PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / LITIGATION PRIVILEGE / COMMON INTEREST PRIVILEGE — DO NOT DISCLOSE
INTERNAL MEMORANDUM
18 January 2024
From: Priscilla Wynn, Senior Associate, Privacy & Data Security Practice, Calderwood & Harkness LLP
Reviewed and Approved By: Rachel Bernstein, Partner, Privacy & Data Security Practice, Calderwood & Harkness LLP
To: Internal Distribution — Calderwood & Harkness LLP Engagement Team (Rachel Bernstein, Kevin Ostrowski, Priscilla Wynn, Alan Burke); Aurelius Global Media Group PLC (Sanjay Redworth, Group General Counsel & Company Secretary; Margaux Fontaine-Li, Group Data Protection Officer); Thistlewood Consulting Ltd (Marcus Drayford, Principal Consultant)
Matter Reference: C&H Matter No. 1017-00008
Subject: Common Interest and Privilege Protocol — Technical Cookie Audit and Data Flow Mapping Engagement of Thistlewood Consulting Ltd
Supersedes: N/A (initial protocol)
Right-click to update Table of Contents
1. PURPOSE AND BACKGROUND
1.1 Purpose of This Memorandum
The purpose of this memorandum is threefold.
First, this memorandum establishes and documents the legal privilege framework and common-interest protections applicable to the technical cookie audit and data flow mapping engagement to be conducted by Thistlewood Consulting Ltd ("Thistlewood") under the direction and supervision of Calderwood & Harkness LLP ("C&H") on behalf of Aurelius Global Media Group PLC ("AGMG"). The engagement involves a comprehensive technical assessment of AGMG's cookie-consent mechanisms, server-side tracking pixel deployments, and adtech vendor data flows across AGMG's European-facing digital properties. Given the sensitivity of the matters under investigation, the existence of active and anticipated regulatory proceedings, and the involvement of a third-party technical consultant, it is essential that a clear and robust privilege framework be established at the outset of the engagement to safeguard the interests of all parties.
Second, this memorandum sets out binding document-handling procedures, privilege markings, communication protocols, and restrictions on disclosure designed to preserve privilege over all work product, communications, and findings generated in connection with the engagement. These procedural safeguards are necessary to ensure that the involvement of Thistlewood as a technical consultant does not inadvertently undermine or waive any privilege that would otherwise attach to the audit findings and related legal analysis. The protocols set out herein are intended to be comprehensive and should be followed strictly by all recipients of this memorandum.
Third, this memorandum ensures that all parties — C&H, AGMG, and Thistlewood — understand and adhere to the protocols necessary to maintain both legal advice privilege and litigation privilege under the laws of England and Wales, and to benefit from common interest privilege protections in the context of a multi-party engagement of this nature. Each party's obligations are clearly delineated, and the consequences of non-compliance are made plain.
All recipients of this memorandum are expected to read it in full, to confirm their understanding of and agreement to its terms, and to ensure that their respective personnel comply with the protocols set out herein. Any questions regarding the application or interpretation of this protocol should be directed to Priscilla Wynn or Rachel Bernstein at C&H.
1.2 Background of the Engagement
Calderwood & Harkness LLP was retained by Aurelius Global Media Group PLC (Companies House No. 08741562; registered address: 140 Threadneedle Row, London EC2R 8AH, United Kingdom) pursuant to an engagement letter dated 12 January 2024 (C&H Matter No. 1017-00008). The engagement letter sets out the scope of C&H's instructions, the basis of C&H's fees, and the applicable terms of business. This memorandum supplements, but does not supersede, the terms of the engagement letter.
The engagement was triggered by two significant regulatory events, both of which give rise to actual or reasonably anticipated adversarial proceedings against AGMG.
CNIL Complaint and Formal Notice. On 8 November 2023, Digitale Rechte Europa e.V. ("DRE"), a Berlin-based digital rights advocacy organisation registered at Schönhauser Allee 167, 10435 Berlin, Germany, filed a complaint with the Commission nationale de l'informatique et des libertés ("CNIL"), the French data protection supervisory authority. The complaint was assigned reference PLT-2023-FR-04821. DRE's complaint concerns AGMG's French-language streaming platform, aurelius-stream.fr, and alleges, among other things, that forty-seven (47) third-party tracking cookies were deployed on the platform before any user consent was obtained, in contravention of Article 82 of the French Loi Informatique et Libertés and the ePrivacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC). DRE further alleges that the cookie-consent banner deployed on aurelius-stream.fr employed so-called "dark patterns" designed to steer users toward acceptance of all cookies, including pre-ticked consent boxes, asymmetric button design, and the absence of a clear "refuse all" option at the first layer of the banner. DRE is represented in connection with the complaint by Kreisel & Hausmann Rechtsanwälte PartG mbB, Berlin, with Dr. Tobias Kreisel acting as lead attorney.
Following receipt and preliminary investigation of DRE's complaint, the CNIL issued a formal notice (mise en demeure) to AGMG on 14 December 2023, reference MED-2023-097. The formal notice identifies specific compliance deficiencies on aurelius-stream.fr and sets a three-month compliance deadline of 14 March 2024. Under French law, failure to comply with a CNIL mise en demeure within the specified deadline may result in the initiation of formal sanction proceedings before the CNIL's formation restreinte, which has the authority to impose administrative fines of up to €20 million or four per cent (4%) of the undertaking's total worldwide annual turnover for the preceding financial year, whichever is higher, as well as injunctions, orders to cease processing, and public censure.
ICO Informal Inquiry. Separately, the United Kingdom Information Commissioner's Office ("ICO") sent an informal inquiry letter to AGMG on 22 December 2023, reference ICO/ENF/2023/LTR-11084. The ICO's letter relates to the deployment of server-side tracking pixels on two of AGMG's UK-facing digital properties, aureliusnews.co.uk and shopaurelia.co.uk, and raises questions regarding the adequacy of consent obtained for analytics cookies under Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"). While characterised by the ICO as an "informal inquiry," the letter requests a substantive response within 28 days and expressly notes that the ICO reserves the right to escalate the matter to a formal investigation under section 146 of the Data Protection Act 2018. The ICO has the power to impose monetary penalty notices of up to £17.5 million (or four per cent of total annual worldwide turnover, whichever is higher) under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, as well as enforcement notices and assessment notices under PECR.
