Contract analysis

I. BACKGROUND At the direction of Victoria Chambers, I conducted a preliminary consultation with Maître Amadou Dossou of Dossou & Mensah Avocats, based in Abidjan, Côte d'Ivoire. The initial consultation took place by videoconference on September 22, 2022, with a follow-up telephone call on October 3, 2022. This memorandum summarizes the substance of those discussions and the preliminary legal guidance provided by Ma

II. KEY LEGAL ISSUES A. Loi n° 2013-450 (Data Privacy) The principal data-privacy statute in Côte d'Ivoire is the Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel (the "Data Privacy Law"). This law establishes a comprehensive framework governing the collection, processing, storage, and transfer of personal data, broadly modeled on the European Union's former Data Protection D

1. Prior Authorization for Cross-Border Transfer (Article 36). Article 36 of the Data Privacy Law provides that the transfer of personal data to a country that does not provide an "adequate level of protection" (niveau de protection suffisant) requires prior authorization from ARTCI. The adequacy determination is made by ARTCI based on a number of factors, including the nature of the data, the purpose and duration of

2. Employee Consent (Article 10). Article 10 of the Data Privacy Law provides that personal data may be lawfully processed where the data subject has given "free, specific, informed, and express" (libre, spécifique, éclairé et exprès) consent. This consent standard is broadly consistent with the consent requirements under the European Union's General Data Protection Regulation ("GDPR"), though the specific interpreti

3. ARTCI Filing (Article 34). Article 34 of the Data Privacy Law requires that any processing of personal data be declared to ARTCI prior to commencement. This declaration is a prerequisite to lawful data processing and is separate from, and in addition to, the cross-border transfer authorization discussed in Section II.A.1 above. Maître Dossou advised that we should confirm whether TWA has previously filed a general

1. Confidentiality of Employee Communications. Ivorian employment law is principally governed by the Code du Travail, Loi n° 2015-532 du 20 juillet 2015 portant Code du Travail (the "Labor Code"). The Labor Code, together with general principles of Ivorian civil law and constitutional protections, recognizes an employee's right to privacy in personal communications, including communications conducted through employer

2. Disciplinary Proceedings. Maître Dossou advised that, in the event the investigation reveals misconduct by Cédric Anouma or any other TWA employee, any disciplinary action taken by TWA must comply with the substantive and procedural requirements of the Labor Code. The failure to follow proper disciplinary procedures could expose TWA to wrongful-termination claims before the Ivorian labor courts (Tribunal du Travai

3. Whistleblower Protections. Côte d'Ivoire enacted Loi n° 2018-867 du 19 novembre 2018 portant répression de la corruption et des infractions assimilées (the "Anti-Corruption Law") as part of a broader legislative effort to strengthen the country's anti-corruption framework. The Anti-Corruption Law includes provisions designed to protect individuals who report acts of corruption or related offenses to the competent

III. PRACTICAL RECOMMENDATIONS FROM MAÎTRE DOSSOU Based on the foregoing analysis, Maître Dossou provided the following practical recommendations for the conduct of the investigation with respect to TWA and the Abidjan office:

1. Formal retention of Dossou & Mensah Avocats. Formally retain Dossou & Mensah Avocats to serve as Ivorian local counsel in connection with the investigation. Upon retention, the firm would prepare a written legal opinion addressing the ARTCI authorization process, the requirements for lawful cross-border data transfer under the Data Privacy Law, and the applicable employment-law considerations. The firm would also

2. Preparation of employee-consent forms. Prepare employee-consent forms, drafted in French, for each of the three key custodians at the Abidjan office — Cédric Anouma, Yves Kouadio, and Adama Coulibaly. The consent forms should clearly describe the purpose of the investigation, the categories of data to be collected, the intended cross-border transfer of data, the identity and location of all recipients, and the emp

3. Review of TWA's IT acceptable-use policy. Conduct a review of TWA's existing IT acceptable-use policy (if any) to confirm that the company has reserved the right to access professional email communications stored on company systems. If no such policy exists, or if the existing policy is inadequate, Maître Dossou recommended that TWA adopt an acceptable-use policy that clearly sets out the employer's right of acces

4. Coordination with other local counsel. Coordinate with Papadakis & Lekkas LLP on Greek-law data-transfer requirements, given that certain records and communications may be transferred to TSL's offices in Piraeus, and with Okafor Bassey & Partners on analogous data-protection requirements under the Nigeria Data Protection Regulation ("NDPR"). The coordination with Nigerian counsel is particularly important because

5. Budget estimates. Maître Dossou provided the following preliminary budget estimates for his firm's engagement: • ARTCI filings and consent-form preparation: Approximately €15,000–€25,000 (approximately $15,750–$26,250 at the June 2022 exchange rate of €1 = $1.05). • Full engagement as Ivorian local counsel for the investigation (including support for employee interviews, preparation or certification of the French-

IV. NEXT STEPS All next steps identified in this memorandum are currently pending due to the dormancy of the matter, which has been dormant since September 30, 2022, following Nikolaos Karavelis's request that the firm pause all external legal spend pending internal budget discussions at TSL. No further action will be taken until the matter is formally reactivated by TSL. Upon reactivation, the following actions shou

1. Formally retain Dossou & Mensah Avocats as Ivorian local counsel, pursuant to an engagement letter to be prepared by Calderwood & Harkness LLP and approved by Dimitra Karavelis-Stavrou.

2. Confirm TWA's existing data-processing declarations and IT acceptable-use policies. This should be accomplished through a targeted request to TWA's management — most likely directed to Yves Kouadio (Finance Manager), given Mr. Anouma's status as a subject of the investigation — for copies of any existing ARTCI declarations, IT policies, employee handbooks, and related documentation.

3. Prepare and obtain employee-consent forms. Draft the consent forms in French, in coordination with Dossou & Mensah Avocats, and present them to the three key custodians (Anouma, Kouadio, and Coulibaly) in accordance with the procedures recommended by Maître Dossou.

4. Obtain ARTCI authorization for cross-border transfer. Prepare and submit the necessary applications to ARTCI for authorization of the cross-border transfer of personal data from TWA in Abidjan to Calderwood & Harkness LLP in New York and to TSL in Piraeus. It should also be noted that the preparation of the French-language translation of the Upjohn warning script — a draft of which was prepared by Jasmine Thornton