Access first, protection later
Particularly in financial-economic crime cases, investigators routinely seize vast datasets. The volume can easily reach several gigabytes, running to one or more terabytes. This means that a seizure can amount to hundreds of millions of pages of text. The seized material frequently includes Office 365 data (email, Teams, etc.), SharePoint and other digital data. We refer to this as ‘bulk data’. The probability that it contains legally privileged information is significant. During a search, this data cannot easily be filtered for privileged material. The current practice is that where there is a reasonable suspicion that the seized material contains privileged information, the investigating judge is engaged to filter it. Until that process is complete, investigating officers may not access the data.
As a solution to the lengthy lead times involved in filtering data for privileged information in financial-economic crime cases, the legislature now opts for a radically different approach to the concept of ‘reasonable suspicion’ in the context of bulk data. The catalyst for this reform is the Dutch Supreme Court’s preliminary ruling of 12 March 2024 (ECLI:NL:HR:2024:375), in which the Court found that the law contains no explicit procedure for handling privileged information in bulk data. The Supreme Court held that any filtering exercise that requires access to the content of data must be carried out by, or under the supervision of, the investigating judge, with strict separation of roles, and called on the legislature to fill this gap. The proposed legislation responds to that call, but in a way that fundamentally undermines legal professional privilege.
On first reading, the new framework looks familiar: a prohibition on accessing data where there is a reasonable suspicion of privilege, with the investigating judge playing a central role. But the bill introduces a fundamental change of direction. Under the current approach, the default position is that bulk data may not be accessed until it has been established with sufficient certainty that no privileged material is contained within it. The proposed legislation reverses that presumption: access to bulk data is now permitted in principle, unless there is a reasonable suspicion in relation to a specific item. This is not a technical adjustment. It strikes at the very heart of what legal professional privilege is designed to protect, and has far-reaching implications for cases in which large quantities of data are seized.
The current framework: no access to bulk data
The Supreme Court addressed this gap in its preliminary ruling of 12 March 2024 (ECLI:NL:HR:2024:375). The ruling was clear: the public prosecutor and investigating officers must not be permitted to access privileged information.
Once there is a reasonable suspicion that the data sought may partially consist of privileged material, the public prosecutor is required to notify the investigating judge. The investigating judge then assesses that suspicion and may attach conditions to any authorisation granted. The practical default position is therefore this: bulk data may not be accessed until it has been established with sufficient certainty that no privileged material is present. That position is now embedded in the Public Prosecution Service’s guidelines on professional privilege (Directive 2025A001) and the judiciary’s published filtering protocol.
What changes: access to bulk data as the new default
The Supreme Court’s reasonable suspicion test asks whether privileged information is present ‘among’ the bulk data. The proposed legislation takes a different course. The explanatory memorandum describes this as a ‘new line of thinking’ with a ‘less constrained’ approach. The explanatory memorandum makes no attempt to conceal the deliberate departure from the line taken by the Supreme Court: this is an explicit policy choice, not an unintended consequence.
Proposed Article 2.7.61a provides that the prohibition on access applies only ‘if and to the extent that’ there is a reasonable suspicion in relation to specific data items, and that a collection of data is caught only where the overwhelming majority of items in that collection are presumed to be privileged. Under the proposed framework, bulk data may be accessed, save where a reasonable suspicion exists in relation to specific items. The suspicion must now attach to an individual file rather than to the dataset This is highly problematic: in practice, it is factually impossible to identify privileged material at item level within large datasets.
The explanatory memorandum describes the current position, that no privileged information should remain in the bulk following filtering, as a ‘fiction’ that must be abandoned. In doing so, the legislature overlooks the fact that it is precisely this ‘fiction’ that makes the protection of legal professional privilege meaningful. Furthermore, the filtering task shifts from the investigating judge to the public prosecutor. We examine what that new procedure looks like in practice, and what it means for judicial safeguards, in our next blog.
Why this is a problem for the protection of legal professional privilege
The new framework contains a structural flaw that is inherent to its own logic. The prohibition on access is only triggered once a reasonable suspicion exists in relation to a specific item, but the explanatory memorandum acknowledges that such a suspicion can sometimes ‘only arise after (limited) access has already been taken’. The system therefore requires that access has already occurred before the protection kicks in. The legislature regards this as acceptable: it ‘must be accepted that there is a substantial probability that privileged data will be found among the data not filtered out’. Legal professional privilege no longer functions as a pre-emptive barrier blocking access before privileged material is seen, it operates as a brake applied after the fact. That is fundamentally at odds with the rationale of legal professional privilege.
The explanatory memorandum adds that no unlawful conduct occurs where an investigating officer unexpectedly encounters privileged material during careful data review, provided it is rendered inaccessible immediately. But this misses the essential point: the access has already taken place and cannot be undone. The proposed framework effectively opens the door to the examination of legally privileged material without any procedural sanction.
Notably, the change of direction is partly justified on pragmatic grounds: filtering and complaint procedures cause lengthy delays in criminal investigations, and those within the criminal justice chain have made an ‘urgent appeal’ for reform. The desire of the police, Public Prosecution Service, and judiciary for faster procedures is understandable, but none of those parties are the ones whose interests legal professional privilege exists to protect. That one of the most fundamental safeguards of a fair trial for the accused is being eroded at the request of parties who inherently hold the upper hand in criminal proceedings, cannot be the intention. Privilege is not a procedural bottleneck to be streamlined. It is a fundamental right that does not yield to investigative expediency.
Faster, but at what cost?
The demand to ease the burden on investigating judges is understandable. The current filtering procedure causes significant delays and places a heavy load on the judiciary. But the solution chosen is not the right one. Shifting the filtering task to the public prosecutor and linking the access prohibition to individual data items rather than to the bulk as a whole does not simply reduce the level of protection afforded by legal professional privilege – it removes the independent, pre-emptive judicial check entirely. Legal professional privilege is thereby entirely hollowed out for the sake of efficiency.
There are practical alternatives that would reduce delays without bypassing judicial oversight, including structural investment in capacity and (technical) expertise within the judiciary. We explore those alternatives in our next blog, where we also critically examine the public prosecutor’s new role as the filtering party.
Want to know more?
In our next three blogs, we discuss in turn the proposal to assign the filtering procedure to the public prosecutor, the proposal to introduce a retention obligation for privileged information found by the Public Prosecution Service and investigating officers, and the lack of oversight mechanisms for the defence over the public prosecutor’s filtering process.
Do you have questions about the implications of this proposed legislation? Our Corporate Crime & Business Integrity team would be happy to advise.
