1. JAN-MAR 2014
www.riskandcompliancemagazine.com
RCrisk&
compliance&
Inside this issue:
FEATURE
The evolving role of
the chief risk officer
EXPERT FORUM
Managing your company’s
regulatory exposure
HOT TOPIC
Data privacy in Europe
REPRINTED FROM:
RISK & COMPLIANCE MAGAZINE
JAN-MAR 2014 ISSUE
DATA PRIVACY
IN EUROPE
www.riskandcompliancemagazine.com
Visit the website to request
a free copy of the full e-magazine
Published by Financier Worldwide Ltd
riskandcompliance@financierworldwide.com
© 2014 Financier Worldwide Ltd. All rights reserved.
R E P R I N T
RCrisk&
compliance&
CROSS-BORDER INTERNAL
COMPLIANCE INVESTIGATIONS IN
GERMANY AND LEGAL PRIVILEGE:
BALANCING THE NEEDS
���������������������������������
������������
risk&
complianceRC&
������������������
�������
�������������������������
��������������
������������
���������������������������
���������
���������������������������
������������������
REPRINTED FROM:
RISK & COMPLIANCE MAGAZINE
JUL-SEP 2018 ISSUE
www.riskandcompliancemagazine.com
Visit the website to request
a free copy of the full e-magazine
Published by Financier Worldwide Ltd
riskandcompliance@financierworldwide.com
© 2018 Financier Worldwide Ltd. All rights reserved.

2. 2 www.riskandcompliancemagazine.comRISK & COMPLIANCE Jul-Sep 2018
risk&
complianceRC&
www.riskandcompliancemagazine.com

3. www.riskandcompliancemagazine.com 3RISK & COMPLIANCE Jul-Sep 2018
PERSPECTIVES
PERSPECTIVES
CROSS-BORDER
INTERNAL COMPLIANCE
INVESTIGATIONS IN
GERMANY AND LEGAL
PRIVILEGE: BALANCING
THE NEEDS
BY WOLFGANG SPOERR AND MATHIAS PRIEWER
> HENGELER MUELLER
I
nternal investigations have become firmly
established in continental Europe, or at the very
least in Germany. They are increasingly viewed as
an important element of a company’s best possible
defence. However, even within just one jurisdiction
there are conflicting goals to consider. Legal
requirements have to be balanced in many different
ways. Experience shows that this is possible, as
long as certain basic cornerstones are respected
and, on a more detailed level, the developing best
practice for internal investigations is adhered to.
This challenge becomes much more complex in the
case of cross-border investigations. The fundamental
legal framework for internal investigations differs
vastly between jurisdictions. Even so, with the help
of foresight it is usually possible to balance the
different requirements so that companies do not
reach the point where there is a genuine conflict
between the requirements of different jurisdictions
and a decision needs to be taken.

4. 4 www.riskandcompliancemagazine.comRISK & COMPLIANCE Jul-Sep 2018
MINI-ROUNDTABLE
Legal privilege and internal
investigations in Germany
Internal investigations, along with the
accompanying disclosure of the results of an
investigation to regulatory or criminal enforcement
authorities, have been firmly established in the
US since the 1970s and are now part
and parcel of the local legal culture.
This has only recently been the case
in Germany. For some time, internal
fact-finding in cases of potential
misconduct was a task for the
internal audit department. Voluntary
disclosure of potentially significant
matters under criminal law and active
support for public investigations were
a rare exception. In the aftermath of
corruption scandals among some of
Germany’s largest corporates, the practice saw its
first systematic developments. But the approach has
been viewed with some scepticism. The German
legal tradition understands fact-finding, under
criminal law, to be the sole responsibility of the
state, with prosecutors having full authority over
the matter. Getting private entities involved in the
processes of fact-finding and investigation seems to
run contrary to this principle at first glance. However,
everything has changed. The concerns were never
really legally substantiated and did not serve to
hinder the establishment of accepted best practice
in Germany.
Nonetheless, many legal questions, generally
concerning the design and implementation of
internal investigations, or specifically related to
the disclosure of the results of the investigation to
state authorities, remain unanswered. For example,
the scope of employees’ disclosure obligations
during interviews, data protection aspects regarding
the internal processing of personal data and the
transmission of information to the authorities, and
the evaluation of the admissibility of the evidence
in legal proceedings, are just some examples to be
mentioned here.
Legal privilege is an area of particular controversy
in Germany. Though there has only been a limited
number of decisions handed down by German
courts on this matter, they have created a
“German companies often find themselves
coming into contact with US laws, most
likely due to the fact that the US is the
most important market for the export of
German goods.”
CROSS-BORDER INTERNAL COMPLIANCE INVESTIGATIONS IN...

