Internal Investigations and the Global Enterprise: …...Many foreign companies operating in the PRC are required to collaborate with local partners, exposing proprietary data to misappropriation

© 2017 Kobre & Kim LLP kobrekim.com

New York London Hong Kong Seoul Washington DC San Francisco Miami Cayman Islands British Virgin Islands

NAPABA ConventionInternational Law Symposium

November 2, 2017

Internal Investigations and the Global Enterprise: Cross-Border Information Gathering in Asia and Elsewhere


Panelists

• Partner• Ropes & Gray

• Executive V.P., General Counsel and Secretary

• InterDigital, Inc.

• Partner• Kobre & Kim

LLP

• Partner• Munger,

Tolles & Olson LLP

• SVP, General Counsel and Secretary

• Entegris, Inc.

Chong Park Jannie Lau Michael Ng Miriam Kim Sue Lee


I. Managing Confidential Information Across the Global Enterprise

II. Conducting Cross-Border Internal Investigations

III. Challenges to Conducting Cross-border Investigations

IV. The Laws Governing Internal Investigations in Asia and Beyond

Agenda






Agenda


• Threats to Confidential Information Data security threats – attacks and accidental loss Employee mobility Joint ventures and other commercial partnerships Proposed acquisitions and other transactions under NDA

• Challenges to Protecting Confidential Information Cultural differences and varying business norms Legal challenges Human error

• Managing Confidential Information – Best Practices Onboarding and offboarding Inventorying and categorizing trade secrets Training and reinforcement Limiting access

• Setting up a Response Plan

Managing Confidential Information Across the Global Enterprise


• Data Security Breach: Malicious Hack or Human / System Error Concerted hacking/social engineering attempts Insufficient IT security

• Employee Mobility Data theft and/or misappropriation for personal use or to bring to a competitor Numerous mobile and wireless devices facilitate easy exchange of data. Employees with extensive cross-border travel can pose risks.

• Exchange of Information under Non-Disclosure Agreements: M&A, Joint Ventures, Strategic Investments, etc. Often unpopular with venture capital funders and thus unpopular with start-ups

and companies seeking investment Sparse enforcement of patent and intellectual property laws in many countries Many foreign companies operating in the PRC are required to collaborate with

local partners, exposing proprietary data to misappropriation.

Threats to Confidential Information


• Differing Cultural Outlooks on Employee Surveillance Non-U.S. jurisdictions impose more restrictions on internal investigative

techniques. Covert video surveillance is typically prohibited. E-mail & data – monitoring restricted by data privacy laws

E.U. – limit monitoring to work-related (not personal) files China – protect employees’ personal data against disclosure Latin America – monitoring corporate e-mail and devices permitted if notice is

given to employees

• Legal Challenges Attorney Ethics – M.R. 8.4(c) prohibits attorneys from engaging in conduct that

involves dishonesty, fraud, deceit, or misrepresentation. Civil Trespass – Investigators who use misrepresentations to gain access to an

employee’s real property may be liable for civil trespass. Do not use a pretext to obtain legally-protected information (e.g., financial or

telephone records).

Challenges to Protecting Confidential Information


• Determining the Reason and Necessity Legitimate business reason (e.g., investigating possible misconduct) Does not violate an employee’s reasonable expectation of privacy in that context Balancing Act: “Intrusion Upon Seclusion” Tort (U.S. concept)

• Reasonable Expectation of Privacy in Physical Searches Workplace bathrooms, locker rooms, locked desks Personal purses, briefcases, other personal containers

• Best Practices Limit the Scope of the Search – only areas where the sought item could reasonably

be found (e.g., don’t search for a laptop in a handbag) Obtain Consent – written consent from the employee is ideal Adopt Clear Search Policies – put employees on notice of what areas and things

will be searched

Managing Confidential Information – Best Practices


Managing Confidential Information – Best Practices

Types and Limitations of Monitoring Reviewing e-mail and texts Video surveillance Exceptions:

Consent – Monitoring is permitted if one of the parties to the communication gives consent (express or implied).

Business Use – Monitoring is permitted in the ordinary course of business, with the use of standard equipment, for a business-related purpose (e.g. to detect improper uses, theft, quality checks, or training).