In light of these regulatory developments, C&H has been retained to undertake the following work on behalf of AGMG:
(a) audit existing cookie-consent mechanisms across all AGMG European-facing digital properties;
(b) map adtech vendor data flows across AGMG's fourteen (14) European-facing websites and three (3) mobile applications, which serve audiences in the United Kingdom, France, Germany, the Netherlands, Spain, and Italy, with approximately eighty-seven million (87,000,000) monthly active EU/EEA users;
(c) identify and remediate non-compliant practices in relation to cookie deployment, consent management, and data sharing with third-party adtech vendors;
(d) negotiate revised data processing agreements with key adtech vendors to ensure compliance with the GDPR, the UK GDPR, PECR, and applicable national implementing legislation; and
(e) prepare and deliver compliance responses to the CNIL (in respect of formal notice MED-2023-097) and the ICO (in respect of informal inquiry ICO/ENF/2023/LTR-11084).
AGMG's potential regulatory exposure in connection with these matters is significant. On the basis of AGMG's reported global annual turnover of approximately £1.42 billion for the financial year ended 31 December 2022, the maximum theoretical CNIL fine exposure is approximately €64.7 million (calculated at four per cent of global annual turnover at the approximate prevailing sterling-to-euro exchange rate). Based on a preliminary assessment of comparable CNIL enforcement actions and the nature of the alleged violations, C&H estimates the realistic range of a CNIL fine, absent successful remediation and cooperation, to be in the range of €3 million to €8 million. In the United Kingdom, the maximum ICO fine exposure is £17.5 million under the UK GDPR and DPA 2018, although ICO practice in PECR cookie-consent cases has historically resulted in lower penalties. These figures are provided for context and do not constitute a prediction of the outcome of any proceedings.
1.3 Role of Thistlewood Consulting Ltd
Thistlewood Consulting Ltd (registered at 9 Worship Street, London EC2A 2BF, United Kingdom) has been retained by AGMG, at C&H's direction and under C&H's supervision, to perform the technical component of the cookie audit and data flow mapping engagement. The engagement lead at Thistlewood is Marcus Drayford, Principal Consultant, who brings extensive experience in cookie scanning, consent management platform analysis, and adtech data flow assessment.
Thistlewood's scope of work encompasses the following:
(a) scanning all fourteen (14) AGMG European-facing websites and three (3) mobile applications to identify and catalogue all cookies, including first-party and third-party cookies, session and persistent cookies, and their classification by purpose (strictly necessary, functional, analytics, advertising, and social media);
(b) identifying and tagging all server-side tracking pixels and analogous tracking technologies deployed across the AGMG digital properties;
(c) mapping data flows from AGMG properties to third-party adtech vendors, including the identification of data recipients, data categories transferred, transfer mechanisms, and the legal bases relied upon for each data flow; and
(d) providing technical implementation support and recommendations for the remediation of identified non-compliances, including modifications to consent management platform configurations, cookie blocking scripts, and server-side tracking implementations.
The Thistlewood engagement is subject to a fixed fee of £145,000 (exclusive of VAT), which is treated as a pass-through disbursement under the C&H engagement letter and will be invoiced by Thistlewood to C&H for onward billing to AGMG. The technical audit is scheduled to commence on 22 January 2024 and is expected to be completed by 16 February 2024, subject to the timely provision of access credentials and technical documentation by AGMG.
It is critical to this privilege protocol that Thistlewood is acting as a technical consultant under the direction of legal counsel (C&H) for the purpose of enabling C&H to render informed legal advice to AGMG regarding GDPR and PECR compliance, and to assist in AGMG's response to actual and reasonably anticipated regulatory proceedings. Thistlewood is not acting as an independent auditor, and its work product is not being prepared for general business purposes; rather, it is being prepared at the specific request and direction of C&H in its capacity as AGMG's legal advisors, in order to inform C&H's legal analysis and advice. This characterisation is fundamental to the privilege protections asserted in this memorandum.
2. LEGAL BASIS FOR PRIVILEGE
2.1 Legal Advice Privilege
Under English law, legal advice privilege protects confidential communications between a client and its legal advisors made for the purpose of giving or obtaining legal advice. The privilege attaches to the communications themselves and to documents that evidence or form part of the giving or receiving of legal advice. The seminal authorities on the scope of legal advice privilege include Three Rivers District Council v Governor and Company of the Bank of England (No. 6) [2004] UKHL 48 and R (on the application of Prudential plc) v Special Commissioner of Income Tax [2013] UKSC 1.
All communications between C&H and AGMG in connection with this engagement, including the provision and analysis of the Thistlewood audit findings, are made for the dominant purpose of giving and receiving legal advice on GDPR and PECR compliance. The engagement letter dated 12 January 2024 expressly confirms that C&H's instructions relate to the provision of legal advice in connection with identified regulatory risks and proceedings, and that all work product generated under the engagement is intended to be privileged.
Thistlewood's work product is commissioned at the direction of and for the benefit of C&H's legal analysis. The technical cookie scan results, data flow maps, and related findings are integral to C&H's ability to render informed legal advice on the cookie-consent and adtech data flow remediation required to address the CNIL formal notice, the ICO informal inquiry, and AGMG's broader GDPR and PECR compliance obligations. Without the benefit of Thistlewood's technical expertise, C&H would be unable to assess the extent and nature of the compliance gaps, to formulate appropriate remediation strategies, or to advise AGMG on the merits and risks of the regulatory proceedings.
In order to maximise the protection afforded by legal advice privilege, all Thistlewood technical findings will be channelled through C&H and incorporated into privileged legal analysis memoranda addressed to AGMG. Thistlewood deliverables will not be transmitted directly to AGMG (except for limited logistical communications as described in Section 5.3 below), and the legal analysis of the technical findings will be performed exclusively by C&H. This structure ensures that the dominant purpose of the Thistlewood work product remains the facilitation of legal advice, rather than the provision of independent technical services.
