1044-00007 · Client 1044 · Memoranda

ivorian-local-counsel-memo.docx DOCUMENT Litigation

10 / 12 ← → ✕

Contract analysis Extract to table

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP

MEMORANDUM

TO: Victoria Chambers

FROM: Liam Donahue

DATE: October 5, 2022

RE: Summary of Consultation with Dossou & Mensah Avocats (Abidjan) — Data Privacy and Employment Law Issues; Matter No. 1044-00007

I. BACKGROUND

At the direction of Victoria Chambers, I conducted a preliminary consultation with Maître Amadou Dossou of Dossou & Mensah Avocats, based in Abidjan, Côte d'Ivoire. The initial consultation took place by videoconference on September 22, 2022, with a follow-up telephone call on October 3, 2022. This memorandum summarizes the substance of those discussions and the preliminary legal guidance provided by Maître Dossou.

The purpose of the consultation was to discuss data-privacy and employment-law issues arising from the collection and cross-border transfer of employee communications and personnel records from the Abidjan office of Thalassa West Africa SARL ("TWA"), located at Rue des Lagunes 27, Zone Portuaire, Abidjan, Côte d'Ivoire. These issues arise in connection with the internal investigation being conducted under the Foreign Corrupt Practices Act ("FCPA") into port-facilitation and customs-clearance payments made by TWA to Goldenshore Maritime Consultants Ltd. pursuant to the Port Agency and Facilitation Services Agreement dated March 1, 2018. The investigation was initiated following receipt of information from a confidential whistleblower source, as previously detailed in the Preliminary Investigation Plan Memorandum dated July 18, 2022.

The key custodians whose data is at issue in the Abidjan office are as follows:

• Cédric Anouma, Managing Director, TWA;

• Yves Kouadio, Finance Manager, TWA; and

• Adama Coulibaly, Operations Coordinator, TWA.

As described in more detail in Section II.B.2 below, Mr. Anouma is of particular significance as the authorized signatory on TWA's operating accounts and the individual who approved the port-facilitation payments at issue. He is also the subject of the whistleblower complaint.

Dossou & Mensah Avocats is a twelve-attorney firm based in Abidjan that specializes in corporate, banking, and compliance law in Côte d'Ivoire. Maître Dossou, a founding partner, has particular experience advising multinational companies on cross-border investigations and data transfers, including in the context of regulatory inquiries initiated by U.S. and European authorities. He has previously advised on data-transfer issues in connection with investigations conducted by the U.S. Department of Justice and the Securities and Exchange Commission, though the specific representations are subject to client confidentiality.

It should be noted that Dossou & Mensah Avocats has been consulted on a preliminary, informal basis but has not yet been formally retained as Ivorian local counsel on this matter. Formal retention remains contingent on reactivation of the investigation, which has been dormant since September 30, 2022, pursuant to Nikolaos Karavelis's request that the firm pause external legal spend pending internal budget discussions, as communicated in the hold-status letter of that date.

For purposes of coordination, the consultation with Dossou & Mensah Avocats is part of a broader engagement with local counsel across the jurisdictions implicated by the investigation. Calderwood & Harkness LLP is also working with Papadakis & Lekkas LLP (Greek local counsel, led by Stavros Lekkas, 28 Vasilissis Sofias Avenue, Athens 106 74, Greece), which is advising on Greek data-protection and corporate-governance issues affecting Thalassa Shipping Lines S.A. ("TSL"), the parent company, and with Okafor Bassey & Partners (Nigerian local counsel, led by Ngozi Okafor, 4th Floor, Marina Towers, 22 Marina Street, Lagos Island, Lagos, Nigeria), which is advising on analogous data-protection and employment-law issues affecting Thalassa Nigeria Limited ("TNL").

II. KEY LEGAL ISSUES

A. Loi n° 2013-450 (Data Privacy)

The principal data-privacy statute in Côte d'Ivoire is the Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel (the "Data Privacy Law"). This law establishes a comprehensive framework governing the collection, processing, storage, and transfer of personal data, broadly modeled on the European Union's former Data Protection Directive (Directive 95/46/EC), though with certain significant differences. The Data Privacy Law applies to all natural and legal persons who collect or process personal data within the territory of Côte d'Ivoire, and its protections extend to all identifiable natural persons, including employees.

The supervisory authority charged with enforcement and administration of the Data Privacy Law is the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire ("ARTCI"), which exercises regulatory oversight over data-processing activities and has the power to grant or deny authorizations for cross-border data transfers.

The following provisions of the Data Privacy Law were discussed in detail during the consultations with Maître Dossou:

1. Prior Authorization for Cross-Border Transfer (Article 36). Article 36 of the Data Privacy Law provides that the transfer of personal data to a country that does not provide an "adequate level of protection" (niveau de protection suffisant) requires prior authorization from ARTCI. The adequacy determination is made by ARTCI based on a number of factors, including the nature of the data, the purpose and duration of the proposed processing, the country of origin and the country of destination, the general and sectoral legal framework of the destination country, and the security measures in force.

Maître Dossou confirmed that, as of the date of our consultations, neither the United States nor Greece is currently included on ARTCI's list of countries recognized as providing an adequate level of protection for personal data. This is consistent with the general posture of Francophone African data-protection authorities, which have tended to follow the European Commission's adequacy determinations prior to the Schrems II decision but have not independently updated their own lists to reflect post-Schrems II developments.

