Witness interviews and legal holds are among the most sensitive aspects of…
When conducted in compliance with specific formalities, defensive investigation activities carried out by a company’s appointed defence counsel, and their results, are legally privileged. They remain at the exclusive disposal of the company and its defence counsel, who retain full discretion over whether and to what extent findings are disclosed to the authorities.
In the context of defensive investigations, information may be gathered through witness interviews, forensic activities, and electronic data review. To preserve legal privilege, the Italian Code of Criminal Procedure ("ICCP") prescribes specific formalities for conducting interviews, including statutory warnings to interviewees and the drafting of formal minutes. Where forensic and electronic data collection is involved, GDPR compliance must also be ensured. Additionally, the formal appointment by defence counsel of technical (including, IT) consultants is necessary to ensure that their activities fall within the scope of the privileged investigation and to safeguard data integrity.
Italian law establishes certain safeguards with respect to, among others, communications exchanged between the appointed defence counsel and his/her client, providing for a general prohibition on the seizure or compulsory acquisition by the authorities of the latter.
To mitigate the risk that such communications may still be accessed, including inadvertently, e.g. in the course of searches or seizures, by the Authorities -
although they could not ultimately be used against the involved entity at trial – the following could be considered: i) using secure channels for document exchange; ii) including clear disclaimers on communications/documents; iii) copying external counsels on all relevant communications.
Investigation findings should ordinarily be reported to the person who appointed the defence counsel. However, where that individual may be involved in the facts under review, a potential conflict of interest arises. It is therefore advisable to direct findings to a dedicated investigation team identified from the outset, comprising relevant control functions such as Internal Audit and Compliance.
Information flows towards the Supervisory Body (Organismo di Vigilanza) under Decree 231/2001 should also be carefully calibrated to enable it to fulfil its supervisory duties while preserving legal privilege.
Selective disclosure of defensive investigation findings to the authorities is permitted but warrants careful evaluation. Since criminal prosecution is mandatory under Italian law, disclosing even a portion of the findings may trigger broader investigations extending beyond the original scope and exposing the entity to corporate liability under Decree 231/2001 and significant reputational consequences.
Effective preservation of legal privilege in Italian internal investigations depends on the formal appointment of external defence counsel, strict compliance with procedural formalities, careful management of reporting lines and conflicts of interest, and rigorous control over the circulation of privileged information.
Paolo Vespa
Jacopo Nicolaj