2.2 Litigation Privilege
Litigation privilege protects documents and communications created for the dominant purpose of actual or reasonably anticipated litigation or adversarial proceedings. Unlike legal advice privilege, litigation privilege extends to communications with and documents prepared by third parties (including expert consultants and technical advisors), provided that the dominant purpose test is satisfied. The scope of litigation privilege was considered by the Supreme Court in Re L (A Minor) [1997] AC 16 and by the Court of Appeal in United States of America v Philip Morris Inc [2004] EWCA Civ 330 and WH Holding Ltd v E20 Stadium LLP [2018] EWCA Civ 2652.
The basis for asserting litigation privilege in this matter is strong, and rests on the following grounds:
(a) CNIL Formal Notice MED-2023-097 (dated 14 December 2023). The issuance of a formal notice (mise en demeure) by the CNIL constitutes the initiation of a formal enforcement process that may result in administrative fines, injunctions, or other sanctions imposed by the CNIL's formation restreinte. CNIL enforcement proceedings are adversarial in nature for the purposes of English privilege law: they involve the determination of rights, obligations, and penalties by a quasi-judicial body, with the right of defence, the right to be heard, and the right of appeal to the Conseil d'État. The issuance of the formal notice satisfies the threshold for adversarial proceedings to be "reasonably anticipated" (and commenced, insofar as the mise en demeure is itself a step in the enforcement process).
(b) Underlying CNIL Complaint PLT-2023-FR-04821. The complaint filed by DRE, represented by Kreisel & Hausmann (lead attorney Dr. Tobias Kreisel), may lead to or support civil litigation by DRE or by affected data subjects. DRE has publicly stated its intention to pursue representative actions on behalf of affected users in circumstances where regulatory remediation is considered inadequate. The risk of follow-on civil proceedings, whether in France or in other EU jurisdictions, is real and material.
(c) ICO Informal Inquiry ICO/ENF/2023/LTR-11084 (dated 22 December 2023). The ICO's informal inquiry letter signals a potential enforcement investigation that could escalate to formal action, including the issuance of assessment notices under section 146 of the DPA 2018, enforcement notices under section 149, penalty notices under section 155, or compulsory audits. The ICO's letter expressly reserves the right to escalate, and the subject matter of the inquiry (server-side tracking pixels and PECR consent compliance) is closely related to the matters raised in the CNIL complaint. The informal inquiry therefore gives rise to a reasonable anticipation of adversarial regulatory proceedings in the United Kingdom.
(d) General Assessment. As of the date of this memorandum, adversarial proceedings are reasonably anticipated in both the French and United Kingdom jurisdictions. The existence of two concurrent regulatory inquiries, one of which has already progressed to a formal notice stage, and the involvement of an advocacy organisation with a track record of pursuing enforcement actions and civil litigation, place this matter squarely within the scope of litigation privilege.
The Thistlewood technical audit is being conducted for the dominant purpose of enabling C&H to advise AGMG in connection with these actual and anticipated regulatory proceedings. The audit will identify the specific compliance gaps that are the subject of the CNIL and ICO inquiries, assess the extent of non-compliance, and inform the remediation strategy that will form the basis of AGMG's regulatory responses. All Thistlewood work product, communications, and findings are therefore subject to litigation privilege in addition to legal advice privilege.
It should be noted that, for the avoidance of doubt, this memorandum asserts both legal advice privilege and litigation privilege in respect of the protected materials. This dual assertion provides an additional layer of protection: even if one basis for privilege were to be challenged or found not to apply in a particular context, the other may remain available.
2.3 Common Interest Privilege
Common interest privilege (sometimes referred to as "joint interest" privilege) permits the sharing of privileged materials between parties who share a common legal interest without waiving privilege. Under English law, the principle was confirmed in Buttes Gas and Oil Co v Hammer (No. 3) [1981] QB 223 and Commercial Union Assurance Co v Mander [1996] 2 Lloyd's Rep 640. Common interest privilege operates as a shield against waiver: where privileged materials are disclosed to a third party with whom the disclosing party shares a common interest, the disclosure does not constitute a waiver of the underlying privilege.
In this engagement, AGMG, C&H, and Thistlewood share a common legal interest in the privileged assessment of AGMG's cookie-consent and adtech data flow practices for the purpose of defending against and responding to the CNIL and ICO proceedings. Each party has a direct interest in the preservation of privilege over the audit findings and related legal analysis:
(a) AGMG has a direct interest in receiving privileged legal advice and in ensuring that the technical audit findings are protected from disclosure to regulators, litigants, and third parties except on terms controlled by AGMG and its legal advisors.
(b) C&H has a professional obligation to its client (AGMG) to preserve privilege and to ensure that the involvement of a third-party consultant does not undermine the privilege framework applicable to the engagement.
(c) Thistlewood has an interest in ensuring that its work product, prepared at the direction of legal counsel, is treated as privileged and is not disclosed in a manner that could expose Thistlewood to liability or require Thistlewood to give evidence regarding its findings in adversarial proceedings.
Thistlewood's access to privileged legal analysis provided by C&H (to the extent necessary to inform the technical audit) and its provision of technical findings to C&H for incorporation into privileged legal advice memoranda are within the scope of this common interest. The sharing of privileged materials among the three parties in accordance with this protocol does not constitute a waiver of privilege.
The common interest does not extend to any third parties beyond AGMG, C&H, and Thistlewood without the prior written consent of AGMG (through Sanjay Redworth or Margaux Fontaine-Li) and C&H (through Rachel Bernstein). Any extension of the common interest to additional parties — for example, local counsel instructed in French proceedings — would require a supplementary protocol or amendment to this memorandum.
For the avoidance of doubt, this protocol does not create a solicitor-client relationship between C&H and Thistlewood. C&H's client is AGMG. Thistlewood is a third-party consultant engaged at C&H's direction for the purpose of facilitating the provision of legal advice by C&H to AGMG. C&H owes no professional duties to Thistlewood, and Thistlewood has no right to receive legal advice from C&H independently of the engagement.
3. SCOPE OF PROTECTED MATERIALS
3.1 Categories of Protected Materials
The following categories of materials are covered by this protocol and are subject to the privilege protections described in Section 2. All persons with access to these materials are required to treat them as privileged and confidential and to comply with the handling, marking, and communication protocols set out in this memorandum.
