15 November 2022 | By Marten Männis
Legal Privilege
Legal privilege and the DPO role for in-house counsel – incompatible or unavoidable?
On 21 October 2022, the General Council of the Portuguese Bar Association, in conjunction with the IAEA (the Institute of Corporate Lawyers and Associations) and ECLA, held a conference on the Challenges of Corporate Law. The conference had two dedicated panel discussions – the first on professional secrecy rules and company lawyers, held by Pedro Raposo, Founding Partner of PRA – Raposo, Sá Miranda e Associados, and Marcus M. Schmitt, General Manager of ECLA. The second discussion, on DPOs and their role and influence, was held by Tiago Félix da Costa, Lawyer, Head of Criminal, Compliance and Data Protection at MLGTS and David Ribbing, General Counsel at Mangold. The opening speeches were given by Jonathan Marsh, President of ECLA, and Duarte Nuno Correia, Member of the General Council of the Portuguese Bar Association. The article here does not attempt to express the discussion verbatim, but rather expand the points raised and continue the necessary dialogue on a European level.
On Legal Professional Privilege
Legal professional privilege (LPP) has strategic value in the promotion and protection of the rule of law in the EU. Ensuring that LPP is respected by relevant national authorities is a fundamental necessity and a critical element for a fair judicial system. In short, LPP allows clients to solicit legal advice in full confidence without fear of persecution for soliciting advice. On the EU level, the borders of what falls under LPP are well established, through case law, the European Charter of Fundamental Rights, and the European Convention on Human Rights. However, after seeing the effects of the judicial decisions on companies a decade later, especially in comparison to other key markets such as the US, the EU needs to reform certain aspects of LPP and harmonise the rules for the benefit of the Internal Market.
Most EU Member States and OECD countries have extended LPP to in-house counsel, however significant exceptions persist in Europe such as France and Italy. Companies whose legal departments operate under such regimes are at risk of having in-house legal advice be seized by foreign judicial authorities in criminal proceedings or by other foreign civil components in discovery phases of proceedings. This can compel companies to disclose sensitive business information and legal strategy, resulting in negative legal, financial, and reputational consequences for the company and the EU.
The limitation of LPP outside of in-house counsel also fundamentally changes the in-house legal profession in different jurisdictions, as companies will rely on outside legal advice, to the detriment of a higher financial burden and reduced efficiency of their legal functioning. In addition, there has also been a rising trend for multinational companies to move their legal departments to a more favourable jurisdiction within the EU.
Nevertheless, there are positive developments one can point to over the last decade across Europe. Spain, in 2021, introduced passages on the scope of the in-house lawyer profession. Switzerland currently is in the process of introducing LPP for company lawyers through the revision of the Code of Civil Procedure. The Gauvin Report called for the extension of LPP to in-house counsel in French companies.
This support has typically been opposed by regulatory authorities and members of the relevant bar associations, usually smaller private practitioners, who are concerned with the growing strength of the in-house legal profession. Whereas the latter is an opposition based on business interests, the regulatory opposition shows a fundamental misunderstanding of how LPP works in practice and how other OECD countries, that do extend LPP to in-house counsel, apply it. There seems to be a general assumption among opponents that extending LPP to company lawyers will lead to a “black box” type instances where companies will be able to hide whatever materials they deem necessary from authorities. However, until now, countries with LPP for in-house counsel have not seen any such instances occur, nor do they see any legitimate opposition towards amending the current rules. For example, the French Competition Authority recently issued a draft guidance on competition law compliance programs. When released for comments, both the American Bar Association and the OECD specifically expressed concern over the French approach to LPP and how that adversely affects compliance programs in companies. This leads one to conclude that the opposition is purely out of fear that the authorities will have limited access to sensitive information that they should not be privy to in the first place, i.e., their jobs will be harder.
The position of Jonathan Marsh and Marcus M. Schmitt of ECLA in this regard is clear – extending LPP is not a matter of “if”, but “when”. Legal departments that are closely embedded to the business have a far higher likelihood to identify and rectify, either internally or in cooperation with external counsel, legal issues relevant for the continued success and well-being of the company. Furthermore, this would allow, in the times of the ongoing technological revolution, for in-house counsel to naturally define their roles and evolve within the business. On the EU level, it would ensure legal clarity for international businesses and ensure a level playing field within the EU. Currently ECLA sees an ideal moment to continue this dialogue, both on a national level and on a European level, with the goal being the extension of LPP in EU competition law matters and in all national jurisdictions in the EU.
