By Patrick Linehan, Zoe Osborne, Brittany Prelogar, Katherine Dubyak and Jefferson Klocke

Law360 (April 3, 2020, 3:14 PM EDT )

Patrick Linehan

Zoe Osborne

Brittany Prelogar

Katherine Dubyak

Jefferson Klocke

As the world grapples with containing the spread of COVID-19, restrictions on travel and social distancing practices have had the effect of slowing the pace of corporate investigations, which typically involve some degree of travel and human interaction, particularly for evidence-gathering and in-person witness interviews.

Given the uncertainty surrounding when these restrictions may be lifted, as well as when law enforcement agencies will resume business as usual, companies will likely need to move forward with investigations using remote techniques.[1] Some of the legal and practical considerations in conducting remote investigations are set forth below, but they may vary by jurisdiction.

Interviews

Recordings

When conducting interviews remotely, it might be tempting for a participant to record the interview given the ability to do so without detection. Of course, regardless of the interview format, in deciding whether to record an interview, companies should always consider whether the recording will be discoverable or otherwise subject to production as part of its defense or future cooperation efforts.[2]

But should exceptional circumstances warrant the investigating company's recording of an interview, or conversely, should the company want to prevent a witness's surreptitious recording of the interview, it should be aware of the laws and regulations governing unauthorized recordings.

Further, given the greater likelihood of remotely conducted interviews occurring across multiple jurisdictions, it is critical that companies understand the rules in each potentially relevant jurisdiction and which jurisdictions' rules are likely to apply.

Under applicable U.S. federal law, as well as the law of most states, a recording requires only the consent of a single party to the communication. Accordingly, call participants wishing to record an interview in these jurisdictions can do so without obtaining the consent of the other parties because their own consent alone is sufficient.

Companies seeking to record an interview should consider whether the employee's consent is required under internal policies or any contractual obligations. Even without a legal obligation to obtain consent, it may be worth notifying the interviewee as a professional courtesy — or at a minimum, to answer honestly if the interviewee asks if the interview is being recorded.

Conversely, companies seeking to avoid the recording of an interview in a one-party consent jurisdiction should ask the interviewee at the outset whether he or she is recording, make clear that the company does not consent and instruct the interviewee that he or she is prohibited from doing so.[3]

Fifteen U.S. states require that all parties to a conversation consent to it being recorded, with violations potentially resulting in either civil or criminal penalties.[4] Among these states, some embrace the idea of implied consent, where consent is found as long as a party continues with the conversation after being told by the other party that it is being recorded, while others require that each participant consent explicitly to the recording.[5]

In all-party consent jurisdictions, companies are well-advised either to seek the interviewee's express consent or conversely, to make clear its nonconsent to any recording by the interviewee.

Determining the governing law can be challenging when participants span both one-party and all-party consent jurisdictions. In these situations, the most conservative approach is to assume that the law of the most stringent state in which any participant is located applies.

In Kearney v. Salomon Smith Barney Inc., for example, a California court determined that it was necessary to apply California law (an all-party consent jurisdiction) where a corporation in Georgia (a one-party consent jurisdiction) recorded calls with witnesses in California, because failing to do so would:


For remote interviews where any participant is outside of the U.S., recording without consent may also be a civil or criminal offense. Where it is not a criminal offense (for example, in the U.K.), covertly recording someone may give rise to a breach of privacy laws and, consequently, to a potential civil claim for substantial damages.

To the extent that interviews present the possibility of capturing information about EU data subjects, companies will also want to consider whether the act of recording an interview is covered by the EU General Data Protection Regulation, which applies to certain companies located outside of Europe and includes a fine of up to €20 million (~$22 million) or, in the case of an undertaking, 4% of annual global turnover. Other applicable data privacy laws also should be considered.

Confidentiality and Privilege Considerations

Remotely conducted interviews also pose challenges to the creation and preservation of an environment that sufficiently protects the interview's confidentiality. Companies should consider the potential risks surrounding waiver of the attorney-client privilege, or equivalent protections outside the U.S., when conducting interviews remotely.

Under these circumstances, a company has considerably less control over who else, unbeknownst to the company, might be present during the interview or meeting.