(a) All Thistlewood Work Product. This includes, without limitation, cookie scan results (including raw scan data and analysed outputs), pixel identification reports, data flow maps and diagrams, vendor data-sharing analyses, technical remediation recommendations, configuration change proposals, and all drafts, iterations, working notes, and supporting materials prepared by Thistlewood in connection with the engagement. This category encompasses all deliverables, whether in final or interim form, and regardless of the format in which they are prepared (including electronic files, spreadsheets, databases, visual diagrams, and written reports).
(b) All C&H Legal Analysis Memoranda. This includes the Cookie Audit & Data Flow Mapping Legal Analysis Memorandum (to be prepared following receipt and review of Thistlewood's deliverables), the GDPR Gap Analysis Memorandum, regulatory response drafts, risk assessment memoranda, and all related working drafts, annotations, and notes prepared by C&H personnel. This category also includes any legal research memoranda, case law analyses, and statutory interpretation notes prepared in connection with the engagement.
(c) All Communications Among the Parties. This includes all communications (whether written or oral) among C&H, AGMG, and Thistlewood relating to the audit findings, their legal significance, remediation strategy, regulatory response strategy, and any other matter arising in connection with the engagement. This encompasses emails, letters, memoranda, instant messages sent via approved secure channels, telephone call notes, video conference recordings or transcripts, and any other form of communication.
(d) All Internal C&H Working Papers. This includes all internal C&H working papers, research memoranda, strategy notes, time entries (to the extent they reveal privileged analysis or strategy), and other internal documents prepared by C&H personnel in connection with the engagement.
(e) All Communications Regarding Regulatory Proceedings. This includes all communications among C&H, AGMG, and Thistlewood regarding the CNIL proceedings (formal notice MED-2023-097 and complaint PLT-2023-FR-04821), the ICO informal inquiry (ICO/ENF/2023/LTR-11084), and any related or follow-on proceedings, including regulatory response strategy, draft submissions to regulators, and internal assessments of regulatory risk and exposure.
(f) Meeting Materials. This includes meeting agendas, minutes, action items, summaries, and presentation materials from any privileged meetings or calls involving any combination of C&H, AGMG, and Thistlewood personnel in connection with the engagement.
This list is intended to be comprehensive but not exhaustive. Any doubt as to whether a particular document or communication falls within the scope of this protocol should be resolved by treating the material as privileged and seeking guidance from Priscilla Wynn or Rachel Bernstein at C&H.
3.2 Exclusions
Certain categories of materials are not rendered privileged by virtue of this protocol, and it is important that all parties understand the limitations of the privilege framework.
Underlying factual business records of AGMG that exist independently of this engagement are not privileged by virtue of this protocol. Examples include existing vendor contracts (such as AGMG's data processing agreements with Pendleton AdTech Solutions Ltd, VoltGraph Analytics GmbH, and Brightleaf Consent Technologies EU B.V.), consent management platform ("CMP") configuration files maintained by AGMG's engineering team in the ordinary course of business, website analytics data generated and stored prior to the engagement, and historical cookie-consent banner designs and deployment records. These records are pre-existing business documents that would exist regardless of whether C&H had been retained or the Thistlewood audit had been commissioned. Their disclosure in response to a regulatory request or in litigation would not, in itself, constitute a waiver of privilege over the audit findings or C&H's legal analysis.
However, compilations, selections, or summaries of such pre-existing records made at C&H's direction for the purpose of the legal analysis may themselves be protected by litigation privilege, to the extent that the act of selection and compilation reveals C&H's legal thinking or litigation strategy. This principle is consistent with the approach taken in Sumitomo Corporation v Credit Lyonnais Rouse Ltd [2001] EWCA Civ 1152 and subsequent authorities. Where pre-existing records are selected, compiled, or annotated at C&H's direction, they should be treated as privileged materials and handled in accordance with this protocol unless C&H advises otherwise.
Additionally, Thistlewood deliverables that are purely factual or technical in nature and do not reflect or incorporate legal analysis, legal advice, or litigation strategy may have weaker privilege protection. A raw cookie scan output, for example, that merely lists the cookies present on a given website without any analysis of their legal significance might be characterised as a factual document rather than a privileged communication. To mitigate this risk and to maximise the protection available, Thistlewood shall channel all deliverables — including those that are primarily factual or technical — through C&H, addressed to Priscilla Wynn or Rachel Bernstein, so that they are received in the context of and for the purpose of C&H's privileged legal analysis. Thistlewood should avoid preparing standalone deliverables that could be characterised as independent business consultancy reports rather than materials prepared at the direction of legal counsel.
4. PRIVILEGE MARKINGS AND LABELLING REQUIREMENTS
4.1 Mandatory Markings
Consistent and conspicuous privilege markings are an essential element of privilege protection. While the absence of a privilege marking does not, as a matter of law, extinguish privilege that would otherwise attach, the presence of clear and prominent markings serves multiple important functions: it signals to the recipient and to any third party who may subsequently encounter the document that the document is asserted to be privileged; it evidences the parties' contemporaneous intention to maintain privilege; and it reduces the risk of inadvertent disclosure or mishandling.
All documents, reports, memoranda, emails, and other written materials generated under this protocol must bear the following legend prominently on the first page and in the header or footer of each subsequent page:
"PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE DIRECTION OF LEGAL COUNSEL — ATTORNEY-CLIENT PRIVILEGE / LITIGATION PRIVILEGE / COMMON INTEREST PRIVILEGE — DO NOT DISCLOSE WITHOUT PRIOR AUTHORISATION FROM CALDERWOOD & HARKNESS LLP"
The legend should appear in bold, capitalised text in a legible font size (no smaller than 9 point) and should be positioned so as to be clearly visible to any reader of the document. Where a document is prepared in a format that does not readily accommodate headers and footers (e.g., spreadsheets, diagrams, or database exports), the legend should be included on a cover sheet or in a prominent text field within the document.
4.2 Email Subject Lines
All email communications among the parties relating to this engagement shall include the following prefix in the subject line:
[PRIVILEGED — C&H Matter 1017-00008]
This prefix should appear at the beginning of the subject line, before any descriptive text, so that the privileged nature of the communication is immediately apparent to the recipient and to any email management or archiving system. The prefix should not be removed or altered in the course of email reply chains; rather, it should be preserved in all replies and forwards.