Therefore, transferring TWA employee emails, personal data, and personnel records to Calderwood & Harkness LLP in New York (600 Lexington Avenue, 38th Floor, New York, NY 10022) or to TSL in Piraeus (14 Poseidonos Avenue, Piraeus 185 31, Greece) will require one of the following:

(a) prior authorization from ARTCI pursuant to Article 36;

(b) the express consent of the relevant data subjects (i.e., the employees whose data is being transferred), obtained in accordance with Article 10 of the Data Privacy Law (discussed further in Section II.A.2 below); or

(c) reliance on an applicable statutory exception, such as the exception for data transfers necessary for the performance of a legal obligation, the protection of vital interests of the data subject, or the execution of a contract to which the data subject is a party.

Maître Dossou expressed the view that, in practice, the most prudent approach would be to pursue both ARTCI authorization and employee consent simultaneously, as the exceptions under clause (c) above are narrowly construed by ARTCI and have not been tested in the context of cross-border investigations of this nature. He noted that ARTCI has been increasingly active in enforcement in recent years and that proceeding without authorization would create a meaningful compliance risk, including the possibility of administrative sanctions and potential inadmissibility of improperly transferred data in subsequent proceedings.

The ARTCI authorization process typically requires the submission of a detailed application describing the nature and purpose of the transfer, the categories of data to be transferred, the identity and location of the recipient, and the safeguards in place to protect the data upon transfer. Maître Dossou estimated that the authorization process, once initiated, could take approximately six to twelve weeks, depending on ARTCI's caseload and the complexity of the request. He emphasized the importance of engaging with ARTCI early and cooperatively, as the regulator tends to look more favorably upon applications made proactively rather than after data transfers have already occurred.

2. Employee Consent (Article 10). Article 10 of the Data Privacy Law provides that personal data may be lawfully processed where the data subject has given "free, specific, informed, and express" (libre, spécifique, éclairé et exprès) consent. This consent standard is broadly consistent with the consent requirements under the European Union's General Data Protection Regulation ("GDPR"), though the specific interpretive guidance issued by ARTCI is less developed than that of European supervisory authorities.

Maître Dossou cautioned that employee consent obtained in the context of an internal investigation may be vulnerable to challenge on the ground that it was not truly "free" given the inherent power imbalance in the employment relationship. This concern is well recognized in European data-protection jurisprudence (see, e.g., Article 29 Working Party, Opinion 2/2017 on Data Processing at Work, WP 249, June 8, 2017) and is increasingly acknowledged by Francophone African regulators as well. The risk is particularly acute where the employee is a potential subject of the investigation, as is the case with Mr. Anouma, because the employee may reasonably feel that refusal to consent could result in adverse employment consequences.

Notwithstanding this concern, Maître Dossou recommended that consent forms be obtained from each of the key custodians as a supplementary measure, even if ARTCI authorization is also pursued. He recommended that the consent forms be prepared in French, in clear and accessible language, and that they include a detailed description of the following:

(a) the purpose of the data collection and transfer (i.e., the internal investigation);

(b) the specific categories of data to be collected and transferred (e.g., professional email communications, personnel records, expense reports, financial records);

(c) the identity and location of all recipients of the data (including Calderwood & Harkness LLP in New York, TSL in Piraeus, and any forensic vendors engaged in connection with the investigation);

(d) the data subject's right to refuse or withdraw consent, together with a clear statement that the exercise of that right will not, in itself, result in adverse employment consequences; and

(e) the data subject's rights under the Data Privacy Law, including the right of access, rectification, and deletion.

Maître Dossou noted that the consent forms should be presented to the employees by TWA management (or, preferably, by Ivorian local counsel) in a non-coercive setting, and that each employee should be given a reasonable period to review and consider the forms before signing. He suggested that employees be informed of their right to seek independent legal advice before consenting.

3. ARTCI Filing (Article 34). Article 34 of the Data Privacy Law requires that any processing of personal data be declared to ARTCI prior to commencement. This declaration is a prerequisite to lawful data processing and is separate from, and in addition to, the cross-border transfer authorization discussed in Section II.A.1 above.

Maître Dossou advised that we should confirm whether TWA has previously filed a general data-processing declaration with ARTCI covering its routine processing of employee data (e.g., payroll, human resources, performance management). If such a declaration is already on file, it may be possible to supplement it to cover the additional processing contemplated by the investigation. If no declaration has been filed — which Maître Dossou indicated is not uncommon among smaller subsidiaries of multinational companies operating in Côte d'Ivoire — one must be filed before any investigative data processing proceeds.

The failure to file the required declaration constitutes an infraction under the Data Privacy Law and could result in administrative penalties imposed by ARTCI, as well as potential criminal sanctions under the penalty provisions of the law. Maître Dossou recommended that the filing of the declaration be treated as an urgent priority upon reactivation of the matter.

B. Employment Law Considerations

1. Confidentiality of Employee Communications. Ivorian employment law is principally governed by the Code du Travail, Loi n° 2015-532 du 20 juillet 2015 portant Code du Travail (the "Labor Code"). The Labor Code, together with general principles of Ivorian civil law and constitutional protections, recognizes an employee's right to privacy in personal communications, including communications conducted through employer-provided electronic systems.

Maître Dossou advised that, under Ivorian law, an employer may access and review employee professional email under limited circumstances. The permissibility of such access generally depends on whether: (a) the communications at issue are not marked or identifiable as personal in nature, and (b) the employer has a legitimate interest in accessing the communications and has provided the employee with prior notice that professional email is subject to employer review.

With respect to Cédric Anouma's professional email account, Maître Dossou advised that the review of professional email communications is likely permissible, provided that TWA has adopted an acceptable-use policy or IT policy that reserves the employer's right to access professional email stored on company systems. In the absence of such a policy, the legal basis for reviewing Mr. Anouma's email is less certain, and there is a risk that evidence obtained without a proper policy foundation could be challenged in subsequent proceedings, whether before the Ivorian courts or in the context of employment-related disputes.