Although U.S. courts take varying views on whether the presence of client agents (such as accountants, auditors, translators or other consultants) destroy the privilege, most U.S. courts hold that the privilege does not protect communications in the presence of third parties other than those who are necessary for the communications.[7]

Thus, companies should be mindful that the presence of unnecessary third parties — such as a witness's family or other cohabitants — during an interview may risk privilege waiver.[8] Companies should explain this risk to employees and emphasize that no one other than the witness should be physically present or within earshot during the interview.

Both federal and state law, as well as ethical rules, may also require that parties undertake precautionary measures to avoid privilege waiver through the inadvertent disclosure of such communications to third parties.[9] Companies should make best efforts to avoid inadvertent privilege waiver and document these efforts.

If it is necessary to provide company documents in advance of or during a remote interview, companies must take steps to protect their confidentiality. One option is to share documents on the screen during a videoconference, although this can have the effect of significantly minimizing the video display of the witness, which is already a compromise as compared to in-person interviews.

Another option is to send the documents shortly before the interview with security settings that prevent their further dissemination. A better alternative may be to set up a secure reading room that allows only the interviewees to access read-only copies of the documents for a restricted period of time.

But all of those options still pose a risk that the recipient may capture and disseminate information contained in the documents through other means, such as through screenshots or handwritten notes. To mitigate this risk, companies may want to monitor by videoconference witnesses' access to documents during interviews or consider requiring that witnesses sign a nondisclosure agreement.

Additionally, employees working remotely may experience difficulty accessing their work-related email and other company systems, which can lead employees to rely on personal emails and devices as alternatives. Often the use of personal emails and devices is strictly prohibited by company policy for security and other reasons.

Where company policy does not prohibit use of personal email or devices, such use is unlikely, by itself, to automatically cause a waiver of an otherwise privileged communication if there is still a reasonable expectation of privacy in the communication.[10]

But in some instances, personal email accounts are shared or accessible by family members, which create the same risk of privilege waiver as if a third party were present in the background during an interview. Companies should therefore discourage the use of personal email as much as possible.

To the extent such use cannot be avoided, companies should direct employees to use accounts to which only they have access and to include appropriate disclaimers (e.g., "privileged and confidential" or "prepared at the direction of counsel") in communications with company counsel.

Interviewing Former and/or Separately Represented Employees

Conducting a thorough investigation often involves interviewing former employees or employees that are separately represented. Because there is an increased likelihood in remote interviews that former and/or separately represented employees will be located in different jurisdictions, and the rules between jurisdictions surrounding this contact vary substantially, companies should be mindful of the differences between each relevant jurisdiction's laws and carefully consider which laws would apply in a cross-jurisdictional interview.

Former Employees and Privilege

U.S. courts generally find that communications with former employees are privileged as long as the communications involve privileged information the employees obtained during their employment that relate to the lawyer's ability to advise the company client.[11]

The privilege may not survive, however, if the former employee's current personal counsel[12] is privy to the communication because the other lawyer's presence would destroy the requisite confidentiality (absent entry into a joint defense or common interest agreement).[13]

As such, investigators must be careful to ensure interviews of former employees are made in a way that preserves privilege, which for former employees means limiting discussions to only matters learned about during the employee's employment and entering into a joint defense agreement covering the interview where applicable.

Although the above privilege rules apply generally, remote investigation settings may potentially implicate multiple U.S. states' laws. Although the admissibility of privileged communications in federal proceedings will be governed by Federal Rule of Evidence 501, Rule 501 requires application of state privilege law in civil cases and privilege law "as interpreted by United States courts in the light of reason and experience" in criminal cases,[14] which also typically looks to state law. This calls for an understanding of both all of the relevant states' privilege laws (i.e., all of the states in which the interview participants are located) and federal courts' interpretations of those laws.

Non-U.S. privilege laws should be considered as well. In the U.K., for example, communications with former employees are not protected by the legal advice privilege since that privilege only applies between a lawyer and client. Certain other forms of legal privilege may be available in the U.K., including where there is a common interest between the parties — but these protections are easily lost.