Where emails are sent to or from Thistlewood personnel, the body of the email shall include the full privilege legend set out in Section 4.1 above, in addition to the subject line prefix. This additional step is necessary because Thistlewood personnel are not employees of C&H or AGMG and may not otherwise be immediately identifiable as participants in a privileged engagement.
4.3 File Naming Convention
All electronic files created or received in connection with this engagement shall follow the standardised naming convention set out below:
`[PRIV] [Date YYYY-MM-DD] [Document Description] [Author] — C&H 1017-00008`
By way of illustration, a Thistlewood cookie scan results report covering all AGMG EU properties, finalised on 16 February 2024, would be named:
`[PRIV] 2024-02-16 Cookie Scan Results All EU Properties Thistlewood — C&H 1017-00008`
This naming convention serves to identify privileged documents quickly and reliably within document management systems, email archives, and file storage platforms. It also facilitates the efficient identification and retrieval of privileged documents in the event of a document review or disclosure exercise. All parties should ensure that their personnel adopt this convention consistently and that files are not saved under alternative names or in locations that lack appropriate access controls.
5. COMMUNICATION PROTOCOLS
5.1 Designated Contacts
The effective maintenance of privilege requires that access to privileged materials and participation in privileged communications be restricted to a defined group of authorised individuals. The following individuals are the designated contacts for privilege purposes under this protocol. Only these individuals (and such additional persons as may be approved in accordance with the procedures set out below) are authorised to access, receive, create, or transmit privileged materials in connection with this engagement.
Calderwood & Harkness LLP:
• Rachel Bernstein, Partner, Privacy & Data Security Practice. Ms. Bernstein is the responsible partner for the engagement and the ultimate approval authority for all privilege-related matters, including any decisions regarding waiver, disclosure to third parties, or amendment of this protocol.
• Priscilla Wynn, Senior Associate, Privacy & Data Security Practice. Ms. Wynn is the day-to-day point of contact for Thistlewood and the primary recipient of all Thistlewood deliverables. All routine queries regarding the application of this protocol should be directed to Ms. Wynn in the first instance.
• Alan Burke, Associate, Privacy & Data Security Practice. Mr. Burke provides supporting legal analysis and may communicate with Thistlewood under Ms. Wynn's supervision and direction.
• Kevin Ostrowski, Partner. Mr. Ostrowski serves as billing partner for the engagement and receives privileged materials as needed for engagement management and supervisory purposes.
Aurelius Global Media Group PLC:
• Sanjay Redworth, Group General Counsel & Company Secretary. Mr. Redworth is the primary client contact and the authorisation authority for privilege waivers on behalf of AGMG. Any decision to waive privilege over any protected material requires Mr. Redworth's express written consent.
• Margaux Fontaine-Li, Group Data Protection Officer. Ms. Fontaine-Li serves as the operational contact for DPO-related matters and technical audit coordination, including the facilitation of Thistlewood's access to AGMG systems and technical documentation.
Thistlewood Consulting Ltd:
• Marcus Drayford, Principal Consultant. Mr. Drayford is the engagement lead at Thistlewood and the sole authorised point of contact unless otherwise agreed in writing by C&H. All Thistlewood deliverables, communications, and queries should be routed through Mr. Drayford.
5.2 Permitted Communication Channels
All written communications in connection with this engagement shall use designated secure email addresses (as notified separately to each party) or the C&H secure document-sharing platform (currently Aldermere Systems-based, with multi-factor authentication and AES-256 encryption at rest and in transit). Access credentials for the C&H secure document-sharing platform will be provided to Marcus Drayford, Sanjay Redworth, and Margaux Fontaine-Li under separate cover.
No privileged materials shall be transmitted via unencrypted email channels, personal email accounts (including but not limited to Northgate Software, Ridgeline Technologies, Cascade Health IT, or similar consumer email services), consumer messaging applications (including but not limited to Meridian Services Inc., Harborline Technologies, Kestrel Data Systems, Westmark Software, or SMS), or social media platforms. The use of personal devices for the creation, storage, or transmission of privileged materials is prohibited without the prior written approval of C&H.
Oral communications, including telephone calls, video conferences (via the C&H-approved video conferencing platform), and in-person meetings, may be conducted freely among the designated contacts listed in Section 5.1. However, notes, minutes, summaries, or recordings of such communications must be prepared, marked, and filed in accordance with the requirements of Section 4 of this protocol. Where oral communications take place in settings that may not be fully secure (e.g., open-plan offices, public spaces, or shared workspaces), participants should exercise appropriate caution to prevent overhearing by unauthorised persons.
5.3 Routing of Thistlewood Communications
In order to maintain the integrity of the privilege framework, all Thistlewood deliverables — including drafts, interim reports, final reports, and supporting data files — shall be addressed to and transmitted first to Priscilla Wynn at C&H. Thistlewood shall not transmit deliverables directly to AGMG personnel without C&H's prior written approval. This routing requirement ensures that all Thistlewood work product is received by C&H in its capacity as legal advisor to AGMG and is incorporated into C&H's privileged legal analysis before being shared with the client.
It is acknowledged that operational coordination may, from time to time, require direct communication between Thistlewood (Marcus Drayford) and AGMG (Margaux Fontaine-Li or Leander Voss, Chief Technology Officer, for technical access matters). Such direct communications are permitted, but shall be strictly limited to logistical and technical access arrangements, including the provision of system credentials, scheduling of scan windows, resolution of technical connectivity issues, and similar operational matters. Direct Thistlewood–AGMG communications shall not discuss legal analysis, regulatory strategy, privilege-related matters, or the legal significance of any audit findings.
In the event that any direct communication between Thistlewood and AGMG inadvertently touches on legal matters — for example, if a conversation regarding a technical finding leads to a discussion of its potential regulatory implications — the relevant Thistlewood or AGMG participant shall promptly report the communication to Priscilla Wynn at C&H, who will assess whether any remedial steps are necessary and provide guidance on how to handle such situations in future.
