Fraud and the sufficient connection test

In September 2018, the High Court addressed the question of whether section 2(3) of the Criminal Justice Act 1987 had extraterritorial effect in KBR Inc, R (On the Application Of) v The Director of the Serious Fraud Office.

The Serious Fraud Office (SFO) was investigating KBR Ltd in the UK for suspected bribery and corruption. The SFO invited a senior member of the US parent company, KBR Inc, to a meeting in London at which it presented her with a notice demanding the disclosure of documents held by KBR Inc in the US. KBR Inc challenged both the validity of the notice and the process by which it was served. The High Court acknowledged concerns about allowing the SFO to make unrestricted demands for overseas documents without the judicial oversight provided by mutual legal assistance (MLA) procedures. However, it also noted that many SFO investigations had an international dimension meaning relevant documents inevitably would be outside the UK. The court’s solution was to strike a ’careful balance’ between these competing factors by requiring, first, that the notice could only be served within this jurisdiction and, second, that the foreign custodian company should have a ’sufficient connection’ to the UK. The court explained that this balance was ’principled’ because ’the existence of some extraterritorial reach guards against the risk of SFO investigations being frustrated or stymied while the requirement of a “sufficient connection” justifies the extraterritorial application of s.2(3) by reference to the foreign company’s own actions linked to the UK.’ The High Court found the SFO’s tactic of bringing the senior representative into the jurisdiction to present her with the notice to be ’unappealing’, but this did not make the notice unlawful.

Following the decision in KBR, lawyers advising overseas companies caught up in an SFO investigation have been considering the practical application of the ’sufficient connection’ test and, no doubt, suspiciously eyeing invitations to senior executives to the SFO Christmas Party. However, this time next year, at least for US companies, these concerns may be irrelevant.

The careful and principled balance struck by the High Court will be swept aside by the introduction of Overseas Production Orders (OPOs) which, Brexit uncertainty permitting, will enter into force in early 2019. UK law enforcement agencies will be able to apply to court for an OPO to be issued directly to an overseas company, irrespective of its connection to the UK, for the production of any ’electronic data’ that is ’likely to be of substantial value’ to the investigation of an indictable offence. The company must be located in a country with which the UK has a ’designated international co-operation arrangement’ that ’relates… to the provision of mutual assistance in connection with the investigation or prosecution of offences.’ Accordingly, OPOs will derive their legal force from the UK’s international MLA treaties, but are intended to eliminate the delay and complexity that prevents the efficient provision of traditional MLA.

The main difference between a s2(3) notice and an OPO is that the former is within the discretion of the SFO, whereas the latter must be issued by a UK court. But there will be no judicial oversight in the country where the company is based, so complex questions of privilege, confidentiality and data protection will be left for the company to resolve itself, or risk non-compliance.

The genesis of OPOs was the concern from UK law enforcement that, without streamlined and reliable access to communications data, primarily held by US email providers, our capability to detect, disrupt and prosecute terrorism and serious crime was handicapped. However, the Bill goes much further. The definition of ’electronic data’ is ’data stored electronically’, which could hardly be any wider: for most companies that is almost every piece of information in their possession.

In theory, this data will be within the SFOs reach without any need for a sufficient UK connection. In practice, OPOs are intended to dovetail with the Executive Agreement the UK is hoping to be granted under the US CLOUD Act, which permits US companies to disclose communications data directly, without the need for MLA procedures or judicial oversight, provided the requesting country is considered to meet certain human rights, data protection and due process standards. The UK is on the verge of being approved by the US Senate for the first such agreement.

However, given the definition of ’electronic data’ in the Bill, Parliament clearly intends the use of OPOs to extend much wider than emails. So, next year, senior US executives may not need to worry about being served with a s2(3) notice if they set foot in the UK, because the OPO might already be in the post.

Nick Vamos, partner, Peters & Peters Solicitors LLP