# Morrill v. Lakeview Loan Servicing, LLC

> District Court, S.D. Florida · March 27, 2025

URL: https://www.frixlaw.com/law-library/cases/10832639

## Case

- **Court:** District Court, S.D. Florida
- **Decided:** March 27, 2025
- **Opinion:** 100trialcourt
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/10832639

## How later opinions describe it (automated extraction)

- applying because of test: “a document can contain protected work- product material even though it serves multiple purposes, so long as the protected material was prepared because of the prospect of litigation.”

## Opinion text

UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF FLORIDA

Master File No. 22-20955-Civ-GAYLES/TORRES

In re LAKEVIEW LOAN SERVICING
DATA BREACH LITIGATION

ORDER ON MOTION FOR RECONSIDERATION
OF ORDER ON PRODUCTION OF INVESTIGATIVE REPORTS

The parties have briefed and presented argument with respect to a
continuing discovery issue surrounding Plaintiffs’ efforts to compel production of
investigative reports prepared by cybersecurity firms Mandiant and Protiviti over
Defendants’ objections. Defendants contend that they are protected from disclosure
because they were prepared in anticipation of litigation and adverse regulatory
proceedings after an unauthorized access to certain devices in Bayview’s network
(the “breach”). The Court agreed in its Order denying production entered June 12,
2024. [D.E. 211].
Plaintiffs now contend that the work product protection recognized by the
Court was actually waived because these documents themselves were disclosed to
mortgage industry regulators following the breach. Plaintiffs argue that the
Court’s original Order on this matter overlooked that issue, thus warranting
reconsideration. And they renew their efforts to gain production of the documents.
[D.E. 218].
Upon initial review of the briefing on this issue, the matter was addressed
again at a discovery hearing conducted December 19, 2024. After considering the

parties’ arguments, the Court requested supplemental briefing on the legal issues
raise by the motion and, specifically, additional caselaw that might prove relevant
to the analysis. The parties complied with that request and filed their well-
prepared supplemental memoranda. [D.E. 257, 264].
After considering the parties’ supplemental briefing on this matter as well

as argument of counsel and the record presented, the Court finds that
reconsideration is warranted because Plaintiffs’ position is sound. Defendants are
compelled to produce the two investigative reports at issue because the Court
prematurely deemed them work product. It turns out that they are not under a
correct application of the dual purpose test that we are revisiting in this Order.

And, though any work product protection may have also been waived to boot, we do
not reach that waiver question for the reasons explained below.
I. BACKGROUND
In October 2019, Mandiant and Bayview Asset Management, LLC
(“Bayview”) entered into a Master Services Agreement (“MSA”) and executed a

Statement of Work (“SOW”) that secured Mandiant’s services in the event of a data
incident, which would be defined at the time of engagement. To be ready to quickly
provide services in the event of a data incident, Mandiant gathered information
about Defendants’ systems, security tooling, logging, and other relevant matters.
On December 2, 2019, a different security company, Protiviti, was engaged
by Bayview through its counsel, BakerHostetler, to provide various services, two of

which were related to data privacy or information security but unrelated to the
breach. Prior to BakerHostetler engaging Protiviti, Protiviti had not entered into
any SOW with Defendants to provide similar work.
In June 2021, Mandiant and Bayview executed a renewal SOW for Mandiant
to continue to be at the ready so that Bayview could respond quickly in the event of

a data incident. Mandiant was purportedly not actively performing any work at the
time the breach was discovered. But when the breach was discovered on December
7, 2021, the only work Mandiant had performed for Bayview was the report
providing an assessment of Bayview’s ability to support requests that may be made
by Mandiant during an incident response engagement. Otherwise, Mandiant was

simply at the ready to quickly respond if a data incident occurred.
And, four days after the breach was discovered, Bayview’s counsel
BakerHostetler engaged Mandiant to perform the forensic investigation related to
the breach. After that investigation was completed, an internal report was prepared
for counsel’s review. That report has not been produced in the litigation.

Nevertheless, Plaintiffs moved to compel production of the internal reports
created by Mandiant and Protivity. Plaintiffs argue that these reports were created
within the ordinary course of Bayview’s business and, therefore, are not protected
work-product. In their motion for reconsideration, Plaintiffs further support that
take by emphasizing the pre-existing business relationship between the
investigative consultants and Bayview long before counsel was retained after the
breach. And during that relationship, the consultants provided various security

reports on matters purportedly related to the security issues involved in the breach.
So Plaintiffs claim that this ongoing relationship evidences a business purpose
behind the post-breach reports as opposed to any work product protected analysis
for counsel.
The Court’s earlier Order, however, rejected these arguments based on the

dual purpose nature of the investigative reports. And the Court understood that
there was a pre-existing relationship between the consultants and Bayview (a fact
that Plaintiffs’ supplemental filings focus on). So nothing in the motion for
reconsideration changes the outcome with respect to that finding. Though the
Court may be wrong on that score and reasonable minds may disagree, the Court

stands by its original position for the reasons laid out in the June Order, at least
based on the information then known to the Court.
But the Court did not fully appreciate, however, what the second part of the
motion for reconsideration is focused on. There Plaintiffs argue that, even if work
product initially immunized these reports from discovery, that work product

protection was lost following Bayview’s communications and disclosures to its
regulator. On this score there is agreement by the parties that the Multistate
Mortgage Committee (“MMC”) is a multistate regulatory agency enlisted to protect
consumers in the mortgage business, to identify and prevent mortgage fraud, and
to generally help regulate the mortgage industry. As it itself describes its role, the
MMC is “a representative body of state mortgage regulators appointed by the
Conference of State Bank Supervisors (CSBS) and American Association of