5.4 Restrictions on Wider Dissemination Within AGMG
Privileged materials may be shared within AGMG only with Sanjay Redworth and Margaux Fontaine-Li, and with the following additional AGMG personnel on a need-to-know basis as determined by Sanjay Redworth:
• Helena Durneval, Chief Executive Officer;
• Dominic Ashford, Chief Financial Officer; and
• Leander Voss, Chief Technology Officer.
The determination of whether any of the above individuals requires access to specific privileged materials shall be made by Sanjay Redworth on a case-by-case basis, having regard to the relevance of the material to the individual's responsibilities and the need to maintain the confidentiality and privilege of the materials. Sanjay Redworth shall maintain a record of any such disclosures and the basis on which they were made.
Privileged materials shall not be circulated to AGMG's external auditors, Hollander Warwick LLP (85 Gresham Street, London EC2V 7NQ), without prior consultation with C&H to ensure that appropriate protections are in place and that any such disclosure does not constitute a waiver of privilege. The disclosure of privileged materials to external auditors raises particular risks, as audit-related disclosures may be subject to different legal frameworks (including the Companies Act 2006 and auditing standards) that could override or undermine privilege claims. C&H will advise AGMG on the appropriate approach if disclosure to Hollander Warwick is contemplated.
Privileged materials shall not be shared with adtech vendors — including, without limitation, Pendleton AdTech Solutions Ltd, VoltGraph Analytics GmbH, and Brightleaf Consent Technologies EU B.V. — or with their respective legal counsel (Dalrymple Kearney & Co.; Feldstein Weber LLP) under any circumstances without the express prior written consent of Rachel Bernstein. Disclosure of privileged audit findings to adtech vendors or their counsel could constitute a waiver of privilege and could also provide those parties with information that is adverse to AGMG's interests in current or future negotiations or proceedings.
6. DOCUMENT HANDLING, STORAGE, AND RETENTION
6.1 Storage Requirements
The physical and electronic security of privileged materials is essential to the maintenance of privilege. If privileged materials are stored in an insecure manner or are accessible to unauthorised persons, the confidentiality that is a prerequisite of privilege may be compromised, potentially resulting in a waiver of privilege over the affected materials.
All privileged materials shall be stored in designated secure repositories as follows:
Calderwood & Harkness LLP: All privileged materials held by C&H shall be stored within C&H's matter management system under Matter No. 1017-00008. Access to the matter file shall be restricted to the engagement team members listed in Section 5.1 (Rachel Bernstein, Kevin Ostrowski, Priscilla Wynn, and Alan Burke). C&H's matter management system employs role-based access controls, encrypted storage, and audit logging in accordance with the firm's information security policies and the Solicitors Regulation Authority's requirements.
Aurelius Global Media Group PLC: All privileged materials held by AGMG shall be stored in a dedicated, access-controlled folder on AGMG's legal department document management system. Access to this folder shall be restricted to Sanjay Redworth and Margaux Fontaine-Li, and to such other persons as Sanjay Redworth may authorise in writing in accordance with the restrictions set out in Section 5.4 above. AGMG shall ensure that the folder is configured with appropriate access controls, encryption, and audit logging capabilities.
Thistlewood Consulting Ltd: All privileged materials held by Thistlewood shall be stored in a dedicated, encrypted project folder accessible only to Marcus Drayford and any Thistlewood team members approved in writing by C&H. The project folder shall be maintained on Thistlewood's secure file server or approved cloud storage platform, with AES-256 or equivalent encryption at rest and in transit, multi-factor authentication for access, and audit logging of all access events. Thistlewood shall not store privileged materials in general-purpose project folders, shared drives, or other locations accessible to Thistlewood personnel who are not approved under this protocol.
No privileged materials shall be stored on personal devices (including personal laptops, tablets, smartphones, or USB drives), on cloud storage services outside of the approved platforms described above (including but not limited to Larkspur Technologies, Hollowell Health IT, Cobalt Ridge Systems personal accounts, or Meridian Systems), or on removable media (including USB drives, external hard drives, or optical discs) without the prior written approval of C&H. Any such approval, if granted, shall be subject to conditions designed to ensure the security of the materials, including encryption requirements and return or destruction obligations.
6.2 Retention and Return/Destruction
Upon completion of the engagement, or at such earlier time as C&H may direct, Thistlewood shall, at C&H's direction, either:
(a) return all privileged materials to C&H, including all copies (whether in electronic or physical form), together with a written confirmation that no copies have been retained; or
(b) securely destroy all privileged materials, including all copies (whether in electronic or physical form), using methods appropriate to the medium (e.g., secure deletion with overwriting for electronic files; cross-cut shredding for physical documents), and provide written certification of destruction to C&H, specifying the materials destroyed, the date of destruction, and the method of destruction used.
The choice between return and destruction shall be made by C&H in consultation with AGMG, having regard to the needs of any ongoing or anticipated proceedings and AGMG's document retention requirements.
AGMG shall retain its copies of privileged materials in accordance with its legal-hold and document-retention policies as advised by Sanjay Redworth. AGMG should ensure that privileged materials are subject to appropriate legal-hold notices to prevent their deletion or destruction during the pendency of the regulatory proceedings and any related litigation.
C&H shall retain its files in accordance with the firm's standard document retention policy (currently a minimum of seven years from the closure of the matter, subject to any applicable legal-hold obligations) and in compliance with applicable professional obligations under the Solicitors Regulation Authority Code of Conduct and the firm's regulatory obligations.
7. INADVERTENT DISCLOSURE AND PRIVILEGE CHALLENGES
7.1 Inadvertent Disclosure Protocol
Despite the best efforts of all parties, the inadvertent disclosure of privileged materials to unauthorised third parties may occur. An inadvertent disclosure does not necessarily result in a waiver of privilege — under English law, the question of whether an inadvertent disclosure constitutes a waiver depends on the circumstances, including the steps taken to maintain confidentiality, the promptness of the response to the disclosure, and the extent to which the material was disseminated. However, the risk of waiver is real, and it is essential that all parties respond swiftly and decisively to any inadvertent disclosure.
