The session was chaired by Sverker Bonde (Advokatfirman Delphi, Stockholm) who had invited a distinguished group of panellists to provide insights and strategies for a company in a corporate crisis. Speakers were Ms Song-Yi Son, senior counsel for ABB Korea in Seoul, and Giovanni Lombardi of illimity Bank in Milan as well as the private practitioners Peter Calamari (Quinn Emanuel Urquhart & Sullivan, New York) and Urs HoffmannNowotny (Schellenberg Wittmer, Zurich).
The panel addressed how to balance the necessity of transparent and quick communication to the public against the different perspective required when defending the company against civil claims or dealing with regulatory or criminal inquiries.
The following hypothetical scenario was put to the panellists. Your client, a listed company in the IT sector, is subject to a massive data hacking attack involving the theft of private data of millions of customers. The hackers threaten to sell the data to the highest bidder unless the company pays a substantial sum to the hackers in bitcoins. News reports are being aired on an hourly basis, making the situation for the client increasingly difficult. How can general and external counsel prepare in advance for the possibility of such a challenging scenario?
Preparation and priorities
Song-Yi Son explained that preparation was key in such a situation. If the company only sets up a crisis organisation when things are at such a stage and are threatening to get out of hand, it's too late. The company needs to know in advance who is in charge in a corporate crisis, where the survival of the company is the top priority.
According to Song-Yi Son, a company needs to set the narrative, and respond to the most relevant question, namely how to communicate the crisis to shareholders, employees, the regulatory authority and to the wider public. The company urgently needs to mitigate the negative impact to survive.
Peter Calamari suggested that the company identified a single point of control where all information was available and the vital decisions are taken. The company needed a consistent approach in order to re-establish confidence in the market and with the public.
Giovanni Lombardi, having experienced the Parmalat demise, explained that a crisis committee with a clear chain of command was required to avoid the onset of a crisis in the first place.
Independent external investigation required
The hypothetical scenario was then further developed. The internal investigation showed that the company had failed to invest sufficiently in data protection measures which may have facilitated the attack in the first place.
Urs Hoffmann-Nowotny explained the challenges facing external counsel in such a situation. In a first step, the client's expectation and the set-up needed to be clarified. A simple defence strategy might not be sufficient to restore public confidence. Even when litigation was threatened or already pending, the litigation risk assessment was not the decisive factor in the public communication. For a company in crisis, the client should try to shape the public opinion proactively.
There was a fine line drawn between transparency and the unnecessary divulging of confidential information. To get back on top of the situation, the communication needed to focus on known facts. Any information that could be proved incorrect needed to be avoided. The company had to apply a policy of rigorous consistency and reliability. The worst for a company would be, if it had to change the facts after disclosure.
Especially if the problem was within the company, an independent factual investigation by an external provider could be crucial. Such an inquiry could enable a full review of the facts and identify the failures. Another crucial question was whether the external report of the investigator was to be released or held back by the board of the company. The panellists identified both advantages and disadvantages in the two scenarios. In any event, the company needed to take responsibility without admitting liability. It was helpful to bear in mind that different audiences (ad hoc body, wider public, supervising authority, investigating authority) might require different levels of transparency. A further layer of complexity arose in case the company was active in different jurisdictions or had worldwide operations. The company had to address the eminent issues in all jurisdictions in which it was operating, keeping in mind that different regulators might require different remedial actions.
Different strategy for the company in crisis compared to classic litigation
The hypothetical scenario was developed even further. It came as no surprise that the share price of the company quickly plummets in the context of such a disaster scenario. Affected individuals, shareholders and consumer threaten to bring (class action) litigation against the client. The regulatory authority, the government, employees and competitors are considering regulatory action and litigation against the company. The client quickly faces the real threat of bankruptcy.
Peter Calamari outlined that a normal approach in litigation would be insufficient in such a situation. Rather, an opposite strategy needed to be applied: a single court action was no longer the decisive issue, but rather the crisis as a whole. To restore public confidence, transparency rules over confidentiality and a prompt remedy were required, otherwise the company would not survive.
Whereas in the classic approach in litigation, the company maintained confidentiality and applied a delay and defend strategy to win the litigation, in a corporate crisis such an approach could lead directly to bankruptcy because the public confidence could not be restored by such measures. Winning civil suits had a low priority in existential battles; the strategy had to be to protect the company including its brand itself. The financial survival became paramount for the company. The panellists seemed to agree that it is often better to settle disputes, even at substantial costs, than to face the public outcry. Defending an ongoing piece of litigation became secondary under such circumstances.
Song-Yi Son made reference to a huge scandal in South Korea, where a company experienced problems due to the use of a certain chemical in food. The only defence the attacked company had was to publicise that it was not the only producer who used this chemical. It goes without saying such a crisis strategy was insufficient.
In relation to the approach regarding the regulator, a cooperative approach might in some jurisdictions lead to an admission of guilt. A balance needed to be struck between cooperation with the regulator on one hand and maintaining the notion that the company could defend its case on the other. Often, a cooperative approach could prove less damaging to the company.
Important role of the company's general counsel in the follow-up
For the general counsel, the focus was on rebuilding the brand and consumer confidence. Having survived a crisis as a company, its general counsel was to stay at the centre of the follow-up work. The organising of sharing data between different counsel, possibly in different jurisdictions, could often pose a challenge in itself. Frequently, though only limited facts needed to be protected by legal privilege, the main set of facts could regularly be shared allowing external legal teams in different jurisdictions to work on the same set of documents. The general counsel also needed to ensure that lessons learnt are implemented. If the fix was identified but not properly applied, eg, owing to high costs, the general counsel could assume the potential point of view of a regulating authority to overcome such resistance. Needless to say, that the regulatory authority might apply an even stricter review of the implemented measures for a certain period after the incident in order to consider appropriate sanctions.
Originally published by International Litegation News on 4 June, 2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.