Similarly, while the interview notes of company lawyers are likely subject to litigation privilege in the U.K. (assuming they were prepared in the context and for the dominant purpose of litigation, which includes investigations), that privilege may be lost if the notes are shared with a third party, including the interviewee.

No-Contact Rule for Separately Represented Witnesses

Another important issue to consider when deciding whether to conduct a remote interview of a separately represented employee (whether current or former) is the American Bar Association's Model Rule of Professional Conduct 4.2, also known as the no-contact rule. This rule generally prohibits a lawyer from communicating with a nonclient whom the lawyer knows to be represented in the matter by another lawyer, subject to certain exceptions.[15]

Because the parameters of the rule differ across states, companies conducting investigations remotely should be mindful of the rules that are potentially applicable to a cross-jurisdictional interview. For example, although a lawyer conducting an interview must abide by the no-contact rule in the jurisdictions in which that lawyer is barred, the interview may also be subject to more restrictive no-contact rules in the jurisdiction in which the lawyer is practicing during the course of the interview, which may include the location of either the lawyer or interviewee during the interview.

Moreover, many international jurisdictions have similar rules regarding contact with separately represented witnesses. In the U.K., for example, the professional rules governing the conduct of solicitors prohibit them from contacting individuals who are separately represented, except for in exceptional circumstances (e.g., if the solicitor representing the individual is not responding). The possibility of these non-U.S. rules' applicability to remotely conducted interviews must be considered as well.

Additional Practical Considerations

Companies should keep the following additional practical considerations in mind when conducting interviews remotely:

As much as possible, the interview should be done in an environment that minimizes witness distractions. The witness should be encouraged to find a private space, and interviewers should be flexible enough to accommodate interviewees' schedules in light of this practical challenge. Similarly, interviews can be stressful and tiring, and interviewees should be afforded the same breaks that typically accompany in-person meetings.

Videoconferences are typically preferable to teleconferences because they allow each participant to assess the conduct of other participants and minimize the likelihood both that third parties are present and that documents are being misused. Additionally, the use of videoconference permits the interviewer to better assess witness credibility, which may be critical to the investigation. But, if videoconference is used, it is important to remind all parties that they are on video and that simply muting audio may not be an option.

Interviewers should set ground rules for speaking during the interview — such as allowing for a brief pause after one person speaks before the other jumps in — to minimize the interruptions caused by multiple individuals speaking at once. Speakers should also pause more frequently so that long responses are not missed due to calls being unknowingly disconnected.

In the case of video interviews, interviewers should maintain a professional appearance and background environment to preserve the seriousness and formality of the interview.

If separate counsel has been retained for the interviewee, interviewers should consider how practically the interviewee can seek advice from his or her counsel during the course of the interview. Additionally, if the interview is occurring in a jurisdiction (such as France) where relevant trade unions or staff counsel must attend the interview, interviewers should consider how to facilitate this process remotely.

If a translator is needed, interviewers should consider the logistics of having the translator participate by phone or videoconference from a different location than the witness.

Remote Document Collection

Although most forms of electronic documents can now be collected remotely, it may be more challenging to collect and review relevant hard-copy documents while travel restrictions and quarantines remain in place. Depending on the restrictions in a given location, and with due regard to employee health and safety, companies may consider a few options:

It may be possible to defer the hard-copy collection, particularly if the matter is less time-sensitive and waiting does not pose a risk of spoliation (e.g., because a building is shut down).

Alternatively, investigators could ask local legal or compliance personnel (or an appropriate legal or accounting consultant) to perform the hard-copy document collection with the aid of a defined document collection protocol and to transmit the documents to investigators via a secure file transfer site.

To the extent that a collection must be performed by the witness outside the presence of investigators or their representatives, investigators might consider overseeing the witness's collection process via videoconference. If that is not an option, investigators could require the witness to confirm in writing the locations searched and to certify that they have provided all documents that are responsive to the collection list (although this would not be a preferred option for suspected wrongdoers given the risk of evidence destruction).

Companies also should document their collection process in detail and consider keeping investigating agencies apprised (perhaps even in advance) as to how they are adapting their hard-copy document collections to address the exigencies of a social distancing environment.