Residential Mortgage Regulators (AARMR) to represent the examination interests
of the combined states under the Nationwide Cooperative Protocol and Agreement
for Mortgage Supervision. The MMC’s primary focus is on nationwide mortgage
lenders and servicers operating in 10 or more states.”1
As part of that responsibility, the MMC wears many hats. At the front end

of things, MMC conducts regular audits and compliance review of member Banks
that are licensed by and registered in the participating States. These regular
examinations are designed to review “multi-state banks for safety and soundness
and compliance with applicable laws, including coordination with the host state
supervisors, the appropriate federal bank regulatory agency and bank

management. . . . Also, the home state supervisor shall consult with the host state
and should use host state examiners to examine for compliance with host state laws
regarding community reinvestment, consumer protection and fair lending, in those
states that have enacted such laws.”2
The same regulatory body, however, can also conduct specific investigations

under the enforcement mechanisms that participating States have adopted.

1 See MMC’s 2019 Mortgage Examination Manual at 9 (available at
https://www.csbs.org/sites/default/files/external-link-
files/MMC%20Mortgage%20Exami nation%20Manual%20v2%20-
%20May%202019.pdf).
2 See Nationwide Cooperative Agreement for Mortgage Supervision § 4.1 (Dec.
9, 1997) (available at https://www.csbs.org/sites/default/files/2017-11/
nationwide_coop_agrmnt.pdf).
Specifically the “home state supervisor shall be primarily responsible for initiating
enforcement actions against a multi-state bank. . . . Enforcement actions to address

violations of host state laws where possible shall be taken jointly by home state and
host state supervisors.”3
One such enforcement action arose here after the Breach took place involving
Bayview and its affiliated entities. As the MMC described its investigation in a
consent decree agreed upon with Bayview:

[O]n becoming aware of and due to the Incident, on or about April 1,
2022, the State Mortgage Regulators, as coordinated by the MMC,
commenced a multi-state targeted cybersecurity examination . . . of
Respondents covering the period of January 1, 2020 through September
30, 2022, in order to determine Respondents’ compliance with applicable
State and Federal laws and regulations and assess the effectiveness of
Respondents’ information technology (“IT”) and cybersecurity program.
. . . The Multi-State Cybersecurity Examination was conducted by the
State Mortgage Regulators from the states of California, Florida,
Maryland, and Washington. The Multi-State Cybersecurity
Examination of Respondents was conducted pursuant to their respective
statutory authorities, and in accordance with the protocols established
by the CSBS/AARMR Nationwide Cooperative Protocol for Mortgage
Supervision as well as the Nationwide Cooperative Agreement for
Mortgage Supervision. . . . The Report of Examination was issued by the
MMC to Respondents on May 4, 2023, and identified alleged compliance
violations of State and Federal law related to Respondents’ IT and
Cybersecurity Program. . . .
Consent Order Re Bayview Asset Management, LLC and affiliates (Dec. 31, 2024)
(available at https://www.mass.gov/consent-order/bayview-asset-management-llc-
and-affiliates-consent-order) (“Consent Order”).

3 See Nationwide Cooperative Agreement for Mortgage Supervision § 5.1 (Dec.
9, 1997) (available at https://www.csbs.org/sites/default/files/2017-11/
nationwide_coop_agrmnt.pdf).
As memorialized in this Consent Order, which resulted in a final
administrative penalty assessed against Bayview in the amount of $19,629,400 plus
costs, the results of that examination showed that Bayview had “deficient IT and

cybersecurity practices, which allegedly constitute violations of certain federal and
state-specific compliance laws and regulations . . . [including] insufficient IT patch
management, insufficient centralized IT vulnerability remediation monitoring and
enterprise reporting, insufficient IT inventory tracking, and failure to appropriately
encrypt certain personally identifiable information when that data was at rest.” Ibid.
To resolve these allegations, Bayview agreed to the penalty in the consent Order that
also incorporated specific remedial measures and a corrective action plan that it

would take going forward.
During the course of this MMC investigation that led up to the entry of the
Consent Order, Bayview and MMC traded correspondence related to whether
Defendants were in compliance with federal and state regulations by adequately
investigating and responding to the breach. To bolster its defense to MMC’s

criticisms of its cybersecurity investigation, including the specific criticism that it
lacked a “root cause report,” Bayview voluntarily produced the Mandiant and
Protiviti reports. Notably, Bayview does not contend that this production was
compelled by any particular order, subpoena, decree or demand sent from MMC.
Nor does Bayview claim that their production was under the auspices of any

particular confidentiality agreement of any kind at the time of the production.
But Bayview insists that the confidential nature of the reports remained
intact for various reasons. First and foremost, The Federal Secure and Fair

