Overview
For additional guidance, please refer to Steptoe's COVID-19 Resource Center.
As the world grapples with containing the spread of COVID-19, restrictions on travel and "social distancing" practices have had the effect of slowing the pace of corporate investigations, which typically involve some degree of travel and human interaction, particularly for evidence gathering and in-person witness interviews. Given the uncertainty surrounding when these restrictions may be lifted, as well as when the US Department of Justice and other global law enforcement agencies will resume business as usual, companies will likely need to move forward with investigations—including document collection and interviews—using remote techniques. Before doing so, it is worth considering the legal and practical considerations that accompany remote investigative techniques.[1] Some of these general considerations are set forth below, but they may vary by jurisdiction.
Interviews
Recordings
When conducting remote interviews telephonically or through other remote means, it might be tempting for either the interviewer or the interviewee to record the interview given the ability to do so without detection. Of course, in deciding whether to record an interview companies should always consider, regardless of how the interview is conducted, whether the recording will be discoverable and the possibility that recordings may be produced to government investigators as part of future cooperation efforts or as part of defending themselves.[2]
But should exceptional circumstances warrant the investigating company's recording of an interview (including, for example, because a law enforcement agency insists on it or credit may be obtained for doing so) or conversely, should the company want to prevent a witness's surreptitious recording of the interview, it should be aware of the laws and regulations governing unauthorized recordings. Further, given the greater likelihood of remotely conducted interviews occurring across two or more jurisdictions than with in-person interviews, it is critical that companies understand the rules in each potentially relevant jurisdiction and which jurisdictions' rules are likely to apply.
Under applicable US federal law, as well as the law of most US states and the District of Columbia, a recording requires only the consent of a single party to the communication. Accordingly, call participants wishing to record an interview in these jurisdictions can do so without obtaining the consent of the other party to the discussion because their own consent alone is sufficient. Companies seeking to record should also consider whether the employee's consent is required under internal policies or any contractual or collective bargaining obligations. Even without a legal obligation to obtain the other party's consent, it may be worth notifying the interviewee as a professional courtesy to retain the working relationship—or at a minimum, to answer honestly if the interviewee asks if the interview is being recorded. Conversely, companies seeking to avoid the witness’s recording of a remotely-conducted interview in a one-party consent jurisdiction should ask the interviewee at the outset of the interview whether he or she is recording the conversation, make clear that the company does not consent to any such recording, and instruct the interviewee that he or she is prohibited from doing so.[3]
Fifteen US states require that all parties to a conversation consent to it being recorded, with violations potentially resulting in either civil or even criminal penalties.[4] Among these states, some embrace the idea of implied consent, where consent is found as long as a party continues with the conversation after being told by the other party that it is being recorded, while others require that each participant consent explicitly to the recording.[5] In all-party consent jurisdictions, companies are well-advised either to seek the interviewee’s express consent to their recording the interview or conversely to make clear its non-consent to any recording by the interviewee.
In determining which law applies to US multi-state conversations, the analysis is simple if all of the conversation participants are located in states where the same consent rule governs. Determining the governing law can be significantly more challenging, however, where participants span both one-party and all-party consent jurisdictions. In these situations, the most conservative approach is to assume that the law of the most stringent state in which any participant is located applies. In Kearney v. Salomon Smith Barney, Inc., for example, a California court determined that it was necessary to apply California law (an all-party consent jurisdiction) where a corporation in Georgia (a one-party consent jurisdiction) recorded calls with witnesses in California.[6] In doing so, the California court found that failing to apply California law would "impair California's interest in protecting the degree of privacy afforded to California residents by California law more severely than the application of California law would impair any interests of the State of Georgia."[7]
For remote interviews where either the interviewer or interviewee is outside of the United States, it may similarly be a civil or criminal offense to record an individual without his or her permission. Where it is not a criminal offense (for example, in the United Kingdom), covertly recording someone may give rise to a breach of privacy laws and, consequently, to a potential civil claim for substantial damages. To the extent that interviews present the possibility of capturing information about EU data subjects, companies will also want to consider whether the act of recording an interview, and any subsequent processing of that recording, is covered by the European General Data Protection Regulation (GDPR). Investigators will want to consider the scope and requirements of the GDPR, as it applies to certain companies located outside of Europe. The sanctions for breach of GDPR include a maximum fine of up to €20 million (or around $22 million USD) or, in the case of an undertaking, 4% of annual global turnover.
