Guest Post: By Refusing to Respect Attorney-Client Confidentiality, European Courts Threaten To Undermine Anti-Bribery Enforcement

GAB is pleased to welcome back Frederick Davis, a lawyer in the Paris and New York offices of Debevoise & Plimpton and a Lecturer at Columbia Law School, who contributes the following guest post:

In the fight against transnational bribery and other forms of corporate crime, a key element of some national prosecution agencies’ strategy is to encourage corporations to “self-report” to the government and to cooperate with any subsequent investigation. The United States Department of Justice (DOJ) pioneered this strategy, but other jurisdictions are beginning to adopt it as well. The basic approach is to offer companies both a stick and a carrot: The stick: If corporations do not self-report and are ultimately discovered, they will be prosecuted vigorously. The carrot: A self-reporting, cooperating company can obtain a more favorable settlement, and perhaps avoid prosecution altogether. From a public policy perspective, it is vastly more efficient for prosecutors to work with corporations in the fight against corruption, essentially enlisting them as partners to detect, investigate, and bring to justice the individuals responsible for corruption, than for prosecutors to do all this work themselves.

From the company’s perspective, though, the decision whether to self-report is difficult: By making a first phone call to a prosecutor, the company all but commits to negotiating a settlement and abandons both the chance of non-detection and the (perhaps scant) possibility of a successful defense. At a minimum, starting this process will entail large costs (particularly legal fees), as well as risks, including the risk that prosecutors may discover more matters to be investigated. There is also the problem, already discussed on this blog, of evaluating whether a negotiated outcome in one country will preclude or deter prosecution in another. And at least at the early stages, the company may not even be certain whether a violation has in fact taken place, or how widespread or egregious such violations may have been. For these reasons, when a company’s leaders learn that there may have been violations of anti-bribery or other laws, the company will retain a seasoned legal team to oversee a thorough internal investigation of the facts in order to make a reasoned decision whether, and where, to self-report.

When a company asks lawyers to do this, it is essential that the attorneys’ work be protected by the attorney-client privilege, at least until such time as the company decides to share fruits of the investigation with prosecutors. If a company knew that everything learned or generated by its lawyers in the course of an internal investigation could be subject to seizure or forced disclosure to prosecutors, then companies would face a huge disincentive to start the process of conducting an internal investigation at all, since doing so could simply create a handy road map – and compelling evidence — for the prosecutor. In the United States, although the conduct of such an internal investigation poses a number of possible traps for the unwary, if the investigation is properly managed then the company can generally be assured that no prosecutor will get her hands on the fruits of its lawyers’ work unless and until the company specifically authorizes such disclosure. Matters are more complicated in Europe, however. For example, in-house counsel are generally not considered to be “attorneys” capable of generating a protectable professional privilege. And in some countries, such as France, the client does not necessarily have the power to “waive” the secret professionel (the rough equivalent of the attorney-client privilege) at all. Most notably—and most troublingly—recent court decisions in the UK and Germany have gone even further in making the results of lawyers’ internal investigations discoverable by prosecutors without the company’s consent. These decisions, if not reviewed or curtailed by legislation, will create huge disincentives to self-investigation, and hence to self-reporting. Continue reading

India and Ireland Enact Anticorruption Compliance Program Laws

Legislation just approved in both Ireland and India create a powerful incentive for businesses to establish anticorruption compliance programs.  Both give firms a defense to criminal charges if one of their employees or agents is caught paying a bribe. Section 18 of the Irish Criminal Justice (Corruption Offences) Act 2018 provides that a “body corporate” can avoid liability if it can prove that “it took all reasonable steps and exercised all due diligence to avoid the commission of the offence.”  Under section 9 of India’s Prevention of Corruption (Amendment) Bill 2018, a “commercial organization” escapes liability if it proves it “had in place adequate procedures in compliance of such guidelines as may be prescribed [by the Attorney General] to prevent persons associated with it from undertaking such conduct.”

The compliance provisions differ, as the quoted language shows, in two respects.  India imposes liability on any “commercial organization,” which includes not only corporations but partnerships and business associations “of any kind,” whereas the Irish law is limited to corporations alone.  Second, while the Irish Minister for Justice and Equality has the discretion to issue guidance on what constitutes “all reasonable steps” and “all due diligence” to prevent employee bribery, the Indian Central Government must, “in consultation with the concerned stakeholders . . .  prescribe such guidelines as may be considered necessary which can be put in place for compliance by [commercial] organizations.”

The Indian requirement follows a report of the Indian Law Commission on an earlier version of the bill.  Noting the “immediate and significant impact” the bill would have on corporations, particularly smaller ones, and that both the U.K. Bribery Act and the U.S. Foreign Corrupt Practices Act require law enforcement authorities to issue compliance guidance, the Commission recommended that the liability provision cum compliance defense be effective only once the Central Government published guidance on what was expected of companies wanting to assert a compliance defense.  An earlier post noted the burgeoning literature on compliance programs by governments, international organizations, and commentators alike evidences a broad consensus on what constitutes an effective compliance program.  Hence in practice the requirement shouldn’t lead to any real difference between what will be required under Indian law and what other nations with a compliance law already require.

The Nations with Anticorruption Compliance Laws table shows Ireland and India are now the fourteenth and fifteenth nations to enact legislation creating a defense to a criminal charge for businesses that have a compliance program.  (Readers are asked to submit a comment if I missed any country.)  With the six countries plus Quebec that require certain firms to have a compliance program, and with the United States, which both tempers corporate liability for firms with an “effective” compliance program and requires those winning public contracts of any appreciable size or duration to have one, the number of jurisdictions with some type of compliance program law now stands at 23.

What are the other 163 parties to UNCAC waiting for?  Why aren’t they enlisting their private sector in the fight against corruption?  Do they really think they can win the fight on their own?