The current regime in certain countries such as France and Italy also significantly hinder the job mobility and opportunities that lawyers have. Putting aside the fact that the job mobility within a national legal sector is already restrictive, pursuant to all jurisdictions having their own legal regime with specific case law and procedures, countries such as France and Italy also restrict in-house lawyers from being members of the relevant bar associations. This means that an attorney in France, who decides to work in a legal department, must leave the bar association and apply for re-entry if they were to wish to work again in a law firm. This creates an artificial barrier between both legal professions that is completely unnecessary.
Other countries, such as Germany, have an in-between option – though the in-house counsel profession is recognised as a separate legal profession, with its own title, the scope of LPP that is bestowed on them differs, most notably in criminal investigations, where no professional secrecy rules have been extended. Company lawyers can only be registered to the relevant bar association if most of their job (up for interpretation, but estimations have been given amounting to two-thirds) concerns giving legal advice. Another example is the regime in Belgium, which has its own regulatory body and title for in-house lawyers, requiring members to uphold their own code of conduct. However, both options still divide the legal profession in a way that restricts job mobility and does not reflect on the similarity of the positions that both in-house counsel and external counsel undertake.
As the legal profession is an ancient profession, its framework naturally has not accounted for the rise of businesses over the last century and for the increasing necessity for lawyers to closely advise companies. The solutions, such as the Belgian one, introduced in 2000, or the German one in 2016, or the Spanish one last year, should not be seen as a final step but rather a path towards the goal – the complete unification of the in-house and outside counsel professions. The solution works as intended in common law countries with lawyers having expanded freedom regarding their career options and businesses having a more streamlined procedure in soliciting legal advice.
The requirement put forth by the German legislation is peculiar – in that it puts a higher burden on a company lawyer than on an equivalent attorney working at a law firm. On the one hand, as Pedro Raposo exemplified – 100% of his work towards their clients encompasses legal advice, he does not communicate with his clients for other purposes. On the other hand, an attorney at a different law firm could also be responsible for soliciting new clients, holding internal or external training sessions or performing administrative work. This in turn could potentially see the proportion of work in which they give legal advice be well under 60%.
The Belgian solution has also come in conflict with the EU Whistleblower Directive, in that the French translation of the legislation as to who is considered a lawyer does not include the specific Belgian terminology for company lawyers – juriste d’entreprise. This in turn has again put the whole profession and LPP for the profession under unfair scrutiny.
The main argument for the general opposition of extending LPP to in-house counsel originates from EU case law in AM&S v Commission and Akzo Nobel Chemicals and Akcros Chemicals v Commission – whereby company lawyers do not have the necessary independence, given that they are bound to an employment contract with their “client”. Because of said employment contract, company lawyers are, in the view of the court and the authorities, unable to operate in an objective manner towards their client. In contrast, because an outside counsel works on behalf of their law firm, they have more freedom to stay objective in giving legal advice.
It is surprising that such a legal opinion was given by the highest court in the EU. This rationale has several misconceptions about the legal profession and the legal industry. Though one can write a whole book about the independence of the in-house legal profession[1], the argument by the Court places in-house lawyers as mindless operatives within the business, with the inability to say “no” to their employer, giving only good news to the business and not focusing on risk minimisation and giving high-quality and neutral legal advice that understands the business needs.
Furthermore, law firms of all sizes heavily depend on recurring revenue from key clients. For smaller firms, the loss of one major client can result in insolvency. Large and multinational law firms adhere to the Pareto principle, whereby roughly 80% of the revenue comes from 20% of the clients. What would happen if one of the clients in that 20% would start considering moving their business to a competitor? Would the law firm and its actors still be seen as functionally independent, given that they have no employment contract, even though they are on the verge of losing a significant source of revenue and, on an individual level, significant amounts of equity and bonuses?
Currently, the European continent has roughly 1,000,000 lawyers, with 150,000 of them being company lawyers. Though the number of lawyers overall has been stagnating in recent years, the number of company lawyers has been steadily increasing. This can anecdotally be reflected by the individual feedback of lawyers in the ECLA network who have worked both in-house and as attorneys, where there is a near unanimous preference of working in-house over working at a law firm.
Furthermore, legal departments have been steadily increasing over the last few decades, with the number of company lawyers working for a business increasing with it. Over the last 15 years, there has been a 165% increase of company lawyers and there are no signs of the growth slowing down. On the contrary – the growing complexity of businesses and the increasing challenges derived from globalisation and cross-border transactions increase the need for specialists that work closely with businesses.