Enforcement for Mortgage Licensing Act (“SAFE Act”) directs state regulators to
establish and maintain the National Multistate Licensing System & Registry
(“NMLS”) to coordinate supervision of the residential mortgage industry. This
provision expressly recognizes and preserves the privileged nature of information
and documents provided to the NMLS. Specifically, 12 U.S.C. § 5111 provides:

Except as otherwise provided in this section, any requirement under
Federal or State law regarding the privacy or confidentiality of any
information or material provided to the Nationwide Mortgage Licensing
System and Registry or a system established by the Director under
section 5108 of this title, and any privilege arising under Federal or
State law (including the rules of any Federal or State court) with respect
to such information or material, shall continue to apply to such
information or material after the information or material has been
disclosed to the system. Such information and material may be shared
with all State and Federal regulatory officials with mortgage or financial
services industry oversight authority without the loss of privilege or the
loss of confidentiality protections provided by Federal and State laws.
12 U.S.C. § 5111(a).
Further Bayview points out that section 5111 expressly preempts any state
open records law that would provide lesser protections. Id. at § 5111(c). And section
5111 also provides that “[i]nformation or material that is subject to a privilege . . .
under paragraph (a) of this section shall not be subject to: Subpoena or discovery, or
admission into evidence, in any private civil action. . . .” Id. at § 5111(b)(2). Hence
Bayview concludes that the production of its fact work product to the MMC
investigators did not waive or forfeit its work product protection because the
Mandiant and Protiviti reports fall under the express protections of section 5111 as
a matter of federal law.
Second, Bayview would note that the conduct and conclusion of the MMC
investigation into the Breach fully took into account this protection. The Consent

Order itself memorialized that:
State Mortgage Regulators, pursuant to their respective books and
records requirements, are entitled to access privileged and confidential
information related to Respondents investigation into the incident,
including, but not limited to, assessment and root cause reports
(“Incident Investigation Materials”). Further, the State Mortgage
Regulators access to such Incident Investigation Materials is an
important supervisory function. Such information is treated by the State
Mortgage Regulators as confidential supervisory information and thus
exempt from disclosure under the Secure and Fair Enforcement for
Mortgage Licensing (“SAFE”) Act, applicable state law, and the
CSBS/AARMR Protocol and Agreement, and the disclosure of the
Incident Investigation Materials does not act to terminate the
confidential and privileged nature of the information.
Consent Order, supra at 6.

Plaintiffs on the other hand argue that Bayview’s bold reliance on section
5111 fails to sustain its continued work product claim to reports that it voluntarily
disclosed to an adversary. Plaintiffs argue that the SAFE Act applies exclusively
to the NMLS that is an online database that manages licenses for companies and
individuals in the financial services industry. The MMC, however, operates its own
platform for use during examinations. And its Mortgage Examination Manual
provides: “[T]he MMC does not send, receive, or request transmission of
unencrypted electronic non-public sensitive information. The MMC uses Box (MMC
Exam Platform) as a tool to securely disseminate information. The MMC Exam
Platform allows both examiners and MMEs to share information.”4

Thus, while the MMC has access to the NMLS for information relating to
MMEs, i.e., Bayview and the related Defendants, it does not use the NMLS to
exchange examination-related materials directly with MMEs. And, most
importantly, Defendants’ decision to waive work-product protection was made as a
result of direct discussions with the MMC without the application of an express

confidentiality agreement between the parties. The Reports were shared by
BakerHostetler (defense counsel) directly to the MMC, without any confidentiality
agreement (and outside the scope of the NMLS). [D.E. 264 at 11 (citing D.E. 218-1
(Exh. 18 at 2-4))].
II. ANALYSIS

To refresh our collective recollection, we start by acknowledging that the
Court’s initial decision deeming these Reports to be protected work product was a
close call. Courts in our Circuit have used either the primary purpose or dual
purpose test in addressing similar claims of work product protection. Goosby v.
Branch Banking & Trust Co., 309 F. Supp. 3d 1223, 1234 (S.D. Fla. 2018). Under

the primary purpose test, a document is protected “as long as the primary
motivating purpose behind the creation of the document was to aid in possible

4 MMC Mortgage Examination Manual at 15, supra n.1.
future litigation.” Id. at 1233 (quoting United States v. Davis, 636 F.2d 1028, 1040
(5th Cir. 1981)). With the dual purpose test, “even if a document has some purpose

within the ordinary course of business, the document is protected as work product
if it is substantially infused with litigation purpose.” Id. (quoting Devs. Sur. &
Indem. Co. v. Harding Vill., Ltd., No. 06-21267CIV, 2007 WL 2021939, at *2 (S.D.
Fla. July 11, 2007) (emphasis added)). This Court has previously found that it
“view[s] the issue from a practical standpoint” and looks to whether litigation was

one important reason for the creation and use of a document. See, e.g., Van Calcar
v. Royal Caribbean Cruises, Ltd., No. 14-20280-CIV-Cooke/Torres, 2014 WL
12861855, at *3 (S.D. Fla. Nov. 19, 2014); Button v. Royal Caribbean Cruises, Ltd.,
No. 12-23624-Civ-Ungaro/Torres, 2013 WL 12064489, at *5 (S.D. Fla. June 25,
2013). And that view is now a majority view among the circuits. See, e.g., United