Maître Dossou further advised that, even where an acceptable-use policy is in place, any communications that are manifestly personal — for example, emails clearly marked "personal" or "privé" in the subject line, or correspondence with a personal attorney or physician — must be segregated and not reviewed by the investigation team. The French legal principle of secret des correspondances has been influential in Ivorian jurisprudence on this point, and courts in Côte d'Ivoire have generally followed the approach of the French Cour de cassation in requiring that manifestly personal communications be excluded from employer review.

It is therefore essential that we confirm whether TWA has an acceptable-use or IT policy in place that addresses employer access to professional email. This should be verified as part of the initial document-collection and fact-gathering phase upon reactivation of the investigation.

2. Disciplinary Proceedings. Maître Dossou advised that, in the event the investigation reveals misconduct by Cédric Anouma or any other TWA employee, any disciplinary action taken by TWA must comply with the substantive and procedural requirements of the Labor Code. The failure to follow proper disciplinary procedures could expose TWA to wrongful-termination claims before the Ivorian labor courts (Tribunal du Travail), which could result in significant financial liability, including reinstatement orders and damages.

The Labor Code prescribes the following procedural steps for disciplinary action, including termination:

(a) Notice: The employee must receive written notice of the allegations against him or her, specifying the nature and basis of the alleged misconduct with sufficient detail to permit the employee to prepare a defense.

(b) Opportunity to be heard: The employee must be afforded a meaningful opportunity to respond to the allegations, typically in a formal disciplinary hearing. The employee has the right to be assisted by a person of his or her choice, which may include a union representative or other employee.

(c) Collective-bargaining agreements: Where applicable, the employer must adhere to any supplemental procedural requirements imposed by the relevant collective-bargaining agreement (convention collective). Maître Dossou indicated that he would need to confirm which collective-bargaining agreement, if any, applies to TWA and its employees.

Termination for serious fault (faute lourde) — which may include embezzlement, bribery, fraud, or other serious misconduct — is permissible under the Labor Code if the evidence is sufficient to support such a determination. However, Maître Dossou cautioned that a premature dismissal, undertaken before the investigation has been completed and without adherence to proper procedure, could give rise to a wrongful-termination claim. In such a case, the Tribunal du Travail could order reinstatement or award damages, including back pay and severance, to the dismissed employee.

The foregoing considerations are of particular significance with respect to Mr. Anouma, who occupies the position of Managing Director of TWA. Mr. Anouma is an Ivorian national, age 44, who has been employed by Thalassa group entities since 2011. He is the authorized signatory on TWA's operating accounts at Aldermere Savings Bank and personally approved the port-facilitation payments at issue in the investigation. He is the principal subject of the whistleblower complaint. Any disciplinary action or termination of Mr. Anouma must be carefully coordinated with Ivorian local counsel to ensure compliance with the Labor Code and to minimize the risk of retaliatory litigation that could compromise the investigation.

3. Whistleblower Protections. Côte d'Ivoire enacted Loi n° 2018-867 du 19 novembre 2018 portant répression de la corruption et des infractions assimilées (the "Anti-Corruption Law") as part of a broader legislative effort to strengthen the country's anti-corruption framework. The Anti-Corruption Law includes provisions designed to protect individuals who report acts of corruption or related offenses to the competent authorities. These protections extend to prohibitions on retaliation, including dismissal, demotion, harassment, or other adverse employment action taken against a reporting individual.

Maître Dossou noted that the scope of the whistleblower-protection provisions under the Anti-Corruption Law is still being developed through regulatory and judicial interpretation, and that there is limited case law on the precise contours of these protections. Nevertheless, the statute is clear in its intent to encourage reporting and to shield whistleblowers from retaliation, and TWA should proceed with caution to avoid any action that could be construed as retaliatory.

This issue is relevant because the confidential whistleblower in this matter, designated WB-1, is believed to be a former mid-level employee of TWA who was based in the Abidjan office. If this identification is correct, the Anti-Corruption Law may provide WB-1 with protections under Ivorian law that constrain TWA's ability to take adverse action against WB-1 or to pursue claims against WB-1 in the Ivorian courts. While WB-1 is no longer employed by TWA, the Anti-Corruption Law's protections may extend beyond the employment relationship, and any action taken by TWA that could be perceived as retaliatory — including the pursuit of civil claims for breach of confidentiality — should be carefully evaluated with Ivorian counsel.

For context, WB-1 filed a tip with the U.S. Securities and Exchange Commission's Office of the Whistleblower on or about May 15, 2022, assigned Tip, Complaint, or Referral ("TCR") No. 2022-WB-08341. WB-1 is represented by Marcus Hartwell of Hartwell & Crane PLLC, located at 1225 Connecticut Avenue NW, Suite 800, Washington, DC 20036. Mr. Hartwell transmitted a letter on behalf of WB-1 to Dimitra Karavelis-Stavrou (General Counsel & Chief Compliance Officer, TSL) on June 3, 2022, asserting WB-1's rights under the Dodd-Frank Act's whistleblower-protection provisions and demanding that TSL and its affiliates preserve all documents relevant to the matters described in the SEC tip. Calderwood & Harkness LLP responded to Mr. Hartwell's letter on June 17, 2022, acknowledging the preservation obligation and confirming the issuance of litigation-hold notices.