It should be highlighted that the goal is not for LPP to cover all business advice, but to cover legal advice specifically, which often includes sensitive information about the business that a company would not want to disclose publicly. However, the legal profession as a whole should be wary of attacks on LPP, as exemplified in the Jones Day/Volkswagen cases. Though the argument for which LPP did not apply was on technical grounds, insofar that the law firm had only been hired for internal investigations rather than for representation purposes in criminal proceedings, and that the premises of the law firm were searched, rather than the company, this precedence could potentially be extended in the future for the detriment of the legal profession in Germany.
On the Data Protection Officer role
Most businesses must appoint a Data Protection Officer (DPO) under Article 37(2) of the GDPR, whereby the controller and a processor must designate a DPO if the core activities consist of data processing operations that, by virtue of their nature, scope and/or purposes, require regular and systematic monitoring of data subjects on a large scale. The DPO must be a qualified expert, pursuant to Article 37(5) GDPR, who is allowed to perform their duties under an employment contract. The tasks are established under Article 39 GDPR. In short, they must advise their business of its obligations under relevant data protection rules, monitor data protection compliance, give advice concerning a data protection impact assessment, established under Article 35 GDPR, and to act as a point of contact for the relevant supervisory authorities, cooperating with them as necessary.
There currently is no clear understanding of who can act as a DPO. Can a general counsel moonlight as a DPO, provided they have the relevant knowledge, even though they belong to the management board? Would a general counsel who also operates as a DPO be considered independent in France? The DPO must be completely independent and cannot be dismissed for making recommendations contrary to the management’s preferences. However, EU case law has established that in-house lawyers by their nature are unable to function independently. Would such a French lawyer have confidentiality rights regarding their role as DPO?
Currently, the compromise solution seems to be, when appointing a managing lawyer as a DPO, to take special care to ensure that conflicts of interests are avoided or dealt with appropriately. For example, if pure legal advice is required, the DPO should refer the matter to others within the legal departments.
Both David Ribbing and Tiago Félix da Costa agree with this sentiment. Though there was a period where Mr. Ribbing operated both as a General Counsel and as a DPO, the company realised that, being a financial institute, it would not be a good fit if a lawyer on the management team also acted as the key person on data compliance. Given that their compliance department already is completely independent from other business units, they concluded that placing the DPO within this department would be beneficial for the long-term health of the company.
However, as the DPO position is rather new and up for interpretation by companies to a certain extent, the effectiveness of the role thus rests strongly on the positions of the management regarding data processing. If a company is inherently indifferent towards the safekeeping of data, then the DPO cannot play an effective and positive role for the business.
Furthermore, there is an overarching question, whether lawyers overall should and can act as DPOs in companies and if so, what are the conditions they must fulfil. The primary concern entails a potential conflict of interest, specifically concerning the obligations and duties that the DPO must fulfil. An example would be a lawyer who also works as the DPO, who would have to both inform the relevant authorities and the management board of any potential gaps in data compliance, while simultaneously working to resolve the business risks arising from it. Given that compliance has, over the last few decades, become a business area of its own, it makes more sense to follow companies such as Mangold and fit the DPO within that structure, as their tasks and obligations are much more aligned than they would be if the DPO would operate within the legal department.
Another example of a clash in opinions between a DPO and a General Counsel arises in cases of international transfer of data, specifically the transfer of personal data with non-EU/EEA countries, where companies could have a legitimate interest or legal ground to either export or import personal data with a Third country. This issue specifically arises with today’s technology, where most technological innovations arise from the US, making the avoidance of data transfer near impossible. Operating systems for computers, payment processors and much more are mostly created by US-based companies, with no viable European alternatives on the horizon. There have been countless reports since the introduction of the GDPR about how personal data is explicitly transferred outside the EU by companies from Third countries, most notably the US and China. Unfortunately, prohibiting the use of such services and devices would make any European company today obsolete purely due to a lack of alternatives.
Ultimately, the introduction of the GDPR and the DPO has required companies to internally redefine the purpose of their legal teams and their compliance teams. While the latter focuses on ensuring that processes comply with the relevant regulatory and legal requirements, i.e., ensure that the business does not violate any laws, the legal department instead focuses on minimising risk for the business, i.e., ensuring viability and profitability of the company.
[1] Philippe Coen and Pr. Christophe Roquilly (eds), “Company Lawyers: Independent by Design – an ECLA White Paper”. A fantastic read on the acute role that legal departments actually play in corporate environments and how misinformed the CJEU judgments have been on the legal profession.