Confidentiality and Privilege Considerations
Remotely conducted interviews also pose challenges to the creation and preservation of an interview environment that sufficiently protects the confidentiality of the interview. Not only is there a risk of interviews being recorded without the company’s consent as discussed supra, but other risks also attach. For example, third parties may be physically present for or within earshot of the interview, or documents (in either paper or electronic form) shared with the interviewee prior to or during the interview may be the subject of further unauthorized distribution to third parties.
Companies should consider the potential risks surrounding waiver of the attorney-client privilege or, outside the United States, the equivalent legal professional privilege protections, when conducting interviews or other meetings remotely. Under these circumstances, a company has considerably less control over who else, unbeknownst to the company, might be present during the interview or meeting. Although US courts take varying views on whether the presence of client agents (such as accountants, auditors, translators, or other consultants) destroy the privilege, most US courts hold that the privilege does not protect communications in the presence of third parties other than those who are "necessary" for the communications.[8] Thus, companies should be mindful that the presence of unnecessary or unauthorized third parties—such as a witness's family members, friends, or other cohabitants—during an investigative interview may risk privilege waiver.[9] Companies should explain this risk to employees and emphasize that no one other than the witness (or his/her counsel, if applicable) should be physically present or within earshot during the interview.
Both US federal law and state law also require that parties undertake precautionary measures to protect the confidentiality of privileged communications to avoid the inadvertent disclosure of such communications to third parties and privilege waiver.[10] On top of these requirements, ethical rules obligate company counsel to undertake efforts to maintain the confidentiality of attorney-client communications. Making best efforts (and creating a written record of those efforts) to minimize the risk of an inadvertent or unauthorized breach of confidentiality is thus critical to the conduct of investigative interviews in a remote setting.
If it is necessary to provide company documents in advance of or during a remote interview, companies must take steps to protect their confidentiality. One option is to share documents on the screen during a videoconference, although this can have the effect of significantly minimizing the video display of the witness, which is already a compromise as compared to in-person interviews. Another option is to send the documents shortly before the interview with security settings enabled that prohibit anyone but the recipient from accessing or forwarding the documents, or to send the documents via secure file transfers with similar restrictions. A better alternative may be to set up a secure reading room that allows only the interviewees (and their counsel, if applicable) to access read-only copies of the documents for a restricted period of time. But all of those options still pose a risk that the recipient may capture and disseminate information contained in the documents through other means, such as through screenshots or handwritten notes. To mitigate this risk, companies may want to monitor by videoconference witnesses' access to documents during interviews or consider requiring that witnesses sign a non-disclosure agreement certifying that they will not use the documents for any other purpose but the interview.
Additionally, employees and other important witnesses working remotely—and potentially sending documents to investigators—may experience difficulty accessing their work-related email and other company systems. This can lead employees and other witnesses to turn to personal emails and personal phone devices as alternatives. Often the use of personal emails and devices is strictly prohibited by company policy for security and other reasons. With respect to privilege, the use of a personal email or device is unlikely, by itself, to automatically cause a waiver of an otherwise privileged communication if there is still a reasonable expectation of privacy in the communication.[11] But in some instances, personal email accounts are shared or accessible by spouses or other family members, which create the same risk of privilege waiver as if a family member or other third party was present in the background during an interview. Companies should therefore discourage the use of personal email as much as possible. To the extent that use of personal email cannot be avoided, companies should emphasize that any account used should be one that only the employee can access and should direct employees or witnesses to label communications with counsel as "Privileged and Confidential," and, where applicable, "Prepared at the Direction of Counsel."
Interviewing Former and/or Separately Represented Employees
Conducting a thorough investigation often involves interviewing former employees or employees that are separately represented. The rules and protections surrounding contacts with these types of witnesses vary substantially by jurisdiction. Because there is an increased likelihood in remote interviews that former and/or separately-represented employees will be located in different jurisdictions, companies should be mindful of the differences between each relevant jurisdiction’s laws and carefully consider which laws would apply in a cross-jurisdictional interview.
Former Employees and Privilege
In the United States, courts generally find that communications with former employees are privileged as long as the communications relate to: (1) privileged information the employees obtained during their time at the company; or (2) facts about the current matter the employees obtained during their employment that relate to the lawyer’s ability to advise the company client.[12] The privilege may not survive, however, if the former employee's current personal counsel[13] is present or privy to the communication because the other lawyer's presence would destroy the requisite confidentiality (absent entry into a joint defense or common interest agreement).[14] As such, investigators must be careful to ensure interviews of former employees are made in a way that preserves privilege, which for former employees additionally means (1) limiting the discussion to matters the former employee learned about during the term of his or her employment and, (2) where the former employee has separate counsel present, entering into a joint defense or common interest agreement with the former employee and his or her counsel that is applicable to that interview.
