Introduction
As recent high-profile litigation, government investigations, and large-scale data-security incidents have shown, organizations are often thrust into crisis mode, requiring rapid responses and close collaboration with third parties, such as public relations consultants, crisis management teams, and forensic accountants and investigators, in order to address the crisis holistically. While these third-party partners are vital in steering an organization through a difficult period, it is imperative to take steps to protect communications with these external partners and safeguard the confidentiality of sensitive and even privileged information.
Generally, the attorney-client privilege protects confidential communications requesting or receiving legal advice between an attorney and their client. The confidential nature of these communications is important, and the privilege can be jeopardized if third parties are included. However, there are important exceptions to the general rule. First, the “common interest” (or “joint defense”) doctrine extends the attorney-client privilege to communications between attorneys and third parties with a shared legal interest (such as co-counsel in an active lawsuit), but it requires active collaboration on a common legal strategy or issue, not just business strategies with incidental legal concerns. Second, privilege can also extend to third-party consultants (such as private investigators, accountants, public relations professionals, etc.), as long as their involvement is essential to aiding the understanding between legal counsel and the client.
Because these exceptions extend the attorney-client privilege beyond just the attorney and client, it is important to have a clear understanding of how these exceptions work in practice, as well as the right strategies in place to enhance the chances of maintaining privilege over sensitive communications that should not be discoverable in active litigation, by the government, or otherwise. Below, we outline practical steps you can take to protect sensitive, privileged, and confidential information when communicating with third parties during a crisis.
1. Engage Legal Counsel Early in the Process
To enhance attorney-client privilege protections over communications that are broader than those between just attorney and client, involve legal counsel at the outset of a crisis. Legal counsel should oversee the structure of third-party relationships and provide guidance on maintaining privilege, ensuring that all communications—particularly those related to legal strategy or risk management—are handled appropriately. Additionally, legal counsel should work with the client to identify essential third parties for managing the crisis and ensure they understand the importance of and how to protect sensitive information. If there is any possibility of litigation resulting from the crisis, work product protections (discussed more below) also become extremely important and provide additional protection over discussions with third parties who may be essential to the development of legal strategy.
2. Designate Third Parties as Agents
To protect privilege, ensure third parties—such as consultants, PR firms, or other experts—are designated as agents of legal counsel, acting under their direction and assisting in providing advice for legal purposes. These arrangements should be formalized through engagement letters that clearly define the third party’s role in supporting legal strategy and specify that all communications with the third party are intended to support the provision of legal advice, not merely to advise on public relations or business decisions. Legal counsel—whether in-house or outside counsel—should initiate the engagement to confirm it is for legal, not business, purposes, ensuring that the work aligns with the overall legal strategy and maintains confidentiality.
3. Anticipate Litigation and Protect Work Product
During a crisis, safeguarding materials prepared in anticipation of litigation is essential for preserving work product protections. Importantly, work product safeguards kick in not just when a legal claim is filed, but when such a claim is reasonably “anticipated.” Work product can be a powerful protection because it not only protects an attorney’s work, thoughts, and impressions—it also extends to documents prepared by third parties that are created because of the pending or impending litigation. Again, to ensure that communications with third parties are protected work product, legal counsel—whether in-house or outside counsel—should initiate engagement with third parties, confirming that the purpose is legal, not business-related, and that such engagement is initiated because of anticipated litigation. In the PR context, courts have recognized that communications with public relations consultants, who need to understand the attorney’s strategy to advise properly, do not waive work product. (Note that if an organization has a consultant on retainer for routine and regular support, it is a best practice to separately re-engage the consultant in the event of a crisis to make clear that the work is being performed to mitigate the specific crisis—and any impending litigation and/or regulatory investigation—and is distinguishable from other, routine work.)
4. Reassess Privilege Issues as New Challenges Arise
Crises often evolve, introducing new issues that require reevaluation of privilege protections and adjustments to communication strategies. For each new issue that arises—whether through changing circumstances or the emergence of new legal concerns—it is essential to re-engage legal counsel and third parties under privilege and work product frameworks. This involves:
- Revisiting the scope of third-party engagements to ensure their roles align with the current legal strategy;
- Confirming that communications remain directed by legal counsel and tied to anticipated litigation; and
- Updating engagement letters or agreements to reflect the specific context of the new issue.
By treating each emerging challenge as an opportunity to reassess and reestablish privilege protections, organizations can better safeguard the integrity of their communications.
5. Limit Distribution of Sensitive Communications and Mark Communications Appropriately
One of the simplest yet most effective strategies for protecting privileged communications is to limit distribution of information to individuals directly involved in the creation and implementation of legal strategy. Additionally, be sure to label emails and messages with headers like “Attorney-Client Privileged” or “Prepared in Anticipation of Litigation” or “Prepared at the Direction of Counsel,” as may be appropriate, to serve as both a reminder to recipients of the communication’s protected status and as documentation in the event the privilege is challenged. While this does not guarantee protection, it minimizes the risk of waiver. Also, be cautious with text messages, email threads, or collaborative platforms (e.g., Slack, Teams, etc.), especially during a crisis, as these methods, because of their informality and broader accessibility, can inadvertently expose sensitive information and undermine legal safeguards. These methods of communication are often the subject of discovery and often contain damaging information. Therefore, ensure sensitive communications are directed to the right individuals and clearly marked to maintain privilege.
Conclusion
While no one wants to be enmeshed in a crisis or the target of litigation, by taking the steps above, organizations can enhance their ability to protect critical communications during crises and focus on resolving the legal issues without fear of exposing sensitive strategies or analyses. Early legal involvement, careful structuring of third-party relationships, and ongoing vigilance are crucial to maintaining confidentiality and minimizing legal risks. For more information or assistance, contact Desirée Moore or Katie Wright Morrone.