If any party or any individual listed in this protocol becomes aware of an inadvertent disclosure of privileged materials to an unauthorised third party, the following steps shall be taken immediately:
(a) The party that made or became aware of the disclosure shall immediately notify Rachel Bernstein at C&H by telephone and by email, with a copy to Priscilla Wynn. If C&H is not the disclosing party, C&H shall promptly notify Sanjay Redworth at AGMG.
(b) The disclosing party shall take all reasonable steps to retrieve the disclosed materials from the unauthorised recipient. This includes contacting the recipient (or the recipient's legal counsel, if known) to request the immediate return or destruction of the materials.
(c) The disclosing party shall obtain written confirmation from the unauthorised recipient that the materials have been returned or destroyed, that no copies have been made or retained, and that the materials have not been further disseminated to any other person or entity.
(d) C&H shall assess whether the inadvertent disclosure constitutes a waiver of privilege under applicable law and shall advise AGMG accordingly. C&H's assessment will take into account the nature and sensitivity of the disclosed materials, the identity of the recipient, the circumstances of the disclosure, the steps taken to retrieve the materials, and any applicable legal authorities.
(e) C&H shall consider whether any additional protective measures are required, such as seeking injunctive relief to restrain the use of the disclosed materials or applying to a court or tribunal for a ruling that privilege has not been waived.
All parties shall cooperate fully with C&H in implementing the inadvertent disclosure protocol and in taking any steps necessary to protect the privileged status of the disclosed materials.
7.2 Third-Party Requests for Privileged Materials
Privileged materials may become the subject of requests, demands, subpoenas, or court or regulatory orders from third parties, including the CNIL, the ICO, DRE, Kreisel & Hausmann, or other regulators, litigants, or government bodies. The proper handling of such requests is critical to the preservation of privilege.
If any party receives a request, demand, subpoena, or court or regulatory order seeking the production or disclosure of materials covered by this protocol, the receiving party shall:
(a) immediately notify C&H (Rachel Bernstein and Priscilla Wynn) and AGMG (Sanjay Redworth) before making any production or disclosure, and in any event within twenty-four (24) hours of receipt of the request;
(b) provide C&H with a copy of the request, demand, subpoena, or order and any accompanying documentation;
(c) cooperate with C&H in asserting all applicable privilege claims, including by providing any information or documentation reasonably requested by C&H for the purpose of preparing a privilege log, a motion to quash, an objection, or other responsive filing;
(d) not produce, disclose, or make available any privileged materials to the requesting party or any other person without the express written authorisation of C&H (Rachel Bernstein) and AGMG (Sanjay Redworth); and
(e) if compelled by a court or regulatory order to produce privileged materials notwithstanding an assertion of privilege, cooperate with C&H in seeking a stay, protective order, or other relief to preserve the privileged status of the materials pending appeal or further review.
The obligation not to produce privileged materials without authorisation applies even where the requesting party asserts that the materials are not privileged or that privilege has been waived. Such assertions should be referred to C&H for assessment and response.
8. THISTLEWOOD CONSULTING — SPECIFIC OBLIGATIONS
8.1 Acknowledgment and Undertaking
In order to ensure that Thistlewood's participation in this engagement does not compromise the privilege framework, Marcus Drayford, on behalf of Thistlewood Consulting Ltd, shall sign the acknowledgment and undertaking form appended to this memorandum as Annex A. The acknowledgment form must be signed and returned to Priscilla Wynn at C&H before the commencement of the technical audit (scheduled for 22 January 2024).
By signing the acknowledgment form, Marcus Drayford confirms, on behalf of Thistlewood:
(a) that Thistlewood has read, understood, and agrees to comply with all terms and conditions of this Common Interest and Privilege Protocol Memorandum;
(b) that all Thistlewood work product in connection with the engagement is prepared at the direction of C&H for the purpose of enabling C&H to render legal advice to AGMG and in connection with actual or reasonably anticipated regulatory proceedings;
(c) that Thistlewood will not disclose any privileged materials or the substance of the audit findings to any party other than the designated contacts at C&H and AGMG as specified in this protocol;
(d) that Thistlewood's engagement in this matter is subject to the common-interest protections described in Section 2.3 of this protocol; and
(e) that Thistlewood acknowledges that a breach of this protocol may result in the waiver of privilege over the affected materials, with potentially serious consequences for AGMG, and that Thistlewood accepts responsibility for ensuring compliance by its personnel.
8.2 Thistlewood Personnel
Only Marcus Drayford and such other Thistlewood personnel as are approved in writing by C&H (through Priscilla Wynn or Rachel Bernstein) shall have access to privileged materials or participate in privileged communications in connection with this engagement. Requests for the approval of additional Thistlewood personnel should be submitted to Priscilla Wynn in writing, identifying the individual by name and role, the reasons why access is required, and confirming that the individual is bound by confidentiality obligations consistent with the requirements of this protocol.
Thistlewood shall ensure that all approved personnel are bound by confidentiality obligations at least as stringent as those set out in this protocol, whether pursuant to their employment contracts, a separate non-disclosure agreement, or other binding arrangements. C&H reserves the right to request copies of any such agreements for review.
Upon any approved Thistlewood team member ceasing to work on the engagement (whether by departure from Thistlewood, reassignment, or otherwise), Thistlewood shall promptly notify C&H and shall ensure that the departing individual's access to privileged materials is terminated and that any privileged materials in the individual's possession are returned or securely destroyed.
8.3 Sub-Contractors
Thistlewood shall not engage any sub-contractors, freelance consultants, or third-party service providers, or use any third-party tools or platforms that would require the disclosure of privileged materials to persons or entities outside of Thistlewood, without the prior written consent of C&H (through Priscilla Wynn or Rachel Bernstein). This restriction extends to cloud-based scanning tools, third-party analytics platforms, and any other tools or services that process, store, or transmit data derived from the privileged engagement.
If Thistlewood considers it necessary to engage a sub-contractor or use a third-party tool, it shall submit a written request to C&H describing the proposed sub-contractor or tool, the scope of access required, the security measures in place, and the basis on which the sub-contractor or tool provider would be bound by confidentiality obligations. C&H will assess the request in light of the privilege framework and advise whether approval can be granted, and if so, on what terms and conditions.