States v. Deloitte LLP, 610 F.3d 129, 138 (D.C. Cir. 2010) (“a document can contain
protected work-product material even though it serves multiple purposes, so long
as the protected material was prepared because of the prospect of litigation.”)
(collecting cases); but see United States v. El Paso Co., 682 F.2d 530, 542 (5th Cir.
1982) (anticipation of litigation must be the “primary motivating purpose” behind

a document’s creation in order to fall within the work product privilege).
Based on this line of authority, the Court found that the Reports were
protected under the work production privilege’s dual purpose test. See also In re
Experian Data Breach Litig., No. SACV 15-01592, 2017 WL 4325583, at * 2-3 (C.D.
Cal. May 18, 2017) (the court found that “Mandiant conducted the investigation
and prepared its report for [outside counsel] in anticipation of litigation, even if that
wasn’t Mandiant’s only purpose” and, therefore, it was protected work product); In

re Marriott Int’l Inc. Customer Data Sec. Breach Litig., MDL No. 19-MD-2879, 2021
WL 2660180 (D. Md. June 29, 2021) (because Marriott had retained IBM to provide
the services specific to assisting BakerHostetler in providing legal advice to
Marriott, the documents related to the consultant’s investigation were protected
attorney work product).

But had the record clearly evidenced that litigation investigation was a far
less important consideration, and that corporate business reasons predominated
over the creation of these reports in the first place, the outcome should have been
different. So before turning to the waiver arguments that the Court anticipated
being the focus of the discussion on this motion, let’s turn back to the work product

issue and reconsider whether we need to take a different approach for these two
reports.
A. Whether the reports can still be treated as work product
It is axiomatic that a document primarily prepared for business or corporate
governance purposes is not privileged just because it is prepared by counsel or her
agents. So even in cases that have led the charge in favor of the dual purpose or

“because of” tests, like the Second Circuit in United States v. Adlman, documents
that fall within that scope are not protected:
Where a document is created because of the prospect of litigation,
analyzing the likely outcome of that litigation, it does not lose protection
under this formulation merely because it is created in order to assist
with a business decision. Conversely, it should be emphasized that the
“because of” formulation that we adopt here withholds protection from
documents that are prepared in the ordinary course of business or that
would have been created in essentially similar form irrespective of the
litigation. It is well established that work-product privilege does not
apply to such documents.
United States v. Adlman, 134 F.3d 1194, 1202 (2d Cir. 1998) (emphasis added).
In that case, for instance, the Court upheld application of the work product
privilege to tax-related documents generated by an accountant and counsel that
analyzed the benefits, proposed methods, and potential litigation risks of a corporate
merger and restructuring contemplated by a corporation. Even though this analysis
was grounded on business-related purposes, i.e. an evaluation of a proposed corporate
restructuring, the Court found that it could still be protected as work product because
it also was generated with anticipated litigation by the IRS in mind. Id. at 1195 (“It
proposed possible legal theories or strategies for Sequa to adopt in response,
recommended preferred methods of structuring the transaction, and made

predictions about the likely outcome of litigation.”). Notably, however, the Court
remanded the dispute back to the District Judge to determine if the business purpose
predominated:

Whether it can fairly be said that the Memorandum was prepared
because of that expected litigation really turns on whether it would have
been prepared irrespective of the expected litigation with the IRS. If the
district court concludes that substantially the same Memorandum
would have been prepared in any event—as part of the ordinary course
of business of undertaking the restructuring—then the court should
conclude the Memorandum was not prepared because of the expected
litigation and should adhere to its prior ruling denying the protection of
the Rule.
Id. at 1204 (emphasis added).
The Court’s original Order in this dispute understood these principles and
applied them to the facts then available in the record. The Court’s review of the

supporting materials evidenced a consultant’s report prepared for counsel in
anticipation of litigation filed by aggrieved customers who would likely claim that
the data breach was Defendants’ fault. That anticipated litigation, like the looming
IRS audit and challenge in Adlman, was not just possible; it was likely. Hence, the
Court deemed the work product privilege to be plausibly asserted even though there

were other business interests that were relevant to their creation in the regular
course of Bayview’s business, including the responsibility of helping to identify and
fix the breach.
That assessment, however, may have been hasty. What the Court then did
not appreciate was how central these two “privileged” reports were in Bayview and

Defendants’ compliance with the regulatory framework it was duty-bound to follow.
The record submitted on the motion for reconsideration, which the Court has
reviewed at length, evidences that these two reports per se played a far more central
purpose in Bayview’s regulatory compliance. According to the regulations
governing its operations, and as the Consent Order now available to the Court

makes clear, “assessment and root cause reports” are required by the State
Mortgage Regulators as part of the company’s duty to maintain books and records
under the laws of each participating State in which it does business. And when an
MMC investigation is required, those root cause reports are required to be turned
over to the MMC examiners as part of the MMC’s “important supervisory function.”
Consent Order, supra at 6.