III. PRACTICAL RECOMMENDATIONS FROM MAÎTRE DOSSOU

Based on the foregoing analysis, Maître Dossou provided the following practical recommendations for the conduct of the investigation with respect to TWA and the Abidjan office:

1. Formal retention of Dossou & Mensah Avocats. Formally retain Dossou & Mensah Avocats to serve as Ivorian local counsel in connection with the investigation. Upon retention, the firm would prepare a written legal opinion addressing the ARTCI authorization process, the requirements for lawful cross-border data transfer under the Data Privacy Law, and the applicable employment-law considerations. The firm would also prepare and file the necessary ARTCI applications and declarations on behalf of TWA.

2. Preparation of employee-consent forms. Prepare employee-consent forms, drafted in French, for each of the three key custodians at the Abidjan office — Cédric Anouma, Yves Kouadio, and Adama Coulibaly. The consent forms should clearly describe the purpose of the investigation, the categories of data to be collected, the intended cross-border transfer of data, the identity and location of all recipients, and the employees' rights under the Data Privacy Law, including the right to refuse or withdraw consent. As discussed in Section II.A.2 above, the consent forms should be presented in a non-coercive setting, and employees should be given a reasonable period to review them and to seek independent legal advice if desired.

3. Review of TWA's IT acceptable-use policy. Conduct a review of TWA's existing IT acceptable-use policy (if any) to confirm that the company has reserved the right to access professional email communications stored on company systems. If no such policy exists, or if the existing policy is inadequate, Maître Dossou recommended that TWA adopt an acceptable-use policy that clearly sets out the employer's right of access, subject to the exclusion of manifestly personal communications. Any new or revised policy should be communicated to employees in writing prior to the commencement of email review.

4. Coordination with other local counsel. Coordinate with Papadakis & Lekkas LLP on Greek-law data-transfer requirements, given that certain records and communications may be transferred to TSL's offices in Piraeus, and with Okafor Bassey & Partners on analogous data-protection requirements under the Nigeria Data Protection Regulation ("NDPR"). The coordination with Nigerian counsel is particularly important because Emeka Obiora, the Country Manager of Thalassa Nigeria Limited ("TNL"), located at 5B Apapa-Oshodi Expressway, Apapa, Lagos, Nigeria, is also a key custodian and is a co-signatory on certain inter-company fund transfers between TWA and TNL that are within the scope of the investigation. The goal of this coordination is to ensure a consistent and harmonized approach to data collection and transfer across all three jurisdictions, minimizing the risk of procedural deficiencies that could compromise the investigation or the admissibility of evidence.

5. Budget estimates. Maître Dossou provided the following preliminary budget estimates for his firm's engagement:

• ARTCI filings and consent-form preparation: Approximately €15,000–€25,000 (approximately $15,750–$26,250 at the June 2022 exchange rate of €1 = $1.05).

• Full engagement as Ivorian local counsel for the investigation (including support for employee interviews, preparation or certification of the French-language Upjohn warning script, review of document collections, advice on disciplinary proceedings, and ongoing coordination with Calderwood & Harkness LLP): Estimated €35,000–€60,000 (approximately $36,750–$63,000).

These estimates are preliminary and subject to revision upon formal retention and scoping of the engagement. Maître Dossou noted that the estimates assume a matter duration of approximately six to nine months and do not include the cost of any litigation or administrative proceedings that may arise.

IV. NEXT STEPS

All next steps identified in this memorandum are currently pending due to the dormancy of the matter, which has been dormant since September 30, 2022, following Nikolaos Karavelis's request that the firm pause all external legal spend pending internal budget discussions at TSL. No further action will be taken until the matter is formally reactivated by TSL.

Upon reactivation, the following actions should be treated as immediate priorities:

1. Formally retain Dossou & Mensah Avocats as Ivorian local counsel, pursuant to an engagement letter to be prepared by Calderwood & Harkness LLP and approved by Dimitra Karavelis-Stavrou.

2. Confirm TWA's existing data-processing declarations and IT acceptable-use policies. This should be accomplished through a targeted request to TWA's management — most likely directed to Yves Kouadio (Finance Manager), given Mr. Anouma's status as a subject of the investigation — for copies of any existing ARTCI declarations, IT policies, employee handbooks, and related documentation.

3. Prepare and obtain employee-consent forms. Draft the consent forms in French, in coordination with Dossou & Mensah Avocats, and present them to the three key custodians (Anouma, Kouadio, and Coulibaly) in accordance with the procedures recommended by Maître Dossou.

4. Obtain ARTCI authorization for cross-border transfer. Prepare and submit the necessary applications to ARTCI for authorization of the cross-border transfer of personal data from TWA in Abidjan to Calderwood & Harkness LLP in New York and to TSL in Piraeus.

It should also be noted that the preparation of the French-language translation of the Upjohn warning script — a draft of which was prepared by Jasmine Thornton on August 22, 2022 — is contingent on the formal retention of Dossou & Mensah Avocats. Maître Dossou's firm would be responsible for preparing or certifying the French translation of the Upjohn warning for use in witness interviews conducted in Abidjan, ensuring that the warning is legally accurate and culturally appropriate in the Ivorian context. The Upjohn warning is a critical component of the interview protocol and must be finalized before any substantive interviews of TWA personnel are conducted.

As a further note, the document-collection delays reported by Dimitra Karavelis-Stavrou on August 15, 2022, cited concerns regarding compliance with Ivorian data-privacy law as one of the principal reasons for the delay in producing documents from the Abidjan office. The guidance obtained from Maître Dossou during these preliminary consultations, once formalized in a written legal opinion following formal retention, should provide a clear and actionable roadmap for resolving those delays and proceeding with data collection and transfer in a manner that is compliant with Ivorian law.

