Introduction
Legal professional privilege is frequently described as a fundamental constitutional right rather than a mere procedural rule. The courts have repeatedly affirmed that it exists not for the benefit of lawyers but for the benefit of clients, enabling them to communicate openly with their legal advisers without fear that those communications will be used against them. As Lord Taylor CJ stated in R v Derby Magistrates’ Court, ex parte B [1995] UKHL 18, legal professional privilege is “much more than an ordinary rule of evidence” — it is a right that, once established, “cannot be overridden by the court’s general discretion.” In that case, the House of Lords held that no balancing exercise is permissible: the judge cannot weigh the importance of the privileged material against the public interest in its disclosure and order production on that basis. The privilege, when it exists, is absolute.
Yet for businesses operating in regulated sectors, this apparently absolute position is subject to a significant qualification. Parliament has, on many occasions, enacted legislation granting regulatory bodies powers that are capable of overriding legal professional privilege. The question of whether a regulator can compel the production of a document that would otherwise be privileged therefore turns not on general principle alone, but on the specific statutory framework applicable to the regulator in question and the proper construction of the statutory power it purports to exercise. Getting this analysis right is critical: providing a privileged document to a regulator can amount to a waiver of privilege that has consequences extending well beyond the regulatory context, potentially exposing the document — and the entire advice chain from which it comes — to hostile parties in subsequent civil litigation.
This article examines the legal framework governing regulatory compulsion of privileged documents in England and Wales, identifies the key regulatory regimes in which the issue most frequently arises, considers the limited circumstances in which privilege may not provide protection even in the absence of express statutory override, and offers practical guidance for businesses facing document demands from regulators.
The Constitutional Status of Privilege and the Principle of Statutory Override
The starting point for any analysis of regulatory compulsion is the constitutional status of legal professional privilege. The courts of England and Wales have consistently held that privilege is a fundamental right, recognition of which predates many of the regulatory frameworks that now seek to override it. This status has important implications for statutory construction: Parliament can abrogate privilege, but only if it does so by clear and express words or by necessary implication. A general power of investigation or information-gathering, however broadly framed, will not suffice.
The leading authority on this point is R (Morgan Grenfell & Co Ltd) v Special Commissioner of Income Tax [2002] UKHL 21, in which the House of Lords held that a statutory power conferred on an inspector of taxes to require the production of “documents” did not extend to documents that were the subject of legal professional privilege. Lord Hoffmann, with whom the majority agreed, articulated the principle in clear terms: because legal professional privilege is a fundamental right, Parliament is presumed not to have intended to override it unless it has said so expressly or the implication is necessary and not merely possible. The fact that the power was expressed in wide and unqualified terms was insufficient to rebut that presumption.
“The courts should be very slow to hold that a fundamental right has been abrogated by a statute which does not expressly provide for its abrogation and contains no necessary implication to that effect.” — Lord Hoffmann, Morgan Grenfell [2002] UKHL 21
Morgan Grenfell established the principle that has since been applied across a wide range of regulatory contexts. It does not mean that statutory override is impossible — Parliament is sovereign, and it can and does enact provisions that expressly displace privilege. But it does mean that where the statutory language is ambiguous, the courts will construe it in a manner that preserves the privilege rather than destroys it. For businesses facing document demands from regulators, the first question to ask is always whether the statutory power being exercised expressly and unambiguously extends to privileged documents, or whether it falls short of that.
Regulatory Regimes That Override or Limit Privilege
Despite the robust constitutional position, there are a number of important regulatory regimes in which Parliament has enacted provisions that do, either expressly or by necessary implication, override legal professional privilege to some degree. The most significant are examined below.
Financial Services Regulation: The FCA and PRA
The Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA) exercise extensive information-gathering powers under the Financial Services and Markets Act 2000 (FSMA). Section 165 of FSMA confers a general power on the FCA to require authorised persons and certain connected persons to provide information or documents. However, section 175(5) provides a significant qualification: a person need not disclose information or produce a document if they are entitled to refuse to do so on grounds of legal professional privilege.
This is a straightforward and express preservation of privilege, and it means that an authorised firm can — and should — assert privilege over documents falling within its scope when responding to an FCA information requirement under section 165. The position is broadly similar under the PRA’s equivalent powers. It is worth noting, however, that this protection does not extend to all FCA investigative powers in all circumstances: where the FCA is conducting a formal investigation under section 170 of FSMA, the powers are wider, and the position in respect of specific categories of document may be more nuanced. Firms should take advice before assuming that privilege provides a complete answer to any FCA document demand.
The FCA has also published guidance making clear that it will not use section 165 to compel the production of privileged documents and that it expects firms asserting privilege to do so in good faith and with proper analysis. However, the FCA does scrutinise privilege claims carefully, and unsubstantiated or overbroad assertions of privilege are likely to prompt challenge and may damage the relationship between the firm and the regulator at a critical time.