5. www.riskandcompliancemagazine.com 5RISK & COMPLIANCE Jul-Sep 2018
MINI-ROUNDTABLE
contradictory picture and contributed to intense
legal uncertainty, with even the German Federal
Constitutional Court now being involved in resolving
the matter. In a simplified way, legal privilege is part
of the professional rules of the legal system, and
only indirectly protects against state intervention.
In-house counsels are not even granted privilege.
Whether case-related documents are protected
from confiscation depends on their content
and their possession. For example, confidential
documents that are in the custody of the client are
only protected if they were clearly drafted as part
of the defence in ongoing criminal proceedings.
Even within the safe harbour of a law firm there is
no absolute protection, according to a contested
opinion. Instead, the protection is dependent on the
condition that the documents in question mirror
the particular relationship of trust between the
defendant and its counsel. A search of the law firm’s
(not the criminal defence attorney’s) premises by
investigative authorities is therefore conceivable
and fairly common, despite legal privilege, whereas
it would be quite the exception from a US point
of view. By contrast, German legal privilege does
not contain a waiver doctrine. In the event that the
client happens to disclose individual documents or
information from the protected set of data, there
is no negative impact on the existence of sufficient
protection with regard to the collection of evidence
in connection to other information or documents.
More complex balancing is required in
cross-border investigations
In a global economy, factual circumstances often
have an international aspect to them. Cross-border
investigations are, therefore, the rule rather than
the exception. An additional element comes into
play when there are not only international facts to
be investigated, but the jurisdiction is also spread
across different nations. On top of the already
difficult relationship between legal privilege and
cooperation and disclosure, the different design of
legal privilege among jurisdictions is added into the
mix.
German companies often find themselves coming
into contact with US laws, most likely due to the
fact that the US is the most important market for
the export of German goods. In addition, authorities
like the Securities and Exchange Commission
(SEC) and the Department of Justice (DOJ) do not
see country borders as a barrier to action, but will
instead prosecute criminal behaviour abroad if
there is a jurisdictional nexus. If, in these cases, a
company considers the disclosure of certain findings
in Germany, potential consequences for US-based
administrative or legal proceedings must then be
taken into account. Even successful cooperation
with German investigative authorities may have a
disastrous effect on the US side, and may eventually
turn out to be a pyrrhic victory if the strategy was
purely set out with the German proceedings in mind.
CROSS-BORDER INTERNAL COMPLIANCE INVESTIGATIONS IN...

6. 6 www.riskandcompliancemagazine.comRISK & COMPLIANCE Jul-Sep 2018
PERSPECTIVES
Other states whose jurisdictions might be
affected by the case must also be taken seriously
of course. The UK, for example, has a very different
understanding of legal privilege, especially as it
pertains to internal company investigations.
US legal privilege and cooperation with
German authorities
Unlike in European law, US law comprehensively
protects the relationship between attorney and
client by way of legal privilege. Insofar as the
attorney-client privilege or the work-product
doctrine are applicable, they may also be relied
on by companies. In-house counsel also benefits.
Within the law of evidence and procedural law,
legal privilege functions as a stronghold against
confiscation, as well as statement and disclosure
obligations. When cooperating with American
authorities, this is relevant insofar as both the SEC
enforcement manual and the US Attorney’s Manual,
which is significant for DOJ investigations, stipulate
that cooperation which is seen to be positive is not
tied to the disclosure of privileged information.
The different levels of protection and the
limitations of legal privilege, which are already
entirely different at a very basic level, lead to
disclosure obligations or expectations being
much more extensive here than in the US. Thus
the minimum expectations of German public
prosecutors in acknowledging cooperation efforts
are based on the scope of information they would
be able to obtain in the event of a hypothetical
intervention on the basis of the existing rules on
investigative powers. As a result, disclosure in
Germany should, in principle, also include those
documents that are protected by legal privilege
under US law, but are subject to confiscation under
German law.
This poses a dilemma. German investigative
authorities are not parties to the case mandate. As
potential prosecutors, they are equally potential
opponents of the company. If they are provided with
documents subject to US legal privilege, this might
lead to a loss of protection in the US, based on the
principles of the attorney-client privilege and the
work-product doctrine. Through an unlimited focus
of the cooperative strategy on German standards,
the company could therefore be forced to also
disclose documents in proceedings before US
courts and authorities, which the opponent would
otherwise not gain access to. This is the direct result
of the privilege waiver doctrine, with an unintended
privilege waiver being the nightmare of any lawyer
dealing with internal investigations.
Finding a way out of this dilemma requires finesse,
negotiation skills and foresight. Even at the stage
of planning a cross-border internal compliance
investigation, the risk of waiving US legal privilege
can already be sought to be minimised. An
example of how to achieve this would be to set the
organisational and timely scope of the investigation
in such a way that internal and external legal advice
CROSS-BORDER INTERNAL COMPLIANCE INVESTIGATIONS IN...