Finally, given the possibility that disinfections and cleanups may be underway at certain locations, companies facing such circumstances are well advised to re-issue any document preservation notices to make clear that under no circumstances should any cleanup efforts involve the disposal of documents otherwise covered by prior preservation notices.

As with any document collection effort, when undertaking a remote collection, companies must also consider any applicable data protection rules. In some jurisdictions, it is necessary to obtain the informed consent of the affected data subjects before processing data, although there may be applicable exceptions where an employee's consent is not required.

Applicable data protection rules may also require specific levels of confidentiality, registration with local data protection agencies or data minimization (e.g., collecting the minimum number of documents necessary by, for example, applying keyword search terms).

In addition, independently of data protection requirements, companies should consider whether documents should be transferred to another jurisdiction when it is legal to do so. The availability of documents in a new jurisdiction might make them subject to production in that new jurisdiction in circumstances where they would otherwise not have been compellable from their original jurisdiction.

Reporting

Finally, companies will want to consider the process for reporting remotely on the results of the investigation, both internally and, if relevant, to third parties such as law enforcement.

In circumstances where physical meetings cannot be convened to report on investigative findings, companies will want to consider whether results should be displayed via an electronic screen share or committed to writing and disseminated by email — as well as the privilege consequences of any processes followed, including the instructions given to recipients about taking notes, sending emails with their thoughts, etc.

Decisions may also be required (including, for example, suspending or dismissing employees, freezing employees' compensation and/or reporting to law enforcement), which will be more challenging remotely and will need careful choreographing to ensure that any available privilege and confidentiality protections are not compromised.

Conclusion

It is clear that measures to control the new coronavirus will require lawyers to adapt quickly to ensure that investigations and other important client matters do not come to a standstill — particularly when operating in certain industries, such as the financial sector, which may require companies to undertake and report on investigations as expeditiously as possible.

As the effects of COVID-19 reverberate throughout corporate America and the world, in-house legal departments and their outside counsel will need to develop creative, and perhaps novel, techniques to conduct investigations remotely, while ensuring that these techniques do not pose unanticipated risks to the integrity of the investigation.

---

Patrick F. Linehan, Zoe Osborne and Brittany Prelogar are partners, and Katherine M. Dubyak and Jefferson Klocke are associates at Steptoe & Johnson LLP.

The opinions expressed are those of the author(s) and do not necessarily reflect the views of the firm, its clients or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.

[1] Although outside the scope of this article, it is worth noting that law enforcement agencies in some jurisdictions require companies to consider whether they should undertake internal investigations without first discussing their scope with the relevant agency, since to do so may "trample the crime scene," and the relevant law enforcement agency may prefer to undertake the investigation itself and get "first accounts" from interviewees. For example, the Serious Fraud Office and the Financial Conduct Authority in the United Kingdom have suggested that a company may get credit for holding off from undertaking an internal investigation, in favor of law enforcement doing its own investigation. This remains a relevant consideration when conducting investigations remotely.

[2] Rules regarding privilege, work product, and associated discoverability of recorded interviews differ across state and international jurisdictions, and for those reasons and others, the cautious approach for clients in both the United States and the United Kingdom is to avoid recording interviews (although, if relevant, the Serious Fraud Office may try to insist on it and a company may get credit for having done so). In any event, companies should understand fully the governing law in all of the potentially applicable jurisdictions, as well as consider the possibility and ramifications of an investigating agency taking the position that such recordings are nonprivileged.

[3] It is worth noting that the US Securities and Exchange Rule 21F-17(a) prohibits any person from "imped[ing] an individual from communicating directly with the [SEC] about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement." 17 C.F.R. § 240.21F–17(a). Companies instructing interviewees that they may not record an interview should be mindful of this rule, and avoid any instruction that would run afoul of it.