Although the above privilege rules apply generally, remote investigation settings may potentially implicate multiple US states' laws. In those settings, it is important to determine which law applies so that appropriate actions can be taken to preserve privilege. Although the admissibility of privileged communications for matters that later become the subject of federal proceedings will be governed by Federal Rule of Evidence 501, Rule 501 requires application of state privilege law in civil cases and privilege law "as interpreted by United States courts in the light of reason and experience" in criminal cases,[15] which also typically looks, in turn, to state law. This calls for an understanding of both all of the relevant states' privilege laws (i.e., all of the states in which the interview participants are located) and federal courts’ interpretations of those laws.
In the United Kingdom, communications with former employees are not protected by the legal advice privilege since that privilege only applies between a lawyer and his or her client. Certain other forms of legal privilege may be available in the UK, including where there is a "common interest" between the parties—but companies should be careful in relying on these protections because they are easily lost. Similarly, while the interview notes of company lawyers are likely subject to litigation privilege in the UK (assuming the notes were prepared in the context of current or anticipated litigation, which can include an investigation, and were prepared for the dominant purpose of that litigation), that privilege may be lost if the notes are shared with a third party, including the interviewee.
No-Contact Rule for Separately Represented Witnesses
Another important issue to consider when deciding whether to conduct a remote interview of a separately-represented employee (whether current or former) is the American Bar Association's Model Rule of Professional Conduct 4.2, also known as the "no-contact" rule. The no-contact rule generally prohibits a lawyer from communicating about the subject of a representation with a non-client whom the lawyer knows to be represented in the matter by another lawyer, subject to certain exceptions.[16] Because the parameters of the no-contact rule may differ across US states, companies conducting investigations remotely should be mindful of the rules that are potentially applicable when interview participants are located across different jurisdictions. For example, although a lawyer conducting an interview of a represented party must abide by the no-contact rule in the jurisdictions in which that lawyer is barred, the interview may also be subject to more restrictive no-contact rules in the jurisdiction in which the lawyer is "practicing" during the course of the interview, which may in turn include not only the interviewing lawyer’s location but also the location of the interviewee.
Moreover, many international jurisdictions have similar rules regarding contact with separately-represented witnesses. In the United Kingdom, for example, the professional rules governing the conduct of solicitors prohibit them from contacting individuals who are separately represented, except for in exceptional circumstances (for example, if the solicitor representing the individual is not responding). The possibility of these non-US rules’ applicability to remotely-conducted interviews must be considered as well.
Additional Practical Considerations
Companies should keep the following additional practical considerations in mind when conducting interviews remotely:
- As much as possible, the interview should be done in an environment that minimizes witness distractions. The witness should be encouraged to find a private space with no distractions, and interviewers should be flexible enough to accommodate interviewees’ schedules in light of this practical challenge. Similarly, interviews can be stressful and tiring, and the interviewee should be afforded the same breaks that typically would be afforded in an in-person meeting.
- Videoconferences are typically preferable to teleconferences because they allow each participant to assess the conduct and well-being of other participants and minimize the likelihood both that third parties are present and that documents are being misused. Additionally, the use of videoconference permits the interviewer to better assess witness credibility, which may be critical to the investigation. But, if videoconference is used, it is important to remind all parties that they are on video and that simply muting audio may not be an option.
- Interviewers should set ground rules for speaking during the interview—such as allowing for a brief pause after one person speaks before the other jumps in— to minimize the interruptions caused by multiple individuals speaking at once. This also can be avoided in interviews via videoconference, where participants can look for visual cues from the speaker. Speakers on conference calls should also pause more frequently so that long responses are not missed due to calls being unknowingly disconnected.
- In the case of video interviews, interviewers should maintain a professional appearance and background environment to preserve the seriousness and formality of the interview.
- If separate counsel has been retained for the interviewee, interviewers should consider how practically the interviewee can seek advice from his or her counsel during the course of the interview. Additionally, if the interview is occurring in a jurisdiction (such as France) where relevant trade unions or staff counsel must be informed of or attend the interview, interviewers should consider how to facilitate this process remotely.
- If a translator is needed for the interview, interviewers should consider the logistics of having the translator participate by phone or videoconference from a different location than the witness.