Best Practices Internal policies Personal e-mail accounts

generally should not be searched.

Superstitiously recording phone conversations raises complex Wiretap Act issues in the U.S.






Agenda


• First step in formulating a response plan

• Limit contamination and mitigate harm

• Respond to government inquiries

• Demonstrate corrective measures Discipline Training and Communication Policies, procedures, and controls Disclosures

Why Are Internal Investigations Important?


Key Steps in an Internal Investigation

Opening the Investigation

Preserving Documents and Other Relevant Information

Defining the Investigation’s Scope and Procedures

Collecting and Reviewing Documents

Conducting Witness Interviews

Drawing Conclusions and Making Recommendations

Closing the Investigation


• Key Objectives Determine what happened Refresh witness recollection Establish credibility of internal investigation

• Factors to Consider Number of custodians and data sources Appropriate timeframes Appropriate search terms Internal technical capacity Creative review options Litigation Hold Notice Methods for collecting data (e.g., email servers, share drives, local drives, instant

messages, copiers and faxes)

Document / Data Collection and Review


• Key Objectives Determine what happened Lock in statements and preserve credibility Establish credibility of internal investigation Protect privilege and work-product protection Minimize negative collateral consequences

• General Interview Principles Explain purpose of interview Warn penalties for lying, including possible termination Begin with basic, less contentious issues Do not unnecessarily convey information to the witness Do not ask leading questions Explain confidentiality – witness must maintain strict confidentiality and you will

too, but on a “Need-to-Know” basis

Witness Interviews


• Purpose

• When to Provide At the beginning of the interview Consider giving a soft Upjohn warning for non-hostile witnesses

• Elements Lawyer for the company Do not represent the witness Interview purpose is to gather facts in order to provide advice to the company Interview is protected by the attorney-client privilege but it belongs solely to the

company Company can elect to waive privilege without the witness’s consent Confidentiality

• Document Warning in Interview Memo

The Upjohn Warning


• Witness’s memory

• Witness’s manner while speaking

• Witness’s interest in the outcome

• Whether evidence contradicts witness

• Reasonableness in light of the evidence

• Any other factors that bear on witness’s veracity

• Recognize potential differences among cultures

Assessing Credibility


• Closing the Interview Advise witness to keep contents of the interview confidential. Tell witness not to discuss interview with anyone, except own attorney or in-house

counsel. Remind witness of document preservation obligations. ALWAYS ask the complaining employee if anything else happened.

• Documenting the Interview Designate one note-taker. Turn interview notes into a formal memorandum. Introductory paragraph should establish that memo is protected by privilege. Memorialize the Upjohn warning and other admonitions. Identify all participants, the location, and the length of the interview.

Closing and Documenting the Interview


• Prepare a report.

• At end must draw conclusions and, if appropriate, recommend corrective action. Can conclude that evidence is inconclusive You are allowed and expected to make credibility decisions, but should have a

basis.

• Remediation plan Take steps to prevent recurrence (procedures and controls). Consider disciplining those responsible (e.g., employees, contractors, providers). Follow-up audits (very important to regulators)

• Consider whether self-reporting is advisable. Local law enforcement? International agencies or regulators?

Closing the Investigation






Agenda


• Issues with Lack of Employee Cooperation Employees may collude to avoid internal controls and even rehearse responses to

interview questions in advance. In some cases, employees have surreptitiously recorded interviews.

• Limits to Compliance and Audit Resources May be limited resources compared to the volume of allegations or adverse

monitoring findings It requires a thoughtful prioritization of investigations as well as a centralized

investigation and remediation process.

• Difficulty in Obtaining Access to Data and Documents In the PRC, employees rarely use company e-mail — texting, Weixin, Weibo, and

other social media are practically the norm. Note that PRC privacy laws require strict written consent before any collection of

employees’ personal devices or e-mail accounts.

Common Challenges with Asia-based Internal Investigations


• It is Difficult to Identify Suitable and Experienced Local Counsel It is often difficult to find local litigators who speak fluent English, have worked

with MNCs, and have experience before the particular overseas regulator. In the PRC, very few are criminal defense lawyers, and only a small subset have

experience working on MNC-related matters.

