Maintaining Attorney-Client Privilege and Work Product Protections over Forensic Reports in Light of 'Wengui v. Clark Hill'

On Jan. 12, 2021, a U.S. district judge for the District of Columbia issued an opinion in Wengui v. Clark Hill, PLC, 440 F. Supp. 3d 30, 33-34 (D.D.C. 2020), granting the plaintiff's motion to compel production of a data breach forensic report and other materials prepared by a third-party forensic consultant. The court ordered production of the forensic report even though the consultant was operating under the direction and control of outside counsel and under an agreement entered into after the discovery of the underlying data breach. The court found that Clark Hill had not established that the forensic report was protected from production by either the attorney-client privilege or work product doctrine, noting that Clark Hill's understanding of the incident seemed to be based solely on the forensic consultant investigation, which would have occurred in the ordinary course of business, and Clark Hill's purpose in hiring the forensic consultant was to obtain cybersecurity expertise, not legal advice.