So, absent any alternative report prepared outside of the sphere of work
product that could be submitted in their place, Bayview’s unredacted submission of
these two work product reports when the MMC demanded the root cause reports
evidences only possible conclusion: the predominant purpose for the creation of the
reports was for regulatory compliance – a factor that the Court’s original Order

assumed was not the case. The Court’s original review of the record showed that
Bayview’s data breach investigation was an ancillary part of its operations, which
primarily involve mortgage lending. But these regulations – most of whom Bayview
and Defendants have pointed us to – illustrate the central purpose that data
maintenance compliance has in its day-to-day operations in accordance with the

participating States licensing authority.
That change in course has one clear ramification. We cannot deem the
generated reports to be work product, under the dual purpose test that we believe
to be bound by, unless we find that there is something in the reports that, but for
the anticipated litigation, would not have been there in the ordinary course of

Bayview’s business. As Adlman put it, we are obligated to determine “whether the
Memorandum studying the tax implications of the contemplated restructuring
would have been prepared in substantially similar form regardless whether
litigation was contemplated, and thus was not prepared ‘because of’ the expected
litigation.” 134 F.3d at 1203. So if the same report, and same factual analysis in
the reports, was going to be drafted and submitted as part of the regulation’s root
cause requirements, then anticipation of litigation falls by the wayside.

In other words, our original conclusion simply was based on the conclusion
that litigation defense did not have to be the primary reason for the creation of the
document. So even if business interests were also being addressed through the
investigators’ work product, the attorney work product protection prevailed. But
what we failed to appreciate was this other aspect of the dual purpose test: if the

primary purpose for the document was for business reasons, and the document
would have been created as is even if lawyers and their agents had no role, can the
document still be work product? The answer, according to the courts of appeal that
have addressed this, is no.
Take, for instance, the Ninth Circuit’s application of the dual purpose test.

That circuit formally adopted the dual purpose test long ago that, to qualify for
work-product protection, documents must: (1) be “prepared in anticipation of
litigation or for trial” and (2) be prepared “by or for another party or by or for that
other party’s representative.” In re Grand Jury Subpoena, 357 F.3d 900, 907 (9th
Cir. 2004). In circumstances where a document serves a dual purpose, that is, where

it was not prepared exclusively for litigation, then the “because of” test is used. Id.
Dual purpose documents are deemed prepared because of litigation if “in light of
the nature of the document and the factual situation in the particular case, the
document can be fairly said to have been prepared or obtained because of the
prospect of litigation.” Id.
In applying that test in a case analogous to this one, the Ninth Circuit held
in United States v. Richey that the dual purpose test did not protect a tax

appraiser’s work file that was generated, at the direction of counsel, to provide
valuation services and advice in connection with a conservation easement owned
by a partnership that was used to claim a charitable tax deduction on the
partnership’s tax return. 632 F.3d 559, 562 (9th Cir. 2011). Work product
protection was claimed when the IRS balked at the deduction and issued an IRS

summons for documents. The partnership argued, like Bayview, that litigation was
anticipated by counsel when the tax review was initiated and thus the appraiser’s
work was protected even though much of that same work was used to prepare the
tax return in question. The district court agreed with that argument under the
dual purpose test, but the Ninth Circuit reversed, citing Adlman, because the

record evidenced a legal requirement to prepare the very same documents in
connection with the tax return. A key part of this was an appraisal report prepared
by the appraiser that was attached to the return, which the court found critical to
the analysis: “Had no appraisal report been attached to the Peskys’ 2002 federal
income tax return, the Taxpayers would have been ipso facto ineligible for any

charitable deduction as a result of the contribution of the Easement. Had the IRS
never sought to examine the Taxpayers’ 2003 and 2004 federal income tax returns,
the Taxpayers would still have been required to attach the appraisal to their 2002
federal income tax return.” Id. at 568. The district court thus erred in treating the
work papers as work product even if a lawyer retained the appraiser to conduct
that review and even though litigation with the IRS was anticipated. “Considering
the totality of the circumstances, we cannot properly conclude that the appraisal

work file ‘can be fairly said to have been prepared or obtained because of the
prospect of litigation.’” Id.
Using these consistent circuit cases as our guide in the absence of Eleventh
Circuit precedent to the contrary, our conclusion that these two reports were work
product must be reconsidered under the dual purpose test. The Court finds that

litigation purpose was only a tangential reason for their creation; instead, based on
the current available record they were primarily created as part of Bayview and
Defendants’ obligation to comply with regulatory obligations owed to their state
regulators and, if necessary, in compliance with their duty to provide root cause
reports in the event of a data breach. Even after complying with the MMC’s

demand for these root cause reports, it turned out that Bayview was still liable for
breach of its compliance requirements under the law to the tune of $19 million.
That sum would undoubtedly have even been greater had the MME found that
Bayview failed to prepare or provide root cause reports when requested as part of
this investigation. Hence, the record shows that these reports would have been

prepared and submitted to the MMC even if they were generated by an investigator
that did not report to or ever deal with BakerHostetler. There is no better evidence
for this than Bayview’s admission that the reports were turned over without
redaction and without any qualification in order to be “helpful” to the investigation.
How would that production be any different than an appraisal report attached to
an IRS tax return that was mandated by law? The legal duty to provide that type
of information pre-existed any attorney retention or prospect of litigation.