9. INTERACTION WITH REGULATORY PROCEEDINGS
9.1 CNIL Proceedings (MED-2023-097 / PLT-2023-FR-04821)
The CNIL formal notice MED-2023-097, dated 14 December 2023, sets a compliance deadline of 14 March 2024. C&H has been instructed by AGMG to seek an extension of this deadline to allow sufficient time for the completion of the Thistlewood technical audit, the preparation of C&H's legal analysis, and the implementation of remediation measures. C&H is in the process of preparing the extension request, which will be submitted to the CNIL in the coming days.
Any materials prepared for submission to the CNIL — whether in connection with the compliance response, the extension request, or any subsequent correspondence — will be carefully reviewed by C&H to ensure that only non-privileged compliance evidence is disclosed to the CNIL. Privileged legal analysis, strategy memoranda, internal communications, and any materials that reflect C&H's legal thinking or litigation strategy will not be submitted to the CNIL. The distinction between non-privileged factual compliance evidence (e.g., evidence of remediated cookie-consent mechanisms, updated CMP configurations, and revised privacy notices) and privileged materials (e.g., C&H's assessment of the legal risks, the Thistlewood audit report in its privileged form, and internal strategic discussions) must be rigorously maintained.
The decision to disclose any specific technical finding from the Thistlewood audit to the CNIL shall be made by Rachel Bernstein in consultation with Sanjay Redworth. The objective will be to demonstrate remediation and good-faith compliance efforts without waiving privilege over the broader audit findings, C&H's legal analysis, or the engagement's strategic direction. Where it is necessary to share technical evidence of remediation, C&H will prepare sanitised, non-privileged summaries or exhibits that present the factual compliance position without revealing the scope, methodology, or conclusions of the privileged audit.
9.2 ICO Inquiry (ICO/ENF/2023/LTR-11084)
The ICO informal inquiry, reference ICO/ENF/2023/LTR-11084, dated 22 December 2023, relates to server-side tracking pixels deployed on aureliusnews.co.uk and shopaurelia.co.uk and raises questions regarding PECR Regulation 6 consent compliance. The ICO has requested a substantive response within 28 days of the date of the letter (i.e., by 19 January 2024). C&H is preparing a holding response to the ICO to acknowledge receipt of the inquiry and to request a reasonable extension of time for a full substantive response, given the complexity of the matters under investigation and the concurrent CNIL proceedings.
The same principles set out in Section 9.1 apply to the ICO proceedings: only non-privileged compliance evidence will be shared in any response to the ICO. Privileged legal analysis, strategy memoranda, and internal communications will not be disclosed. C&H will prepare the ICO response and will clearly delineate between factual compliance demonstrations (e.g., evidence of remediated cookie-consent mechanisms, updated PECR-compliant consent flows, and technical documentation of server-side tracking pixel configurations) and privileged analysis (e.g., C&H's assessment of AGMG's exposure, the Thistlewood audit findings in their privileged form, and internal discussions regarding regulatory strategy).
Where the ICO response requires the disclosure of technical information derived from the Thistlewood audit, C&H will prepare the relevant materials in a manner that isolates the factual compliance evidence from the privileged audit work product, ensuring that the disclosure does not constitute a waiver of privilege over the broader engagement materials.
10. DURATION AND AMENDMENT
10.1 Duration
This protocol is effective from the date of this memorandum, 18 January 2024, and shall remain in effect for the duration of the C&H engagement (Matter No. 1017-00008) and thereafter for so long as privilege subsists in the protected materials described in Section 3. The obligations of the parties under this protocol, including the obligations regarding document handling, storage, retention, return, and destruction, and the restrictions on disclosure to third parties, survive the termination or closure of the engagement.
For the avoidance of doubt, the privilege asserted over the protected materials does not expire upon the completion of the Thistlewood technical audit, the closure of the CNIL or ICO proceedings, or the termination of the C&H engagement. Privilege subsists indefinitely unless waived by the privilege holder (AGMG, acting through Sanjay Redworth or his successor). The parties' obligations under this protocol continue for as long as the privilege remains in effect.
10.2 Amendment
This protocol may be amended only in writing, with the agreement of Rachel Bernstein (C&H), Sanjay Redworth (AGMG), and Marcus Drayford (Thistlewood). Any proposed amendment shall be circulated in draft to all three parties and shall not take effect until signed by all three parties. Amendments shall be documented and appended to this memorandum, with the date of the amendment and the signatures of the approving parties clearly recorded.
Informal or oral modifications to this protocol are not effective and shall not be relied upon by any party. If any party considers that a modification is necessary or desirable, a written proposal should be submitted to Priscilla Wynn at C&H for circulation and consideration.
11. GOVERNING LAW
This protocol, and all questions of privilege arising under it, shall be governed by and construed in accordance with the laws of England and Wales. English law governs the existence, scope, and waiver of legal advice privilege and litigation privilege as described in this memorandum, and the English courts have jurisdiction to determine any disputes arising in connection with this protocol.
To the extent that materials or communications generated under this protocol are or may become subject to privilege analysis under the laws of other jurisdictions — including, without limitation, French law (in connection with the CNIL proceedings, where the applicable rules on secret professionnel and legal professional privilege may differ from English law), German law (in connection with DRE's status as a German-registered organisation and any potential proceedings in German courts or before German data protection authorities), or Irish law (in connection with AGMG's vendor relationships and any GDPR supervisory authority proceedings in Ireland) — C&H reserves the right to provide supplementary guidance to AGMG and Thistlewood on the application of privilege protections under those legal systems. Such supplementary guidance, if required, will be provided by way of addendum to this memorandum or by separate legal advice memorandum.
Nothing in this protocol constitutes a waiver of any privilege or protection available under the laws of any jurisdiction. The assertion of privilege under English law does not preclude the concurrent assertion of privilege or analogous protections under the laws of France, Germany, Ireland, or any other relevant jurisdiction.
ANNEX A
ACKNOWLEDGMENT AND UNDERTAKING FORM
Common Interest and Privilege Protocol — Technical Cookie Audit and Data Flow Mapping Engagement
C&H Matter No. 1017-00008
To: Calderwood & Harkness LLP Attention: Priscilla Wynn, Senior Associate, Privacy & Data Security Practice
From: Thistlewood Consulting Ltd