For reference, the total estimated third-party costs across all local-counsel jurisdictions — including Papadakis & Lekkas LLP (Greece), Dossou & Mensah Avocats (Côte d'Ivoire), and Okafor Bassey & Partners (Nigeria), together with the fees of Northpoint Forensic Advisors LLC (forensic accounting and e-discovery) — are estimated at $225,000–$400,000, as set forth in the Interim Status Memorandum dated September 12, 2022. The Ivorian local-counsel costs described in this memorandum represent a subset of that total estimate.

— End of Memorandum —

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP
MEMORANDUM
TO: Victoria Chambers
FROM: Liam Donahue
DATE: October 5, 2022
RE: Summary of Consultation with Dossou & Mensah Avocats (Abidjan) — Data Privacy and Employment Law Issues; Matter No. 1044-00007
I. BACKGROUND
At the direction of Victoria Chambers, I conducted a preliminary consultation with Maître Amadou Dossou of Dossou & Mensah Avocats, based in Abidjan, Côte d'Ivoire. The initial consultation took place by videoconference on September 22, 2022, with a follow-up telephone call on October 3, 2022. This memorandum summarizes the substance of those discussions and the preliminary legal guidance provided by Maître Dossou.
The purpose of the consultation was to discuss data-privacy and employment-law issues arising from the collection and cross-border transfer of employee communications and personnel records from the Abidjan office of Thalassa West Africa SARL ("TWA"), located at Rue des Lagunes 27, Zone Portuaire, Abidjan, Côte d'Ivoire. These issues arise in connection with the internal investigation being conducted under the Foreign Corrupt Practices Act ("FCPA") into port-facilitation and customs-clearance payments made by TWA to Goldenshore Maritime Consultants Ltd. pursuant to the Port Agency and Facilitation Services Agreement dated March 1, 2018. The investigation was initiated following receipt of information from a confidential whistleblower source, as previously detailed in the Preliminary Investigation Plan Memorandum dated July 18, 2022.
The key custodians whose data is at issue in the Abidjan office are as follows:
• Cédric Anouma, Managing Director, TWA;
• Yves Kouadio, Finance Manager, TWA; and
• Adama Coulibaly, Operations Coordinator, TWA.
As described in more detail in Section II.B.2 below, Mr. Anouma is of particular significance as the authorized signatory on TWA's operating accounts and the individual who approved the port-facilitation payments at issue. He is also the subject of the whistleblower complaint.
Dossou & Mensah Avocats is a twelve-attorney firm based in Abidjan that specializes in corporate, banking, and compliance law in Côte d'Ivoire. Maître Dossou, a founding partner, has particular experience advising multinational companies on cross-border investigations and data transfers, including in the context of regulatory inquiries initiated by U.S. and European authorities. He has previously advised on data-transfer issues in connection with investigations conducted by the U.S. Department of Justice and the Securities and Exchange Commission, though the specific representations are subject to client confidentiality.
It should be noted that Dossou & Mensah Avocats has been consulted on a preliminary, informal basis but has not yet been formally retained as Ivorian local counsel on this matter. Formal retention remains contingent on reactivation of the investigation, which has been dormant since September 30, 2022, pursuant to Nikolaos Karavelis's request that the firm pause external legal spend pending internal budget discussions, as communicated in the hold-status letter of that date.
For purposes of coordination, the consultation with Dossou & Mensah Avocats is part of a broader engagement with local counsel across the jurisdictions implicated by the investigation. Calderwood & Harkness LLP is also working with Papadakis & Lekkas LLP (Greek local counsel, led by Stavros Lekkas, 28 Vasilissis Sofias Avenue, Athens 106 74, Greece), which is advising on Greek data-protection and corporate-governance issues affecting Thalassa Shipping Lines S.A. ("TSL"), the parent company, and with Okafor Bassey & Partners (Nigerian local counsel, led by Ngozi Okafor, 4th Floor, Marina Towers, 22 Marina Street, Lagos Island, Lagos, Nigeria), which is advising on analogous data-protection and employment-law issues affecting Thalassa Nigeria Limited ("TNL").
II. KEY LEGAL ISSUES
A. Loi n° 2013-450 (Data Privacy)
The principal data-privacy statute in Côte d'Ivoire is the Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel (the "Data Privacy Law"). This law establishes a comprehensive framework governing the collection, processing, storage, and transfer of personal data, broadly modeled on the European Union's former Data Protection Directive (Directive 95/46/EC), though with certain significant differences. The Data Privacy Law applies to all natural and legal persons who collect or process personal data within the territory of Côte d'Ivoire, and its protections extend to all identifiable natural persons, including employees.
The supervisory authority charged with enforcement and administration of the Data Privacy Law is the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire ("ARTCI"), which exercises regulatory oversight over data-processing activities and has the power to grant or deny authorizations for cross-border data transfers.
The following provisions of the Data Privacy Law were discussed in detail during the consultations with Maître Dossou:
1. Prior Authorization for Cross-Border Transfer (Article 36). Article 36 of the Data Privacy Law provides that the transfer of personal data to a country that does not provide an "adequate level of protection" (niveau de protection suffisant) requires prior authorization from ARTCI. The adequacy determination is made by ARTCI based on a number of factors, including the nature of the data, the purpose and duration of the proposed processing, the country of origin and the country of destination, the general and sectoral legal framework of the destination country, and the security measures in force.
Maître Dossou confirmed that, as of the date of our consultations, neither the United States nor Greece is currently included on ARTCI's list of countries recognized as providing an adequate level of protection for personal data. This is consistent with the general posture of Francophone African data-protection authorities, which have tended to follow the European Commission's adequacy determinations prior to the Schrems II decision but have not independently updated their own lists to reflect post-Schrems II developments.