Competition Law: The Competition and Markets Authority
The Competition and Markets Authority (CMA) has far-reaching investigation and enforcement powers under the Competition Act 1998, the Enterprise Act 2002, and — in respect of retained EU law — the legacy of EU competition regulation. In the context of Chapter I and Chapter II prohibition investigations and merger inquiries, the CMA can require the production of documents and the provision of information. However, section 30 of the Competition Act 1998 expressly provides that nothing in Part I of the Act requires a person to produce or provide any document or information in respect of which a claim to legal professional privilege could be maintained in legal proceedings.
Section 30 is a clear and important preservation of privilege in the competition law context. It reflects the recognition that the competition investigative process, which can involve document demands of enormous breadth and complexity, should not be used as a vehicle to circumvent privilege. In practice, the CMA and its predecessor the OFT have engaged in litigation in a number of cases concerning the scope of privilege — particularly in the context of the distinction between legal advice privilege and litigation privilege, and the question of whether communications from in-house lawyers qualify — and businesses subject to investigation should ensure that their privilege claims are properly grounded in the applicable legal principles.
It should be noted that, following Brexit, the European Commission’s investigation powers under EU competition regulation no longer directly apply in the United Kingdom. However, businesses with activities in EU member states remain subject to the Commission’s powers in respect of conduct affecting EU trade, and the Commission’s approach to privilege — which is considerably narrower than the English law approach, in particular in its refusal to recognise privilege in communications with in-house lawyers — remains relevant for multinational organisations.
Tax: HMRC
HM Revenue and Customs (HMRC) possesses extensive statutory powers to require the production of documents, most notably under Schedule 36 to the Finance Act 2008. However, paragraph 23 of Schedule 36 provides that a taxpayer need not produce a document if the whole of it is privileged. Importantly, paragraphs 24 and 25 draw a distinction between documents held by the taxpayer and documents held by a “tax accountant” (a category that includes certain non-lawyer advisers): the protection for documents held by tax accountants is more limited than for documents held by lawyers, reflecting the fact that communications with non-lawyer tax advisers do not attract legal professional privilege in the strict sense.
The Morgan Grenfell case itself arose in the HMRC context, and the preservation of legal professional privilege in Schedule 36 can be seen as Parliament’s express legislative response to that decision. The protection is, however, subject to one important qualification: it does not apply to “explanatory documents” that do not contain legal advice but are merely being used as a shield to withhold information that would otherwise be disclosable. HMRC has consistently sought to challenge overbroad privilege claims, and businesses and their advisers should be scrupulous in limiting privilege assertions to material that genuinely qualifies.
Serious Fraud Office
The Serious Fraud Office (SFO) operates under section 2 of the Criminal Justice Act 1987, which confers a power to require persons to produce documents relevant to a fraud investigation. Section 2(9) expressly preserves legal professional privilege: a person is not required to produce any document that he would be entitled to refuse to produce on grounds of legal privilege in proceedings in the High Court.
In practice, the SFO’s approach to privilege has been the subject of significant litigation, most notably in relation to the waiver of privilege through the process of corporate self-reporting and cooperation. The SFO has, in the past, encouraged companies under investigation to share the results of internal investigations — including reports prepared by external lawyers — as a demonstration of cooperation. Where companies have done so, difficult questions arise about whether and to what extent they have waived privilege over related documents, and whether that waiver can be relied upon by private litigants who are not party to the regulatory process. The Court of Appeal addressed aspects of this in SFO v ENRC [2018] EWCA Civ 2006, in which it held that documents prepared in anticipation of SFO prosecution qualified for litigation privilege — a decision with significant implications for the conduct of internal investigations in the shadow of regulatory scrutiny.
Environmental Regulation
The Environment Agency and other environmental regulators have statutory powers to require the provision of information in connection with their regulatory and enforcement functions. The relevant provisions typically preserve legal professional privilege. Section 108 of the Environment Act 1995, for example, which confers powers of entry and inspection, does not require the production of privileged documents. Similar protections exist in sector-specific environmental legislation. However, the complexity of environmental regulation — which involves multiple regulators at national and local level, each operating under different statutory frameworks — means that businesses facing demands in this area should obtain careful advice about the specific powers being invoked before making privilege assertions.
Health and Safety
The Health and Safety Executive (HSE) has powers to require the provision of information and documents under the Health and Safety at Work etc. Act 1974 and associated regulations. Those powers do not generally override legal professional privilege, and in practice the HSE operates on the basis that privilege claims will be respected where properly made. Post-incident investigations are a common context in which privilege issues arise, particularly in respect of reports prepared by external lawyers in anticipation of inquest, enforcement, or civil litigation proceedings.