• Issues with Conducting Witness Interviews in Asia Issues with Upjohn warning, confidentiality, and non-retaliations — what if the

local employers and/or employees do not take these seriously? Cases where witness refuses or deliberately postpones interview while overseas Difficult to follow up with witnesses who say that they will “go back to check later”

• Issues with State Secrets What constitutes a “State Secret?” Who decides what a “State Secret” is?

Common Challenges with Asia-based Internal Investigations


• Risk-Based and Proactive Approach to Anti-Corruption Compliance Written policies and procedures, trainings, regular monitoring and auditing,

constant communications, incentives and awards, risk assessment, acquisition and third-party due diligence, confidential reporting and investigations, commitment from top

Focus especially on middle-level management on the ground.

• Regulators Now Focusing on Company Internal Controls Know your organization, your business, your employees.

• Constantly Review and Update Internal PRC Policies Updates include changes to laws, recent cases, and enforcement trends Important to deliver messages and updates on a regular basis and to implement

“from the board room to the supply room” messages Make handbook on internal policies a “living document” rather than a closed book.

Responding to Authorities and Risk Mitigation


• Tailor Policies to Each Specific Region as Much as Possible Take into account local laws and regional nuances. Adjust policies and procedures to match on-the-ground specifics.

• Implement a Strong Disciplinary and Reward Program Many companies have policies and procedures, but are weak on execution and

remediation (worse than no policies in place).

• Make Trainings as Realistic as Possible Design real-life examples and tailor case-studies to your specific industry as much

as possible.

Responding to Authorities and Risk Mitigation






Agenda


Data Privacy Laws

• What Are They? Laws that protect employees’ personal data (name, identification number, and other

identifiers) 89 countries have adopted comprehensive data privacy regimes, and many have

civil or criminal penalties attached. Unfamiliar concept to U.S. investigators

• Best Practices Obtain prior written consent from

employees as part of hiring process. Adopt internal policy governing use of

personal data. Strictly monitor offshore export of personal

data.

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjb7rLj4KfLAhVMPj4KHRkQAysQjRwIBw&url=http://www.peak10.com/its-data-privacy-day/&bvm=bv.115339255,d.amc&psig=AFQjCNG5xhauJtATiT4rFp3qdJaAqu8DLw&ust=1457205787085989

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjb7rLj4KfLAhVMPj4KHRkQAysQjRwIBw&url=http://www.peak10.com/its-data-privacy-day/&bvm=bv.115339255,d.amc&psig=AFQjCNG5xhauJtATiT4rFp3qdJaAqu8DLw&ust=1457205787085989


PRC State Secrets Law

• What Is It? Chinese law that prohibits unauthorized export of China State Secrets Law broadly defines “State Secrets” to include documents related to 7 critical areas /

industries deemed to be important to national interests (largely a catch-all phrase) Presents significant challenges for MNCs investigating their China operations

• Best Practices Proactively manage data storage from

inception (“know your data”). Use screens to monitor for data export. Implement organization-wide trainings. Create strong relationships with

experienced local counsel and vendors with capable data hosting services.

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjwksrw36fLAhWJcD4KHXuDBZMQjRwIBw&url=http://www.acslaw.org/acsblog/node/13329&bvm=bv.115339255,d.amc&psig=AFQjCNFzX0sDhUTd1B9qiPlZFmVkSww2yw&ust=1457205555906236

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjwksrw36fLAhWJcD4KHXuDBZMQjRwIBw&url=http://www.acslaw.org/acsblog/node/13329&bvm=bv.115339255,d.amc&psig=AFQjCNFzX0sDhUTd1B9qiPlZFmVkSww2yw&ust=1457205555906236

ATTORNEY-CLIENT PRIVILEGERECOGNITION OF

IN-HOUSE COUNSEL A/C PRIVILEGE

SELF-INCRIMINATION MLAT/MOU

Hong Kong • Legal Professional Privilege (“LPP”) available as constitutional right and common law

• Similar to U.S. and commonlaw countries

• Legal privilege applies to in-house counsel providedlawyer is acting in her capacity as a lawyer and advice is related to legalmatters