Therefore, transferring TWA employee emails, personal data, and personnel records to Calderwood & Harkness LLP in New York (600 Lexington Avenue, 38th Floor, New York, NY 10022) or to TSL in Piraeus (14 Poseidonos Avenue, Piraeus 185 31, Greece) will require one of the following:
(a) prior authorization from ARTCI pursuant to Article 36;
(b) the express consent of the relevant data subjects (i.e., the employees whose data is being transferred), obtained in accordance with Article 10 of the Data Privacy Law (discussed further in Section II.A.2 below); or
(c) reliance on an applicable statutory exception, such as the exception for data transfers necessary for the performance of a legal obligation, the protection of vital interests of the data subject, or the execution of a contract to which the data subject is a party.
Maître Dossou expressed the view that, in practice, the most prudent approach would be to pursue both ARTCI authorization and employee consent simultaneously, as the exceptions under clause (c) above are narrowly construed by ARTCI and have not been tested in the context of cross-border investigations of this nature. He noted that ARTCI has been increasingly active in enforcement in recent years and that proceeding without authorization would create a meaningful compliance risk, including the possibility of administrative sanctions and potential inadmissibility of improperly transferred data in subsequent proceedings.
The ARTCI authorization process typically requires the submission of a detailed application describing the nature and purpose of the transfer, the categories of data to be transferred, the identity and location of the recipient, and the safeguards in place to protect the data upon transfer. Maître Dossou estimated that the authorization process, once initiated, could take approximately six to twelve weeks, depending on ARTCI's caseload and the complexity of the request. He emphasized the importance of engaging with ARTCI early and cooperatively, as the regulator tends to look more favorably upon applications made proactively rather than after data transfers have already occurred.
2. Employee Consent (Article 10). Article 10 of the Data Privacy Law provides that personal data may be lawfully processed where the data subject has given "free, specific, informed, and express" (libre, spécifique, éclairé et exprès) consent. This consent standard is broadly consistent with the consent requirements under the European Union's General Data Protection Regulation ("GDPR"), though the specific interpretive guidance issued by ARTCI is less developed than that of European supervisory authorities.
Maître Dossou cautioned that employee consent obtained in the context of an internal investigation may be vulnerable to challenge on the ground that it was not truly "free" given the inherent power imbalance in the employment relationship. This concern is well recognized in European data-protection jurisprudence (see, e.g., Article 29 Working Party, Opinion 2/2017 on Data Processing at Work, WP 249, June 8, 2017) and is increasingly acknowledged by Francophone African regulators as well. The risk is particularly acute where the employee is a potential subject of the investigation, as is the case with Mr. Anouma, because the employee may reasonably feel that refusal to consent could result in adverse employment consequences.
Notwithstanding this concern, Maître Dossou recommended that consent forms be obtained from each of the key custodians as a supplementary measure, even if ARTCI authorization is also pursued. He recommended that the consent forms be prepared in French, in clear and accessible language, and that they include a detailed description of the following:
(a) the purpose of the data collection and transfer (i.e., the internal investigation);
(b) the specific categories of data to be collected and transferred (e.g., professional email communications, personnel records, expense reports, financial records);
(c) the identity and location of all recipients of the data (including Calderwood & Harkness LLP in New York, TSL in Piraeus, and any forensic vendors engaged in connection with the investigation);
(d) the data subject's right to refuse or withdraw consent, together with a clear statement that the exercise of that right will not, in itself, result in adverse employment consequences; and
(e) the data subject's rights under the Data Privacy Law, including the right of access, rectification, and deletion.
Maître Dossou noted that the consent forms should be presented to the employees by TWA management (or, preferably, by Ivorian local counsel) in a non-coercive setting, and that each employee should be given a reasonable period to review and consider the forms before signing. He suggested that employees be informed of their right to seek independent legal advice before consenting.
3. ARTCI Filing (Article 34). Article 34 of the Data Privacy Law requires that any processing of personal data be declared to ARTCI prior to commencement. This declaration is a prerequisite to lawful data processing and is separate from, and in addition to, the cross-border transfer authorization discussed in Section II.A.1 above.
Maître Dossou advised that we should confirm whether TWA has previously filed a general data-processing declaration with ARTCI covering its routine processing of employee data (e.g., payroll, human resources, performance management). If such a declaration is already on file, it may be possible to supplement it to cover the additional processing contemplated by the investigation. If no declaration has been filed — which Maître Dossou indicated is not uncommon among smaller subsidiaries of multinational companies operating in Côte d'Ivoire — one must be filed before any investigative data processing proceeds.
The failure to file the required declaration constitutes an infraction under the Data Privacy Law and could result in administrative penalties imposed by ARTCI, as well as potential criminal sanctions under the penalty provisions of the law. Maître Dossou recommended that the filing of the declaration be treated as an urgent priority upon reactivation of the matter.
B. Employment Law Considerations
1. Confidentiality of Employee Communications. Ivorian employment law is principally governed by the Code du Travail, Loi n° 2015-532 du 20 juillet 2015 portant Code du Travail (the "Labor Code"). The Labor Code, together with general principles of Ivorian civil law and constitutional protections, recognizes an employee's right to privacy in personal communications, including communications conducted through employer-provided electronic systems.