Remote Document Collection
Although most forms of electronic documents can now be collected remotely, it may be more challenging to collect and review relevant hard-copy documents while travel restrictions and quarantines remain in place. Depending on the restrictions in a given location, and with due regard to employee health and safety, companies may consider a few options:
- It may be possible to wait to perform the hard-copy collection, particularly if the matter is less time-sensitive and waiting does not pose a risk of spoliation (e.g., because a building is shut down).
- Alternatively, investigators could ask local legal or compliance personnel (or an appropriate legal or accounting consultant) to perform the hard-copy document collection with the aid of a defined document collection protocol and to transmit the documents to investigators via a secure file transfer site.
- To the extent that a collection must be performed by the witness outside the presence of investigators or their representatives, investigators might consider overseeing the witness’s collection process via videoconference. If that is not an option, investigators could require the witness to confirm in writing the locations searched and to certify that they have provided all documents that are responsive to the collection list (although this would not be a preferred option for suspected wrongdoers given the risk of evidence destruction).
Companies also should document their collection process in detail and consider keeping investigating agencies apprised (perhaps even in advance) as to how they are adapting their hard-copy document collections to address the exigencies of a social distancing environment. Finally, given the possibility that disinfections and clean-ups may be underway at certain locations, companies facing such circumstances are well advised to re-issue any document preservation notices to make clear that under no circumstances should any clean-up efforts involve the disposal of documents otherwise covered by prior preservation notices.
As with any document collection effort, when undertaking a remote collection, companies must also consider any applicable data protection rules. In some jurisdictions, it is necessary to obtain the informed consent of the affected data subjects before processing data, although there may be applicable exceptions where an employee’s consent is not required. Applicable data protection rules may also require specific levels of confidentiality, registration with local data protection agencies, or data minimization (e.g., collecting the minimum number of documents necessary by, for example, applying keyword search terms). In addition, independent of data protection requirements, companies should consider whether documents should be transferred to another jurisdiction when it is legal to do so. The availability of documents in a new jurisdiction might make them subject to production in that new jurisdiction in circumstances where they would otherwise not have been compellable from their original jurisdiction.
Reporting
Finally, companies will want to consider the process for reporting remotely on the results of the investigation, both internally and, if relevant, to third parties such as law enforcement. In circumstances where physical meetings cannot be convened to report on investigative findings, companies will want to consider whether results should be displayed via an electronic screen share or committed to writing and disseminated by email—as well as the privilege consequences of any processes followed, including the instructions given to recipients about taking notes, sending emails with their thoughts, etc. Decisions may also be required (including, for example, suspending or dismissing employees, freezing employees' compensation, and/or reporting to law enforcement), which will be more challenging remotely and will need careful choreographing to ensure that any available privilege and confidentiality protections are not compromised.
Conclusion
It is clear that measures to control the new coronavirus will require lawyers to adapt quickly to ensure that investigations and other important client matters do not come to a standstill—particularly when operating in certain industries, such as the financial sector, which may require companies to undertake and report on investigations as expeditiously as possible. As the effects of COVID-19 reverberate throughout corporate America and the world, in-house legal departments and their outside counsel will need to develop creative, and perhaps novel, techniques to conduct investigations remotely, while ensuring that these techniques do not pose unanticipated risks to the integrity of the investigation.
[1] Although outside the scope of this article, it is worth noting that law enforcement agencies in some jurisdictions require companies to consider whether they should undertake internal investigations without first discussing their scope with the relevant agency, since to do so may "trample the crime scene," and the relevant law enforcement agency may prefer to undertake the investigation itself and get "first accounts" from interviewees. For example, the Serious Fraud Office and the Financial Conduct Authority in the United Kingdom have suggested that a company may get credit for holding off from undertaking an internal investigation, in favor of law enforcement doing its own investigation. This remains a relevant consideration when conducting investigations remotely.
[2] Rules regarding privilege, work product, and associated discoverability of recorded interviews differ across state and international jurisdictions, and for those reasons and others, the cautious approach for clients in both the United States and the United Kingdom is to avoid recording interviews (although, if relevant, the Serious Fraud Office may try to insist on it and a company may get credit for having done so). In any event, companies should understand fully the governing law in all of the potentially applicable jurisdictions, as well as consider the possibility and ramifications of an investigating agency taking the position that such recordings are non-privileged.
[3] It is worth noting that the US Securities and Exchange Rule 21F-17(a) prohibits any person from "imped[ing] an individual from communicating directly with the [SEC] about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement." 17 C.F.R. § 240.21F–17(a). Companies instructing interviewees that they may not record an interview should be mindful of this rule, and avoid any instruction that would run afoul of it.