7. www.riskandcompliancemagazine.com 7RISK & COMPLIANCE Jul-Sep 2018
PERSPECTIVESXXX
is excluded. This does have
to be openly agreed with
the authorities though.
In general, when
communicating with
German authorities,
it is advisable to
raise awareness
of the particular
circumstances
of a cross-border
investigation early
on. The reasons for
choosing not to disclose
certain information which is
protected under US law must
be clearly articulated. Relevant data
must, therefore, be permanently and
reliably saved. Transparency is key here. There
must never be the impression that arguments such
as the privilege argument are used in a strategic
way to withhold evidence. The end result would
be mistrust, which is very hard to get rid of again.
The stance taken by the German authorities is
very similar to the US authorities’ attitude toward
European companies in cases where they rely on
European or other local data protection laws.
Only where practical approaches are not sufficient
to exclude or mitigate the conflicts in an individual
case, does the dilemma need to be cleared through
a careful weighing-up exercise. The only remaining
option
is to
compare
and balance
the risks resulting
from, for example, US
and German law. The core question is one of risk
assessment, including the probability of an adverse
event and its impact: is it worse to limit cooperation
with the authorities on the German side or to face
the likely consequences for proceedings on the US
side? A risk assessment of this type entails more
than comparing the impending moderate fines in
Germany with the impending horrendous liability
payments and penalties in the US. The effects on
the company’s public perception must also be
considered. A good rapport with the investigative
CROSS-BORDER INTERNAL COMPLIANCE INVESTIGATIONS IN...

8. 8 www.riskandcompliancemagazine.comRISK & COMPLIANCE Jul-Sep 2018
PERSPECTIVES
authorities can reinstate lost trust and limit the
reputational damage caused by the investigation.
In any case, the result of the balancing, depending
on the design and intensity of the relationship
thus far, may vary: the deliberate non-disclosure of
documents will usually not be that severe from the
point of view of the authorities if it is preceded by
months of successful cooperation. If, however, the
decision for non-disclosure is already made early
on in the cooperation or later on without a clear
rationale and transparent scope, the cooperation
may be permanently damaged.
Outlook: regulations in the future
corporate criminal law of Germany
Internal compliance investigations will gain
new momentum with the future corporate
criminal law, which the ruling parties of the new
German federal government have agreed upon.
It envisages legal requirements and incentives
for internal investigations and disclosure of the
resulting findings. This is to be combined with a
drastic increase in company fines, up to 10 percent
of turnover per offence. Private business is not
overjoyed about this. Instead, it leads to legal
uncertainty across all industry sectors. There is a
fear that this will de facto lead to an obligation to
cooperate with the authorities. While companies
currently, more or less, have a choice of whether
they want to use the findings from an internal
investigation for compliance purposes or whether
to pass them on to investigative authorities, the
new rules could lead to disclosure being the only
option. The statement that cooperative efforts will
be viewed positively, after all (at least semantically)
is not that far from the threat, that a refusal would
have negative effects. It is already clear that, in line
with the political intent of the federal government,
the disclosure of findings from internal compliance
investigations will become more important and
most likely a more regular occurrence too. Alongside
this, the need for legal advice on cooperation
with investigative authorities and the need for
internal investigations will increase. Sound strategic
legal advice will also increasingly be required by
companies across all sectors. RC&
CROSS-BORDER INTERNAL COMPLIANCE INVESTIGATIONS IN...
Wolfgang Spoerr
Partner
Hengeler Mueller
T: +49 (0)30 203 74 159
E: wolfgang.spoerr@hengeler.com
Mathias Priewer
Associate
Hengeler Mueller
T: +49 (0)30 203 74 248
E: mathias.priewer@hengeler.com