Bayview would stand on stronger footing, of course, if the reports had not
been summarily turned over and, instead, simply being a source for a separately-
created document that would be used as the root cause report. In that case, any
particularly sensitive findings targeting the prospect of litigation could have been
omitted, while leaving intact factual information generated during the course of

that multi-purpose investigation. Perhaps that is how Bayview and similar entities
should deal with these problems in the future. But the record shows that this is
not what happened here.
In sum, by turning over these reports in this way in order to comply with
their legal obligations to prepare root cause reports, no work product protection was

generated even though litigation was a factor in their creation. The predominant
reason for their creation was regulatory compliance for regulators who could levy
significant penalties against Bayview. Under the dual purpose test, this unique
legal duty to produce these reports overwhelms any ancillary litigation purpose. So
these documents are not, then, “dual purpose” documents; they are primarily

corporate compliance documents that have no privilege attached to them.
Further support for this reconsideration is found in the same cases the Court
analyzed in reaching its earlier conclusion. In a key case that Bayview cited, which
was applying Ninth Circuit’s dual purpose test, In re Experian Data Breach Litig.,
No. 15-01592, 2017 WL 4325583 (C.D. Cal. May 18, 2017), the court denied the
plaintiffs’ motion to compel a third-party investigator’s report and documents
related to the investigation of a data breach event. In that case, when Experian

learned that one of its systems was breached, it retained the law firm Jones Day
for legal advice regarding the attack. In turn, Jones Day retained Mandiant to
conduct an analysis of the attack. According to Experian, the only purpose of that
report was to assist Jones Day in providing legal advice to Experian regarding the
attack, realizing that Experian’s own experts lacked sufficient resources. Id. at *2

(emphasis added).
In their motion plaintiffs argued that because Experian had independent
business duties to investigate any data breaches and it hired Mandiant to do such
work, the expert report was not work product. Id. at *2. The court rejected that
argument, reasoning that Mandiant was hired by Jones Day to assist the lawyers

in providing legal advice to the client in anticipation of litigation. And most
notably, the court relied on the fact the report as a whole was only turned over to
the lawyers. There was no discussion or any mention of the report being produced
wholesale to any third party, nor was there any issue about production of the report
as part of the finance company’s regulatory compliance.

To the contrary, the court’s analysis affirmatively relied on the fact the report
as a whole was not turned over to anyone, even those within the client’s operations.
Selected portions of the report were in fact provided to a team of personnel from
Experian’s “Incident Response Team” to assist in their remediation efforts. But the
court’s opinion took pains to point out that these selected portions were limited for
that purpose: “If the report was more relevant to Experian’s internal investigation
or remediation efforts, as opposed to being relevant to defense of this litigation, then

the full report would have been given to that team. The evidence here establish that
Jones Day instructed Mandiant to do the investigation and, but for the anticipated
litigation, the report wouldn’t have been prepared in substantially the same form or
with the same content.” Id. at *2 (emphasis added).
In measuring the Experian decision by the standards adopted in the Ninth

Circuit, Second Circuit, and elsewhere, it is indeed a proper application of the dual
purpose test for the simple reason that the court found that business purposes (like
assisting in remediation efforts) were not the predominant reason for the
document’s creation. And had it been, the opinion is recognizing on its face that
the outcome would be very different because in that case it “would . . . have been

created in substantially similar form [even with] the prospect of that litigation.” Id.
at *1 (quoting In re Grand Jury Subpoena, 357 F.3d at 908) (alteration added).
In following that correct decision here, however, the Court overlooked a
critical factual difference. Frankly, perhaps the record before the Court at the time
of the initial Order should have been enough to distinguish this case. But apologies

aside, the record is crystal clear now, especially after we have the benefit of the
Consent Order that Defendants entered into with the participating State regulators
in December 2024. Unlike Experian, these attorney-mandated reports were in fact
turned over, in wholesale fashion, to these third parties because of the regulatory
duty to provide “root cause” reports in connection with an MME investigation.
Bayview was legally obligated to do so. By generating these reports, Bayview was
complying with its legal obligations and would have had to do so, with the same

reports, even if counsel had never been hired and legal work product had never
been requested. So, under the dual purpose test that the Court was purportedly
following in its initial Order, these reports should not have been deemed work
product. See also In re Premera Blue Cross Customer Data Sec. Breach Litig., 296
F. Supp. 3d 1230, 1246 (D. Or. 2017) (compelling production of Mandiant reports

over work product objection; “the Court concludes that Premera has not shown that
all of the underlying documents relating to the Mandiant reports were created
because of anticipated litigation and ‘would not have been created in substantially
similar form but for the prospect of litigation.’”) (quoting United States v. Richey,
632 F.3d at 568).

Other similar decisions applying the dual purpose test are in accord with this
analysis. For instance, in Wengui v. Clark Hill, PLC, No. 19-3195, 2021 WL 106417,
(D.D.C. Jan. 12, 2021), Judge Boasberg was following the same dual purpose test
that the D.C. Circuit adopted in United States v. Deloitte LLP, 610 F.3d 129, 137
(D.C. Cir. 2010) (applying because of test: “a document can contain protected work-

product material even though it serves multiple purposes, so long as the protected
material was prepared because of the prospect of litigation.”) (remanding work
product finding for further examination to determine if portions of auditor’s report
would have been created irrespective of litigation). There a plaintiff's personal
information collected by his former law firm/defendant was hacked by a third party,
leading to a lawsuit against the law firm. The plaintiff sought production of reports
of forensic investigations into the cyberattack. The firm resisted, claiming that the