Maître Dossou advised that, under Ivorian law, an employer may access and review employee professional email under limited circumstances. The permissibility of such access generally depends on whether: (a) the communications at issue are not marked or identifiable as personal in nature, and (b) the employer has a legitimate interest in accessing the communications and has provided the employee with prior notice that professional email is subject to employer review.
With respect to Cédric Anouma's professional email account, Maître Dossou advised that the review of professional email communications is likely permissible, provided that TWA has adopted an acceptable-use policy or IT policy that reserves the employer's right to access professional email stored on company systems. In the absence of such a policy, the legal basis for reviewing Mr. Anouma's email is less certain, and there is a risk that evidence obtained without a proper policy foundation could be challenged in subsequent proceedings, whether before the Ivorian courts or in the context of employment-related disputes.
Maître Dossou further advised that, even where an acceptable-use policy is in place, any communications that are manifestly personal — for example, emails clearly marked "personal" or "privé" in the subject line, or correspondence with a personal attorney or physician — must be segregated and not reviewed by the investigation team. The French legal principle of secret des correspondances has been influential in Ivorian jurisprudence on this point, and courts in Côte d'Ivoire have generally followed the approach of the French Cour de cassation in requiring that manifestly personal communications be excluded from employer review.
It is therefore essential that we confirm whether TWA has an acceptable-use or IT policy in place that addresses employer access to professional email. This should be verified as part of the initial document-collection and fact-gathering phase upon reactivation of the investigation.
2. Disciplinary Proceedings. Maître Dossou advised that, in the event the investigation reveals misconduct by Cédric Anouma or any other TWA employee, any disciplinary action taken by TWA must comply with the substantive and procedural requirements of the Labor Code. The failure to follow proper disciplinary procedures could expose TWA to wrongful-termination claims before the Ivorian labor courts (Tribunal du Travail), which could result in significant financial liability, including reinstatement orders and damages.
The Labor Code prescribes the following procedural steps for disciplinary action, including termination:
(a) Notice: The employee must receive written notice of the allegations against him or her, specifying the nature and basis of the alleged misconduct with sufficient detail to permit the employee to prepare a defense.
(b) Opportunity to be heard: The employee must be afforded a meaningful opportunity to respond to the allegations, typically in a formal disciplinary hearing. The employee has the right to be assisted by a person of his or her choice, which may include a union representative or other employee.
(c) Collective-bargaining agreements: Where applicable, the employer must adhere to any supplemental procedural requirements imposed by the relevant collective-bargaining agreement (convention collective). Maître Dossou indicated that he would need to confirm which collective-bargaining agreement, if any, applies to TWA and its employees.
Termination for serious fault (faute lourde) — which may include embezzlement, bribery, fraud, or other serious misconduct — is permissible under the Labor Code if the evidence is sufficient to support such a determination. However, Maître Dossou cautioned that a premature dismissal, undertaken before the investigation has been completed and without adherence to proper procedure, could give rise to a wrongful-termination claim. In such a case, the Tribunal du Travail could order reinstatement or award damages, including back pay and severance, to the dismissed employee.
The foregoing considerations are of particular significance with respect to Mr. Anouma, who occupies the position of Managing Director of TWA. Mr. Anouma is an Ivorian national, age 44, who has been employed by Thalassa group entities since 2011. He is the authorized signatory on TWA's operating accounts at Aldermere Savings Bank and personally approved the port-facilitation payments at issue in the investigation. He is the principal subject of the whistleblower complaint. Any disciplinary action or termination of Mr. Anouma must be carefully coordinated with Ivorian local counsel to ensure compliance with the Labor Code and to minimize the risk of retaliatory litigation that could compromise the investigation.
3. Whistleblower Protections. Côte d'Ivoire enacted Loi n° 2018-867 du 19 novembre 2018 portant répression de la corruption et des infractions assimilées (the "Anti-Corruption Law") as part of a broader legislative effort to strengthen the country's anti-corruption framework. The Anti-Corruption Law includes provisions designed to protect individuals who report acts of corruption or related offenses to the competent authorities. These protections extend to prohibitions on retaliation, including dismissal, demotion, harassment, or other adverse employment action taken against a reporting individual.
Maître Dossou noted that the scope of the whistleblower-protection provisions under the Anti-Corruption Law is still being developed through regulatory and judicial interpretation, and that there is limited case law on the precise contours of these protections. Nevertheless, the statute is clear in its intent to encourage reporting and to shield whistleblowers from retaliation, and TWA should proceed with caution to avoid any action that could be construed as retaliatory.
This issue is relevant because the confidential whistleblower in this matter, designated WB-1, is believed to be a former mid-level employee of TWA who was based in the Abidjan office. If this identification is correct, the Anti-Corruption Law may provide WB-1 with protections under Ivorian law that constrain TWA's ability to take adverse action against WB-1 or to pursue claims against WB-1 in the Ivorian courts. While WB-1 is no longer employed by TWA, the Anti-Corruption Law's protections may extend beyond the employment relationship, and any action taken by TWA that could be perceived as retaliatory — including the pursuit of civil claims for breach of confidentiality — should be carefully evaluated with Ivorian counsel.