Situations Where Privilege May Provide Incomplete Protection
The analysis above confirms that, in most major regulatory contexts, legal professional privilege is expressly or effectively preserved. However, there are several important situations in which privilege may provide incomplete protection, and businesses should be aware of each of them.
The Crime-Fraud Exception
Legal professional privilege does not protect communications that are made for the purpose of facilitating crime or fraud. This is sometimes called the “iniquity” exception. If a client sought legal advice in order to further a criminal or fraudulent purpose, the advice and associated communications are not privileged, even if the lawyer was innocent of any wrongdoing. The exception applies to the purpose of the communication, not its content: a document that happens to record a criminal plan does not lose privilege simply by virtue of that content; the question is whether the communication was itself made for the purpose of facilitating the wrongdoing.
In the regulatory context, the crime-fraud exception is of particular relevance where a regulator is investigating conduct that may also constitute a criminal offence. If the regulator can establish (to a threshold standard) that the relevant communications were made in furtherance of the criminal or fraudulent conduct under investigation, it may be able to challenge a privilege claim on this basis. The threshold for triggering the exception is, however, a real one: mere assertion that wrongdoing is suspected is insufficient, and a court will scrutinise the evidence carefully before allowing privilege to be displaced on this ground.
Regulatory Regimes Without Express Preservation: A Residual Risk
Although the Morgan Grenfell principle provides strong protection in cases where a statutory power is silent on privilege, the position is not entirely free from risk in every context. In limited circumstances, a court may find that the abrogation of privilege is a necessary implication of a statutory scheme — for example, where the entire purpose of the regime would be frustrated if privilege could be asserted. Such findings are rare and courts approach them with great caution, but they are not impossible. Businesses operating in novel or complex regulatory contexts — for example, under recently enacted post-Brexit regulatory frameworks, or in sectors subject to international regulatory cooperation arrangements — should not assume that privilege will necessarily survive a determined regulatory challenge without careful analysis.
Waiver Through Selective Disclosure
Even where a regulator cannot compel the production of privileged documents, a business may inadvertently waive its privilege by selectively disclosing some privileged material while withholding other related material. This can occur in a number of ways: through the voluntary disclosure of a legal opinion in correspondence with the regulator, through statements in submissions that characterise or summarise legal advice, or through the production of documents in a regulatory process that reveals the substance of advice even without disclosing the advice document itself.
Waiver is perhaps the most practically significant risk in the regulatory context because, once privilege is waived in respect of a particular communication or advice chain, the waiver typically extends to all documents in that chain dealing with the same subject matter. A business that discloses a favourable legal opinion to a regulator in the hope of closing down an investigation may find that it has opened the door to disclosure of the entire body of associated legal advice — including advice that is unfavourable — in subsequent civil proceedings brought by private litigants. The decision to disclose any privileged material to a regulator should always be taken deliberately, with full awareness of the waiver consequences, and ideally with specific legal advice on the scope of any waiver that would result.
Limited Use and Limited Waiver Arrangements
It is sometimes possible to disclose privileged material to a regulator on a limited-use basis, pursuant to an agreement or undertaking that the material will not be used for purposes other than the specific regulatory investigation and will not be passed to third parties. Such arrangements — sometimes called “limited waiver” or “Deferred Prosecution Agreement-style” disclosure arrangements — have been used in the SFO context and in some overseas regulatory frameworks.
However, the position under English law on whether a limited-use undertaking can effectively prevent a broader waiver of privilege is not entirely clear. The general principle is that waiver, once effected, cannot be clawed back by private agreement — privilege is a protection owed to the client, and a third party who obtains privileged material cannot be required to treat it as if privilege still subsisted. While specific statutory schemes may carve out limited-use protections, businesses should not assume that an informal undertaking from a regulator to treat disclosed material as confidential will prevent adverse use of it in future proceedings. This is an area where legal advice should always be obtained before any voluntary disclosure is made.
Overseas Regulatory Demands
Businesses with international operations face the additional complexity of overseas regulatory demands. Regulators in other jurisdictions — particularly in the United States, where the Fifth Amendment and attorney-client privilege operate differently from English law, and in the European Union, where the Court of Justice has confirmed that privilege does not extend to communications with in-house lawyers — may not recognise, or may take a narrower view of, the privilege protections applicable under English law. Where a US regulator issues a subpoena or formal document demand to an English company or its subsidiaries, there may be a conflict between the obligation to comply and the English law privilege position. Navigating such conflicts requires specialist advice from lawyers admitted in both jurisdictions.