documents sought by plaintiff were produced by external security-consulting firm
Duff & Phelps, retained by outside litigation counsel, and therefore, were covered
by both the attorney client privilege and work product. Id. at *2. The court
compelled production of the reports because the firm “has not met its burden to
show that the Report, or a substantially similar document, ‘would [not] have been

created in the ordinary course of business irrespective of litigation.’ ” Id. at *5
(quoting Banneker Ventures, LLC v. Graham, 253 F. Supp. 3d 64, 72 (D.D.C. 2017)).
Further support for that conclusion was found in the fact the subject report was,
not only shared with outside counsel, but produced to firm leadership and personnel
as well as the FBI that investigated the hack. Based on these facts, the court

concluded that “the Report was shared this widely because it was the one place
where [defendant] recorded the facts of what had transpired,” all of which evidenced
that the vendor had a more far-reaching role than merely assisting outside counsel
in preparation for litigation. Id. at *12-13.
That analysis is certainly quite analogous to the record presented here.

When push came to shove, Bayview did not generate a root cause report separate
and apart from the Mandiant and Protiviti reports. Instead, it simply turned the
reports over to the MMC. Why? Because the record shows that was what Bayview
had to evidence its compliance with its regulatory obligations to properly
investigate any such data breach. That fact, as in Wengui, underscores that the
overarching purpose for the investigation and the report focused on corporate and
regulatory compliance as opposed to legitimate litigation needs. So, like the report

produced in Wengui, the work product nature of the report evaporates because the
report would clearly have had to be created whether or not litigation was also
anticipated.
Again, nothing stopped Bayview from requesting different reports from the
consultants. For instance, Mandiant could have generated two separate reports;

one for the lawyers and in house counsel, and another report with selected portions
of the main report for use as the root cause report. And then that second report
could have been produced during the MME’s investigation. Under those
circumstances, the dual purpose test properly applied would allow for such a
distinction between the two reports. See, e.g., Maldondo v. Solara Med. Supplies,

LLC, No. 20-12198, 2021 WL 8323636, at *1-3 (D. Mass. June 2, 2021) (denying
production of main work product report prepared by examiner hired for data breach
investigation; law firm hired examiner to perform a privileged forensic
investigation into the incident to assist the attorneys in providing legal advice to
the company, as well as a separate report (already produced in discovery) originally

intended for submission to Federal Trade Commission for regulatory purposes).
For whatever reason that did not happen here. The reports were produced
to counsel first and then re-produced in their entirety to the MMC as being
tantamount to the root cause report. That renders the same document a
prototypical regulatory document, required by law, that would have been generated
and produced even absent any law firm’s involvement or litigation being
anticipated. Under the dual purpose test, that report does not possibly qualify as

work product.
Accordingly the motion for reconsideration is Granted and the Court now
enters this Order that deems the documents at issue to fall outside the protection
of the work product doctrine. Defendants are compelled to produce the Mandiant
and Protiviti reports to Plaintiff subject to the Court’s Confidentiality Order.

B. Whether any work product privilege was waived
Given the Court’s reconsideration of the underlying work product claim,
there is no urgent need now to tackle the waiver issue as originally intended. That
is because the documents at issue are not work product in the first place, so they
are not any more unprotected now that they were turned over to the MMC. And
indeed, as discussed above, that wholesale production to the MMC evidences why

the document is not work product under the rule of decision that governs here.
A few points will still be addressed, however. Assuming the documents are
work product in the first place, Plaintiffs argue that the production of the reports
to the MMC constitutes a waiver of the protection in their entirety. And
Defendants’ argument, urging application of the selective waiver doctrine to allow

the reports to retain their work product protection, should be rejected. We agree
that the selective waiver doctrine would have no bearing here based on the majority
view of the circuits that such a doctrine does not shield production of documents
turned over to an adversary. See, e.g., In re Columbia/HCA Health Care
Corporation Billing Practices Litig., 293 F.3d 289 (6th Cir. 2002). Under this view
courts should reject the concept of “selective waiver” and hold that a voluntary

disclosure to one’s adversary is a waiver as to all adversaries. See id. at 306 (a
company cannot “pick and choose to which adversaries [it would] reveal
documents”) (alteration in original).
The record here shows that, at the time of their production to the MMC, the
reports were produced to stave off any penalties or findings of non-compliance

arising from the participating States’ laws and regulations. That MMC’s
investigation was clearly potentially adverse to Bayview and Defendants at the
time it was conducted given the possibility of penalties or sanctions that could be
levied. So under the voluntary waiver concept, Bayview’s decision to produce the
entire reports to the MMC would ordinarily foreclose any claim now to assert work

product protection in subsequent litigation.
That is especially true where production of work product to an adversary is
done without the cover of an express confidentiality agreement, court order,
subpoena, or other form of compulsion on which one could rely in disputing that
any voluntary waiver ever took place. And here there is no dispute that no specific

document was executed or relied upon at the time the documents were produced.
See also In re Steinhardt Partners, L.P., 9 F.3d 230, 235 (2d Cir. 1993) (“Once a
party allows an adversary to share the otherwise privileged thought processes of
counsel, the need for the privilege disappears.”) (rejecting idea of selective
disclosure adopted by some courts and holding that company’s transmittal to SEC—
a potential litigation adversary—of memorandum prepared by company attorney
in response to agency inquiry waived document’s work-product protection as to

