The Massachusetts Supreme Judicial Court Clarifies the Contours of the Attorney-Client Privilege and Work Product Doctrine in Internal Investigations

April 1, 2021 Published Works

In Attorney General v. Facebook, Inc., No. SJC-12496 (March 24, 2021),[i] the Massachusetts Supreme Judicial Court clarified the scope of protection afforded by the attorney-client privilege and the work product doctrine to internal investigations. At issue was the Massachusetts Attorney General’s request to obtain documents Facebook collected and created during its expansive internal investigation in the wake of the 2018 Cambridge Analytica scandal.

The case concerned the AG’s third civil investigative demand; Facebook had produced documents in response to the first two. The AG’s third demand contained a group of requests seeking the names of the apps that Facebook decided to review during its investigation, as well as information about those apps. The third demand also included a request for the internal communications and internal correspondence concerning certain categories of apps and/or apps for which Facebook conducted specific reviews or investigations.

Facebook claimed that its investigation had been "designed, managed, and overseen" by its inside and outside counsel, and that these attorneys "devised and tailored the [investigation’s] methods, protocols, and strategies to address the specific risks posed by these legal challenges." It refused to turn over the documents responsive to the contested requests claiming that the documents were protected from disclosure by the attorney-client privilege and the work product doctrine.

The Attorney-Client Privilege.

In its ruling, the Court reiterated that "[a] construction of the attorney-client privilege that would leave internal investigations wide open to third-party invasion would effectively penalize an institution for attempting to conform its operations to legal requirements by seeking the advice of knowledgeable and informed counsel." It highlighted the distinction between attorney-client communications, which are protected by the privilege, and the underlying facts, which are not if they are available from another source. The Court noted that the first contested group of the AG’s requests asked only for the factual information that Facebook collected, which did not require disclosing communications between Facebook and its attorneys. These requests therefore did not implicate the attorney-client privilege. The Court found persuasive that the AG had agreed that Facebook could produce the information requested “in a spreadsheet format” in lieu of producing responsive documents themselves.

The Court took a different course with the last contested request, which asked for Facebook’s “internal communications” about the apps. The Court said that any confidential communications between or among Facebook, its outside counsel, and other members of the investigatory team during the investigation would almost certainly be privileged, and directed Facebook to prepare a detailed privilege log. The Court also reiterated the bedrock principle that Facebook could not be compelled to answer the question, “What did you say or write to the attorney?”

The Work Product Doctrine.

Although the work product doctrine shields from discovery documents prepared “in anticipation of litigation,” the Court made clear that: (1) there does not need to be any litigation pending when the document was created so long as it was prepared with “the prospect of litigation in mind”; and (2) the threat of litigation does not need to be the only, or even primary, motivation for creating the document for it to be protected– although it must be a necessary reason.

Applying these principles, the Court found that the app information Facebook compiled during its internal investigation was clearly work product. Importantly for in-house counsel, the Court carefully distinguished between Facebook’s internal app investigation, which was focused on past violations, and Facebook’s business-as-usual compliance program aimed at improving its ongoing operations. The Court highlighted that Facebook’s compliance team could and would not have conducted the large-scale investigation into app-developer misconduct in the ordinary course of its business.

The more difficult question was whether the app information was “fact” work product or “opinion” work product, a line the Court recognized is sometimes not clear. The distinction is important because the latter is rarely discoverable, whereas the former may be discoverable if the party seeking the information demonstrates a “substantial need” for the information and “undue hardship” in obtaining it through other methods.

The specific facts here are important and informative. In response to negative publicity about the scandal, Facebook had made multiple public statements about the existence and progress of its internal investigation. And, in response to earlier demands from the AG, Facebook had told the AG the criteria that it used to identify apps during each phase of its investigation. In fact, the contested requests in the AG’s third demand closely tracked the language that Facebook had used during this explanation. With this background in mind, the Court focused its opinion-or-fact work product analysis on whether the AG’s requests would reveal any confidential information about Facebook’s investigation that was not previously disclosed.

Noting that the first group of contested requests allowed Facebook to remove any attorney impressions, and reflected information touched upon in Facebook’s public statements, the Court was skeptical about whether producing the app information requested would reveal opinion work product. However, the Court acknowledged the possibility that at least two of the AG’s requests might reveal counsel’s previously undisclosed thought processes and remanded the case to the trial court for a “document-by-document work product review.”

Any documents later identified by the trial court as “fact” work product would need to be produced, the Court said, because the AG demonstrated a substantial need and undue hardship. The Court reasoned that the AG is statutorily obligated to protect Massachusetts consumers; that there is a strong public interest in disclosure when the AG is investigating potentially unfair or deceptive trade practices involving Massachusetts consumers that is absent in a typical civil dispute; and that the AG would be unable to otherwise obtain this relevant factual information (or its substantial equivalent) absent Facebook’s disclosure. Importantly, the Court observed that “[t]his is not a case where the internal investigation involved simply interviewing key employees and other witnesses or reviewing a manageable number of documents.”

Lessons Learned.

At least three lessons that may be gleaned from the Facebook decision concerning applicability of the attorney-client privilege and the work product doctrine to internal investigations:

  1. The attorney-client privilege protects communications between an attorney and client, and not the underlying facts, even when those facts are contained in such communications. Even if information collected in the ordinary course of business is relayed to counsel through confidential communications, the facts themselves are generally not shielded from disclosure. However, factual information communicated to counsel for the purpose of obtaining legal advice, or in response to counsel’s request for information sought to assist counsel in providing legal advice to management, will likely be protected by the attorney-client privilege if no previously existing documents created in the ordinary course contain this factual information.
  2. The decision distinguished between retrospective investigations conducted with the “prospect of litigation in mind,” and investigations conducted in the ordinary course to improve ongoing or future operations. Although the prospect of litigation need not be the sole or even the primary purpose of an investigation, it is essential that it be at least one of the purposes of the investigation. Thus, simply funneling an organization's investigation through counsel does not bring with it the protection of the work product doctrine if the organization would have conducted the activities irrespective of anticipated litigation.
  3. While organizations often want to issue public statements to assure the public and/or stakeholders that the organization is investigating an allegation or an acknowledged problem, even carefully drafted, general statements about an internal investigation may jeopardize protection of attorney opinion work product that would otherwise be protected. The Court reasoned that “publicized general statements regarding [an investigation] . . . reduc[es] the risk that disclosure of [the information] will reveal confidential opinion work product.” It concluded, “a corporate defendant cannot publicize its ‘internal investigation to assert the propriety of its actions to third parties and simultaneously . . . block third parties from testing whether its representations about the internal investigation are accurate.’"

While the Facebook decision is based on Massachusetts law, given its importance and the number of non-Massachusetts decisions on which it relies, in-house counsel, in any state, would be wise to review it carefully.


[i] The authors of this alert had the privilege of filing an amicus brief in the Facebook case on behalf of the Association of Corporate Counsel.