Managing Risks and Costs of Litigation: A Business Perspective

3 December 2019

Litigation is a costly business. However by reducing the risks associated with litigation before it arises, those costs can be limited by a company.

In the second of our series of breakfast seminars, held on Wednesday 6 November at the Fitzwilliam Hotel, our EFC panel speakers addressed how risk and, in turn, costs might be minimised across the following three key aspects of litigation.

Regulatory Investigations

Investigations are an unfortunate risk of operating a business in a regulated space. These investigations are the most important means by which a regulator can ensure compliance with regulations. Investigations can take place either on a scheduled or unscheduled basis.

Regulatory investigations pose a number of risks to companies, which should not be underestimated. These include reputational risk, business risk (including fines) and the risk of negative publicity. Investigations also divert valuable resources away from the business and add an additional layer of often unanticipated costs on the company.

With this in mind, it is important that businesses manage the possibility of an investigation taking place in order to limit business disruption. There are a number of ways in which this can be done:

1. Plan: Put in place a plan to deal with the logistics of the inspection, to review and authorise search warrants (if required) and to record activities undertaken by investigators.

2. Engage: Engagement with an investigation is key. Be clear about the aim of the investigation, and what investigators need to consider to achieve this aim. If possible, seek to set ground rules to shape the investigation and limit business interruption. It is also important to have a representative shadow the investigators and record the investigation, if possible.

3. Delegate: To limit the costs and risks associated with an investigation, creating one point of contact with investigators can be vital. Similarly, contacts within the IT team should be arranged to streamline the flow of information on the technical side. It is also important to brief solicitors to protect the position of the company, as soon as notification of an investigation is received.

Subject Access Requests

The introduction of the GDPR in May 2018 has boosted public awareness of privacy rights. This in turn has led to an increase in the number of subject access requests received by companies. Every subject access request received bears a cost and risk implication for the company to whom it is sent, so it is important to put in place processes to manage and streamline the response to these requests.

Under Article 15 of the GDPR, individuals have enhanced rights to access personal data belonging to them, which is held by companies. The definition of personal data under the GDPR is very broad and the obligation to provide data on foot of a subject access request is significantly wider than the obligation to provide documents on discovery.

Handing over personal data on individuals which is held by a company inherently creates risk for the business. For example, where a company is in dispute with an individual, the data provided may be compared and contrasted by that individual against material received from the same company on discovery, in order to undermine the compliance of the company with their privacy obligations, or discovery obligations requirements.

All businesses must comply with their data privacy obligations and run the risk of a complaint being made by the data subject to the Court or to the Data Protection Commissioner if they do not do so.

Although the possibility of litigation does not absolve a company of its obligations, there are ways in which the risk associated with subject access requests can be managed.

For example, in some limited circumstances, a company can restrict the production of personal data to an individual. These include:

1. Article 15.4 of the GDPR: Where the production of personal data to an individual would adversely affect the rights and freedoms of others.

2. Section 60 of the Data Protection Act 2018: Where the restriction of data is necessary and proportionate, in certain circumstances.

3. Section 162 of the Data Protection Act 2018: Which allows privileged data to be withheld, in some instances.

Companies must pro-actively engage with subject access requests received. This in turn may reduce the costs incurred by the company in complying with a subject access request.


Discovery is an important part of the litigation process. It involves the exchange of documents relevant to the issue in dispute between the parties, before the case is heard by the Court.

Although originally envisaged to reduce the costs incurred, by narrowing the issues between the parties, discovery in fact often has the opposite effect, ballooning the costs incurred by parties to litigation.

This exposure to costs can be reduced by following a number of practical steps. The ability to limit the costs associated with litigation quickly disappears once discovery has been agreed or ordered by the Court, so these steps should be undertaken as soon as proceedings are issued.

1. It is important to set up a discovery project team at an early stage. The discovery process is often a lengthy one and the sooner a project team is put in place, the sooner the company can understand the types of data held, where that data is located, and how wide the collection of data will be.

2. The putting in place of a discovery team at an early stage can allow a company to start to identify potentially relevant documents quickly. This can provide a company with a litigation advantage by increasing your chances of capturing all relevant data, making the discovery exercise more defensible and reducing the chance for mistakes to be made due to time pressure. Critically, it can also help to inform the company’s litigation strategy at the outset of the proceedings.

3. Preservation of data is key to completing a fully defensible discovery exercise. As soon as a party becomes aware of litigation, they are under an obligation to preserve all material relevant to the dispute. Once identification of data is complete, then a company can put in place a litigation hold over potentially relevant data, and send any necessary preservation notices to third parties. This reduces the risk of a future complaint by an opposing party on the adequacy of discovery, avoiding a possible costs sanction by the Court and in turn limiting the costs incurred by a company in complying with its discovery obligations.

By taking these practical steps to limit business interruption, companies can reduce the risk associated with litigation and create a commensurate saving on costs to benefit the business in the short term.

For further information please contact one of the team members below or your usual contact at Eugene F Collins.

David Hackett, Head of IP/IT & Data Protection
Paul Dempsey, Associate, Dispute Resolution
Donal Dunne, Associate, Dispute Resolution

< Back