." Id. at *6. Like most losers, McMenamins cited one of the only few cases that seem to have succeeded on the work product side. The court first nixed the analogy to In re Target Corp. Customer Data Security Breach Litigation, MDL No. 14-2522 (PAM/JJK), 2015 U.S. Dist. LEXIS 151974 (D. Minn. Oct. 23, 2015), noting that "unlike here, Target had engaged in a two-track investigation" — one