shareholder plaintiffs in subsequent litigation).
On the other hand, we are not going to make a definitive finding on this score.
The same regulatory backdrop and documentation that the Court has reviewed in
connection with the section above does reveal an arguable basis to find that
production of these documents under an MME process, if demanded by a state

regulator as was done here, does not give rise to a waiver. Defendants have
presented a persuasive argument that their litigation privileges are expressly
preserved from waiver/forfeiture by operation of statute. Even if this MMC’s
investigation is sufficiently adversarial, Defendants point to the fact the context of
the disclosure was based on the MMC’s statutorily-driven examination under the

auspices of the NMLS. An aspect of this regulatory framework involves specific
examinations like this one, all of which fall under the umbrella of the Federal
Secure and Fair Enforcement for Mortgage Licensing Act (“SAFE Act”), which
directs state regulators to establish and maintain the NMLS for the purpose of
coordinating supervision of the residential mortgage industry. This statute also

recognizes and preserves the privileged nature of information and documents
provided to the NMLS:
Except as otherwise provided in this section, any requirement under
Federal or State law regarding the privacy or confidentiality of any
information or material provided to the Nationwide Mortgage Licensing
System and Registry or a system established by the Director under
section 5108 of this title, and any privilege arising under Federal or
State law (including the rules of any Federal or State court) with respect
to such information or material, shall continue to apply to such
information or material after the information or material has been
disclosed to the system. Such information and material may be shared
with all State and Federal regulatory officials with mortgage or financial
services industry oversight authority without the loss of privilege or the
loss of confidentiality protections provided by Federal and State laws.
12 U.S.C. § 5111(a) (emphasis added).
Further Bayview points out that section 5111 expressly preempts any state
open records law that would provide lesser protections. Id. at § 5111(c). And section
5111 also provides that “[i]nformation or material that is subject to a privilege . . .
under paragraph (a) of this section shall not be subject to: Subpoena or discovery, or
admission into evidence, in any private civil action. . . .” Id. at § 5111(b)(2). Hence
Bayview understandably argues that the production of its work product to the MMC
investigators would not waive or forfeit its work product protection because the
Mandiant and Protiviti reports fall under the express protections of section 5111 as
a matter of federal law. And even if they are not expressly related to the NLMS
licensing process, as Plaintiffs point out, they are still within the auspices of the
regulatory framework that ultimately gave rise to the MMC’s examination in this
case. The MME protocol cited by the Court above clearly suggests that this process
is part and parcel of the overall regulatory system that federal and state regulators
have agreed to follow with respect to multi-state institutions like Bayview and
Defendants.
Upon review of the statute and the regulations cited, Defendants have a
compelling argument that an MMC’s investigation does not fall outside the protection
contemplated by the statute. Why would it? The MME protocol was agreed upon
precisely to enforce compliance with federal and state laws. It would be incongruous
if the statutory confidentiality imposed by the statute is limited to only the initial
licensing and regular maintenance process, but withers once there is a specific

investigation by the same regulatory authorities if notice of a specific violation is
received. At least at first blush, that makes little sense.
There is an old saying in judicial circles that “when in doubt, leave it out.”
There is a certain clarity in that approach because it prevents idle hand wringing
over legal issues that are ultimately not necessary to the required outcome. We will
leave this debate over the legal effect of this statute on traditional voluntary
disclosure principles right there. Because these documents cannot qualify as work

product, application of the privilege-preserving language of the statute is a moot
point. We do so with the caveat that the statute does not save Bayview from the effect
of the Court’s earlier analysis. In other words, the statute may immunize disclosure
of otherwise protected documents on a selective waiver argument. But the converse
is not true: unprotected, non-work product documents do not magically become
privileged, by operation of this same statute, when they are turned over to MMC

investigators or other NLMS-related authorities. The statute arguably only
preserves the protection that already exists under the law so, as in this case, if that
governing law does not in fact apply then the statute has nothing to protect as a shield
against relevant discovery in a civil action.
Here, we have found on reconsideration that these reports do not qualify as
privileged work product based on how they were generated and the proper application
of the dual purpose test. When they were produced to the MMC investigating this
data breach, there was no work product to waive. They are primarily business and
regulatory-related documents that were required to be produced by law. Section 5111
thus has no bearing here because there is no privilege or legal protection to exempt
from the traditional application of federal or state legal principles. Those principles,
correctly applied, result in no legal protection for these reports from the normal rules
of discovery. And section 5111 does not create a work product immunity where none
existed.
In sum, we will table for a future case whether a work product-protected
investigative report loses that protection when mandatorily produced to an MMC
investigator. This case does not call for a final answer to that interesting question
because there is no work product-protected report to begin with.
IT. CONCLUSION
For the reasons set forth above, Defendants shall produce to Plaintiffs the
Mandiant and Protiviti reports at issue within seven days of this Order. Defendants’
objections to the related discovery requests are Overruled. The pending motion for
reconsideration [D.E. 218] is GRANTED. The Court’s Order entered June 12, 2024
[D.E. 211] is VACATED.
DONE AND ORDERED by the Court this 27th day of March, 2025.

<= G. TORRES
United States Magistrate Judge

Page 30 of 30

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/10832639. Public record. Not legal advice.