Should I breach confidentiality to report suspected criminality?

A recent case throws up some interesting issues concerning when it is OK (and when it is not OK) to breach confidence in order to report suspected criminality. The case concerned some private investigators who decided to report their clients for suspected criminal conduct, rather than keep confidential the results of their investigation: Saab & Anor v Dangate Consulting Ltd & Ors [2019] EWHC 1558 (Comm).

Private investigators disclose information to regulators and law enforcement agencies

The claimants in this case are the owners of FBME Bank (the Bank).  In 2014, the US regulator FinCEN sent the Bank a notice alleging money laundering.    Soon after, the Cyprus branch of the Bank was taken over by the Central Bank of Cyprus (the CBC).  The owners of the Bank then engaged two private investigators to conduct an independent internal investigation into the allegations in the FinCEN notice.

The private investigators signed a retainer containing strict confidentiality provisions with Quinn Emanuel Urquhart & Sullivan (Quinn Emanuel) (on behalf of the owners of the Bank).  At the end of the retainer the private investigators gave documents and information from the Bank to FinCEN, the CBC and other law enforcement agencies.  They believed they could disclose the information because they considered that they had identified serious alleged criminal conduct.  The owners of the Bank sued the private investigators for breach of confidence.  The claimants dispute both the FinCEN allegations and that the disclosed materials were evidence of criminality.

The importance of express confidentiality agreements

The engagement letter contained five key obligations in relation to confidential information. These were:

1. To keep the information confidential.
2. To tell Quinn Emanuel before disclosing any confidential information to third parties.
3. To tell Quinn Emanuel if any confidential information had been disclosed to third parties without consent.
4. To refuse to produce confidential information in response to a request from a third party.
5. To deliver up confidential documents if requested by Quinn Emmanuel or the owners of the Bank.

The court was asked to decide whether the express confidentiality obligation (on top of the common law duty of confidence) meant the private investigators were under an enhanced duty to keep the information confidential, and concluded that it did.  The court didn’t give further guidance on what this enhanced duty might look like in practice but commented that it added a further element of weight in the balance between maintaining confidentiality and disclosure.

The defence of iniquity – a distinction between regulators and law enforcement agencies

In relation to the alleged breach of the duty to keep the information confidential, the private investigators relied on the public interest defence. It was common ground that the starting point when looking at the public interest defence is the ‘defence of iniquity’.

The Bank was based in Tanzania with its main branch in Cyprus. The court commented that disclosure of information relating to the legality of the Bank’s conduct to regulators in those countries could, in theory, attract the public interest defence.  The court was willing to assume that disclosures to regulators in the UK and US may fall within the scope of the iniquity defence because of the broad influence of those regulators (meaning a relevant public interest could exist).  However, the court drew a distinction between regulators and law enforcement agencies in the UK and US, finding that disclosures to law enforcement agencies were not capable of attracting the defence of public interest and were therefore a breach of confidence.

Notification and deliver-up provisions

The court concluded that the public interest defence could not apply to the notification and deliver-up provisions of the confidentiality agreement. As a result the private investigators were found to be in breach of those provisions.

Less is more when making a disclosure

The problem the private investigators faced in making out their public interest defence was that the disclosures they had made were broad and far reaching and lacked focus on the individual allegations. It was virtually a “document dump” of all the information they had gathered while conducting the internal investigation.  This meant that they were forced to advance a case of public interest which covered the whole of the disclosure.  If the disclosure had been more focussed, the court felt some of it might have been justified on public interest grounds.

So: should I breach confidentiality to report suspected criminality?

There is no general duty to report suspicions or knowledge of criminality by a third party. There are some specific duties however, for example on those who operate in the regulated sector, to report suspicions of money laundering or terrorist financing.  For others, whether or not to report suspicions is a matter of choice.

A party, on whom there is no obligation to make a report but who is nonetheless considering making a disclosure in breach of a duty of confidentiality, should seek legal advice first, even if they believe that disclosure is in the public interest. The party must consider to whom the information would be disclosed and whether there is a genuine public interest in respect of the specific information being disclosed.  Disclosure should be targeted and must evidence the allegation made.

On the flip side, if a party is disclosing sensitive information to third parties, they should enter into express confidentiality agreements which include notification and deliver-up provisions. If their confidential information is later disclosed, this is likely to mean the defence of public interest disclosure is harder to establish (and is not available in respect of breaches of the notification and deliver-up provisions).