• Privilege is a constitutional and common law right

• SFC self-incriminating answers inadmissible in criminal proceedings

• DOJ: MLAT in CriminalMatters

• SEC/CFTC – Securities and FuturesCommission:

• IOSCOsignatory

• Bilateral MOU reEnforcement Cooperation

China • No concept ofattorney-client privilegeexists

• Duly licensed PRC andforeign lawyers required to maintain confidentiality

• No in-house counselprotection

• Courts consider in-house counsel to be a business employee and not a lawyer

• No concept of privilegeagainst self-incrimination


• SEC/CFTC – China Securities RegulatoryCommission:

• IOSCOsignatory

• Bilateral MOU reTechnical Assistance

Taiwan • No concept ofattorney-client privilegeexists

• Duly licensed PRC andforeign lawyers required to maintain confidentiality

• No in-house counselprotection

• Courts consider in-house counsel to be a business employee and not a lawyer

• No concept of privilegeagainst self-incrimination


• SEC/CFTC – China Securities RegulatoryCommission:

• IOSCOsignatory

• Bilateral MOU reTechnical Assistance

SouthKorea • No concept ofattorney-client privilegeexists

• Lawyer’s general obligationto maintain secrecy of clientinformation

• Duty of secrecy applies toin-housecounsel

• Constitutional right against self-incrimination

• No regulatory protectionif responding to SFC inquiry


• SEC/CFTC – Financial Services Commission:

o IOSCO signatory

Singapore • Legal privilege analogous to the U.S. and other commonlaw countries

• Extend legal adviceprivilege to include third-party communications

• Legal privilege appliestoin-house counsel if advice is related to legalmatters

• Privilege also extendsto foreignlawyers

• Limited privilege including heavily qualified right to silence

• Disclosures to SFA may notbe used in criminal proceedings

• DOJ: N/A

• SEC/CFTC – Monetary Authority ofSingapore:

o IOSCOsignatory

o Bilateral MOU reEnforcement Cooperation

Continues on other side

Hazards of Cross-Border Internal Investigations: A Regional Comparison

KOBREKIM.COM 1

This content provides information on legal issues and developments of interest to our clients and friends and should not be construed as legal advice on any matter, specific facts, or circumstances. The distribution of our content is not intended to create, and receipt of them does not constitute, an attorney-client relationship.

© 2016 Kobre & Kim LLP. Attorney Advertising. Prior results do not guarantee a similar outcome.

2

ATTORNEY-CLIENT PRIVILEGERECOGNITION OF

IN-HOUSE COUNSEL A/C PRIVILEGE

SELF-INCRIMINATION MLAT/MOU

India • Legal privilege similar totheU.S. and other commonlaw countries

• Limited privilege applies to in-house counsel who isnot deemed to be a “full-timesalaried employee” undertheBar Council of IndiaRules

• Privilege recognized although limited protection on self-incriminating oral or written statements of personal knowledge


• SEC/CFTC – Securities and Exchange Board ofIndia:

o IOSCOsignatory

o Bilateral MOU reTechnical Assistance

Malaysia • Legal privilege based onIndian privilege laws and similar to other common law countries

• No protection as in-house counsel cannot be apracticing advocate orsolicitor

• Privilege is recognizedbut limited at trial

• Witness must answeralthough cannot be utilized in future criminalproceeding


• SEC/CFTC – Securities Commission:

• IOSCOsignatory

Japan • No concept ofattorney-client privilegeexists

• Lawyers admitted in Japan (Bengoshi) and registered foreign business lawyers (Gaikokuho Jimu Bengoshi) must maintainconfidentiality

• In-house counsel is entitled to same confidentialityprotections if they possess Bengoshi or Gaikokuho Jimu Bengoshi status

• Both civil and criminal procedure codes providea witness with right to refuse to testify on potential self-incriminatingmatters


• SEC/CFTC – Financial Services Agency:

• IOSCOsignatory


Australia • Legal privilege analogous to the U.S. and other commonlaw countries

• Legal privilege applies to in-house counsel providedlawyer is acting in her capacity as a lawyer and advice is related to legalmatters

• Privilege protects against being compelled to produce incriminating documents or information

• Does not extendto corporations


• SEC/CFTC – Australian Securities and InvestmentsCommission:

• IOSCOsignatory