[4] The following states require all-party consent before the conversation can legally be recorded: California (Cal. Penal Code §§ 632, 637.2), Connecticut (Conn. Gen. Stat. §§ 52-570d, 53a-189), Delaware (Del. Code Ann. tit. 11, §§ 1335, 2402, 2409), Florida (Fla. Stat. § 934.03), Illinois (720 Ill. Comp. Stat. Ann. §§ 5/14-2, 5/14-4, 5/14-6), Maryland (Md. Code Ann., Cts. & Jud. Proc. §§ 10-402, 10-410), Massachusetts (Mass. Gen. L. ch. 272 § 99 (2019)), Michigan (Mich. Comp. Laws § 750.539c), Montana (Mont. Code § 45-8-213), Nevada (Nev. Rev. Stat. § 200.650), New Hampshire (N.H. Rev. Stat. §§ 570-A:2, 570-A:11), Oregon (Or. Rev. Stat. §§ 133.739, 165.540), Pennsylvania (18 Penn. Cons. Stat. §§ 5704, 5725, 5747), Vermont (see Vermont v. Geraw , 795 A.2d 1219 (Vt. 2002)), and Washington (Wash. Rev. Code §§ 9.73.030, 9.73.060, 9.73.080). Further, while Nevada's relevant statute appears to require only one-party consent (see Nev. Rev. Stat. § 200.650), the Nevada Supreme Court has interpreted the statute as requiring all-party consent. See Lane v. Allstate Ins. Co. , 969 P.2d 938 (Nev. 1998). Conversely, although the relevant statute in Michigan looks like an all-party consent statute, it is unclear if a participant must receive the consent of all other participants before recording the conversation. Compare Mich. Comp. Laws § 750.539c, with Sullivan v. Gray , 324 N.W.2d 58 (Mich. App. 1982) (finding applicable statute does not prohibit party to telephone conversation from tape recording conversation absent consent of all other participants).

[5] See, e.g., New Hampshire v. Locke , 761 A.2d 376 (N.H. 1999) (holding that party effectively consented to recording when circumstances demonstrated party knew the communication was being recorded); Conn. Gen. Stat. § 52-570d (noting requisite consent is present when (1) prior written consent is given, (2) the participants continue with the conversation after being verbally notified of the recording at the conversation's outset, or (3) the recording is made using a device that emits an audible tone at 15-second intervals while the device is recording); Wash. Rev. Code §§ 9.73.030 (requiring prior consent of all conversation participants before any party can legally record any private conversation).

[6] 37 P.3d 914, 917 (Cal. 2006).

[7] See, e.g., Pearlstein v. Blackberry Ltd. , 2019 WL 2281280, at *2 (S.D.N.Y. May 29, 2019); Narayanan v. Sutherland Global Holdings, Inc. , 285 F. Supp. 3d 604, 611-12 (W.D.N.Y. 2018).

[8] See, e.g., United States v. Stewart , 287 F. Supp. 2d 461, 464 (S.D.N.Y. 2003); Wertenbaker v. Winn , 30 Va. Cir. 327, 330 (Va. Cir. Ct. 1993).

[9] See, e.g., Fed. R. Evid. 502(b); N.Y. C.P.L.R. § 4503; Cal. Evid. Code §§ 954-55; Fla. Stat. § 90.5021.

[10] See City of Reno v. Reno Police Protective Ass'n , 59 P.3d 1212, 1218 (2002) (holding that a confidential document transmitted via email is protected by the attorney client privilege as long as the requirements of privilege are met); In re Asia Global Crossings, Ltd. , 322 B.R. 247, 257 (Bankr. S.D.N.Y. 2005) (establishing a widely used four-factor test for determining whether there is a reasonable expectation of privacy in a privileged communication).

[11] See, e.g., Peralta v. Cendant Corp. , 190 F.R.D. 38, 41 (D. Conn. 1999) (relying on Upjohn Co. v. United States , 449 U.S. 383 (1981)).

[12] Ethical issues that may be implicated by the former employee having separate representation in the matter are discussed below.

[13] See Fed. R. Evid. 501.

[14] See id.

[15] See, e.g., ABA Model R. Prof. Conduct 4.2 (1995); Restatement (Third) of the Law Governing Lawyers § 99 cmt. b. (2000) (noting "the rule is universally followed in American jurisdictions").

For a reprint of this article, please contact reprints@law360.com.