[4] The following states require all-party consent before the conversation can legally be recorded: California (Cal. Penal Code §§ 632, 637.2), Connecticut (Conn. Gen. Stat. §§ 52-570d, 53a-189), Delaware (Del. Code Ann. tit. 11, §§ 1335, 2402, 2409), Florida (Fla. Stat. § 934.03), Illinois (720 Ill. Comp. Stat. Ann. §§ 5/14-2, 5/14-4, 5/14-6), Maryland (Md. Code Ann., Cts. & Jud. Proc. §§ 10-402, 10-410), Massachusetts (Mass. Gen. L. ch. 272 § 99 (2019)), Michigan (Mich. Comp. Laws § 750.539c), Montana (Mont. Code § 45-8-213), Nevada (Nev. Rev. Stat. § 200.650), New Hampshire (N.H. Rev. Stat. §§ 570-A:2, 570-A:11), Oregon (Or. Rev. Stat. §§ 133.739, 165.540), Pennsylvania (18 Penn. Cons. Stat. §§ 5704, 5725, 5747), Vermont (see Vermont v. Geraw, 795 A.2d 1219 (Vt. 2002)), and Washington (Wash. Rev. Code §§ 9.73.030, 9.73.060, 9.73.080). Further, while Nevada's relevant statute appears to require only one-party consent (see Nev. Rev. Stat. § 200.650), the Nevada Supreme Court has interpreted the statute as requiring all-party consent. See Lane v. Allstate Ins. Co., 969 P.2d 938 (Nev. 1998). Conversely, although the relevant statute in Michigan looks like an all-party consent statute, it is unclear if a participant must receive the consent of all other participants before recording the conversation. Compare Mich. Comp. Laws § 750.539c, with Sullivan v. Gray, 324 N.W.2d 58 (Mich. App. 1982) (finding applicable statute does not prohibit party to telephone conversation from tape recording conversation absent consent of all other participants).
[5] See, e.g., New Hampshire v. Locke, 761 A.2d 376 (N.H. 1999) (holding that party effectively consented to recording when circumstances demonstrated party knew the communication was being recorded); Conn. Gen. Stat. § 52-570d (noting requisite consent is present when (1) prior written consent is given, (2) the participants continue with the conversation after being verbally notified of the recording at the conversation’s outset, or (3) the recording is made using a device that emits an audible tone at 15-second intervals while the device is recording); Wash. Rev. Code §§ 9.73.030 (requiring prior consent of all conversation participants before any party can legally record any private conversation).
[6] 137 P.3d 914 (Cal. 2006).
[7] Id. at 917.
[8] See, e.g., Pearlstein v. Blackberry Ltd., 2019 WL 2281280, at *2 (S.D.N.Y. May 29, 2019); Narayanan v. Sutherland Global Holdings, Inc., 285 F. Supp. 3d 604, 611-12 (W.D.N.Y. 2018).
[9] See, e.g., United States v. Stewart, 287 F. Supp. 2d 461, 464 (S.D.N.Y. 2003); Wertenbaker v. Winn, 30 Va. Cir. 327, 330 (Va. Cir. Ct. 1993).
[10] See, e.g., Fed. R. Evid. 502(b); N.Y. C.P.L.R. § 4503; Cal. Evid. Code §§ 954-55; Fla. Stat. § 90.5021.
[11] See City of Reno v. Reno Police Protective Ass'n, 59 P.3d 1212, 1218 (2002) (holding that a confidential document transmitted via email is protected by the attorney client privilege as long as the requirements of privilege are met); In re Asia Global Crossings, Ltd., 322 B.R. 247, 257 (Bankr. S.D.N.Y. 2005) (establishing a widely used four-factor test for determining whether there is a reasonable expectation of privacy in a privileged communication).
[12] See, e.g., Peralta v. Cendant Corp., 190 F.R.D. 38, 41 (D. Conn. 1999) (relying on Upjohn Co. v. United States, 449 U.S. 383 (1981)).
[13] Ethical issues that may be implicated by the former employee having separate representation in the matter are discussed below.
[14] See Fed. R. Evid. 501.
[15] See id.
[16] See, e.g., ABA Model R. Prof. Conduct 4.2 (1995); Restatement (Third) of the Law Governing Lawyers § 99 cmt. b. (2000) (noting "the rule is universally followed in American jurisdictions").