Where Statutory Override Is Clear: How to Respond
In a small number of regulatory contexts, Parliament has enacted clear provisions that do override legal professional privilege. The most prominent current example is the Proceeds of Crime Act 2002 (POCA), which requires solicitors and other regulated professionals to make suspicious activity reports (SARs) in certain circumstances and does not permit privilege to be used as a blanket shield against the obligation to report — although the scope of the reporting obligation is itself carefully defined and limited. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 similarly impose disclosure obligations in the anti-money laundering context that can cut across ordinary privilege principles.
Where a statutory provision does unambiguously override privilege, the business subject to the demand has no legal basis to refuse production on privilege grounds. In such circumstances, the focus shifts to ensuring that the disclosure is limited in scope to what the statute requires, that appropriate records are kept of what has been disclosed and why, and that the litigation and reputational consequences of the disclosure are carefully managed. Even where production is legally compelled, professional and organisational protocols for managing the process — including notification to relevant stakeholders and review of any related contractual confidentiality obligations — should be followed.
Practical Guidance for Businesses Facing Regulatory Document Demands
For businesses confronted with a document demand from a regulator, the following principles should guide the response.
The first and most important step is to identify precisely which statutory power the regulator is purporting to exercise, and to analyse carefully whether that power extends to privileged documents. This is not a mechanical exercise: it requires a close reading of the relevant statutory provisions, their legislative history, and the case law on their interpretation. Where the position is uncertain, external legal advice should be obtained promptly — a failure to assert privilege timeously can itself constitute a form of waiver, and the window for doing so in a regulatory investigation is often narrow.
Second, any assertion of privilege must be properly grounded. Regulatory bodies are experienced in challenging privilege claims, and an assertion that a document is privileged because it was sent to or from a lawyer, without more, is unlikely to withstand scrutiny. The privilege claim should identify the applicable head of privilege — legal advice privilege or litigation privilege — explain why the relevant conditions are met, and address any obvious objections, including the dominant purpose question and the in-house lawyer qualification where applicable. A document-by-document log (a privilege schedule) is typically required, and it should be prepared with care.
Third, businesses should have in place — ideally before any regulatory investigation begins — a document retention and privilege management protocol that enables them to identify privileged material quickly and reliably when a demand is received. The absence of such a protocol means that the response to a regulatory demand may be reactive, hurried, and inconsistent, creating risks both of inadvertent waiver (through disclosure of material that should have been withheld) and of unwarranted privilege claims (through the assertion of privilege over documents that do not qualify). Good document governance is not merely a matter of organisational efficiency: it is a legal risk management tool.
Fourth, any voluntary disclosure of privileged material to a regulator should be treated as a significant legal decision requiring senior management and legal team sign-off. The decision should be documented, the scope of the waiver that would result should be assessed, and the terms on which disclosure is made — including any limited-use undertakings or confidentiality arrangements — should be agreed in writing. Where the disclosure is made in the context of a formal cooperation agreement or deferred prosecution agreement negotiation, the terms of that agreement should address the privilege consequences expressly.
Fifth, and connected to the above, businesses should ensure that their external advisers — both those conducting any internal investigation and those advising on the regulatory process — are fully aligned on the privilege strategy from the outset. A common failure mode in complex regulatory matters is for privilege to be managed inconsistently across different work streams, resulting in gaps or contradictions that are later exploited in litigation. A single coordinated privilege strategy, overseen by lead legal counsel, is essential for any significant regulatory engagement.
Conclusion
The question of whether a governmental regulator can require the production of a privileged document does not admit of a simple yes or no answer. The starting point is a strong constitutional principle — affirmed at the highest judicial level — that legal professional privilege cannot be overridden by a general or unspecified statutory power. That principle means that in many of the most significant regulatory contexts, including financial services, competition law, and tax, privilege is expressly preserved and can be asserted as a complete answer to a document demand.
However, the principle is not absolute. Parliament can, and occasionally does, enact statutory provisions that clearly override privilege, and the courts will give effect to such provisions. The crime-fraud exception provides a further limitation that does not depend on statutory language at all. The risk of inadvertent waiver through voluntary disclosure is ever-present. And the complexity of international regulatory frameworks means that English law privilege protection cannot always be relied upon to hold in every jurisdiction in which a business operates.
For businesses in regulated sectors, the management of legal professional privilege in the face of regulatory scrutiny is a sophisticated and high-stakes exercise. The costs of getting it wrong — whether by inadvertently producing privileged material or by making unsubstantiated privilege claims that damage the relationship with the regulator and invite challenge — can be significant and lasting. The investment in careful, proactive privilege management, with experienced legal support, is one that repays itself many times over in the event of a serious regulatory investigation.
If your organisation is facing a document demand from a regulator, or if you would like advice on establishing privilege management protocols before any investigation arises, please contact a member of our team.
This article is for general information purposes only and does not constitute legal advice. Specific legal advice should be sought in relation to your particular circumstances.