For context, WB-1 filed a tip with the U.S. Securities and Exchange Commission's Office of the Whistleblower on or about May 15, 2022, assigned Tip, Complaint, or Referral ("TCR") No. 2022-WB-08341. WB-1 is represented by Marcus Hartwell of Hartwell & Crane PLLC, located at 1225 Connecticut Avenue NW, Suite 800, Washington, DC 20036. Mr. Hartwell transmitted a letter on behalf of WB-1 to Dimitra Karavelis-Stavrou (General Counsel & Chief Compliance Officer, TSL) on June 3, 2022, asserting WB-1's rights under the Dodd-Frank Act's whistleblower-protection provisions and demanding that TSL and its affiliates preserve all documents relevant to the matters described in the SEC tip. Calderwood & Harkness LLP responded to Mr. Hartwell's letter on June 17, 2022, acknowledging the preservation obligation and confirming the issuance of litigation-hold notices.
III. PRACTICAL RECOMMENDATIONS FROM MAÎTRE DOSSOU
Based on the foregoing analysis, Maître Dossou provided the following practical recommendations for the conduct of the investigation with respect to TWA and the Abidjan office:
1. Formal retention of Dossou & Mensah Avocats. Formally retain Dossou & Mensah Avocats to serve as Ivorian local counsel in connection with the investigation. Upon retention, the firm would prepare a written legal opinion addressing the ARTCI authorization process, the requirements for lawful cross-border data transfer under the Data Privacy Law, and the applicable employment-law considerations. The firm would also prepare and file the necessary ARTCI applications and declarations on behalf of TWA.
2. Preparation of employee-consent forms. Prepare employee-consent forms, drafted in French, for each of the three key custodians at the Abidjan office — Cédric Anouma, Yves Kouadio, and Adama Coulibaly. The consent forms should clearly describe the purpose of the investigation, the categories of data to be collected, the intended cross-border transfer of data, the identity and location of all recipients, and the employees' rights under the Data Privacy Law, including the right to refuse or withdraw consent. As discussed in Section II.A.2 above, the consent forms should be presented in a non-coercive setting, and employees should be given a reasonable period to review them and to seek independent legal advice if desired.
3. Review of TWA's IT acceptable-use policy. Conduct a review of TWA's existing IT acceptable-use policy (if any) to confirm that the company has reserved the right to access professional email communications stored on company systems. If no such policy exists, or if the existing policy is inadequate, Maître Dossou recommended that TWA adopt an acceptable-use policy that clearly sets out the employer's right of access, subject to the exclusion of manifestly personal communications. Any new or revised policy should be communicated to employees in writing prior to the commencement of email review.
4. Coordination with other local counsel. Coordinate with Papadakis & Lekkas LLP on Greek-law data-transfer requirements, given that certain records and communications may be transferred to TSL's offices in Piraeus, and with Okafor Bassey & Partners on analogous data-protection requirements under the Nigeria Data Protection Regulation ("NDPR"). The coordination with Nigerian counsel is particularly important because Emeka Obiora, the Country Manager of Thalassa Nigeria Limited ("TNL"), located at 5B Apapa-Oshodi Expressway, Apapa, Lagos, Nigeria, is also a key custodian and is a co-signatory on certain inter-company fund transfers between TWA and TNL that are within the scope of the investigation. The goal of this coordination is to ensure a consistent and harmonized approach to data collection and transfer across all three jurisdictions, minimizing the risk of procedural deficiencies that could compromise the investigation or the admissibility of evidence.
5. Budget estimates. Maître Dossou provided the following preliminary budget estimates for his firm's engagement:
• ARTCI filings and consent-form preparation: Approximately €15,000–€25,000 (approximately $15,750–$26,250 at the June 2022 exchange rate of €1 = $1.05).
• Full engagement as Ivorian local counsel for the investigation (including support for employee interviews, preparation or certification of the French-language Upjohn warning script, review of document collections, advice on disciplinary proceedings, and ongoing coordination with Calderwood & Harkness LLP): Estimated €35,000–€60,000 (approximately $36,750–$63,000).
These estimates are preliminary and subject to revision upon formal retention and scoping of the engagement. Maître Dossou noted that the estimates assume a matter duration of approximately six to nine months and do not include the cost of any litigation or administrative proceedings that may arise.
IV. NEXT STEPS
All next steps identified in this memorandum are currently pending due to the dormancy of the matter, which has been dormant since September 30, 2022, following Nikolaos Karavelis's request that the firm pause all external legal spend pending internal budget discussions at TSL. No further action will be taken until the matter is formally reactivated by TSL.
Upon reactivation, the following actions should be treated as immediate priorities:
1. Formally retain Dossou & Mensah Avocats as Ivorian local counsel, pursuant to an engagement letter to be prepared by Calderwood & Harkness LLP and approved by Dimitra Karavelis-Stavrou.
2. Confirm TWA's existing data-processing declarations and IT acceptable-use policies. This should be accomplished through a targeted request to TWA's management — most likely directed to Yves Kouadio (Finance Manager), given Mr. Anouma's status as a subject of the investigation — for copies of any existing ARTCI declarations, IT policies, employee handbooks, and related documentation.
3. Prepare and obtain employee-consent forms. Draft the consent forms in French, in coordination with Dossou & Mensah Avocats, and present them to the three key custodians (Anouma, Kouadio, and Coulibaly) in accordance with the procedures recommended by Maître Dossou.
4. Obtain ARTCI authorization for cross-border transfer. Prepare and submit the necessary applications to ARTCI for authorization of the cross-border transfer of personal data from TWA in Abidjan to Calderwood & Harkness LLP in New York and to TSL in Piraeus.
It should also be noted that the preparation of the French-language translation of the Upjohn warning script — a draft of which was prepared by Jasmine Thornton on August 22, 2022 — is contingent on the formal retention of Dossou & Mensah Avocats. Maître Dossou's firm would be responsible for preparing or certifying the French translation of the Upjohn warning for use in witness interviews conducted in Abidjan, ensuring that the warning is legally accurate and culturally appropriate in the Ivorian context. The Upjohn warning is a critical component of the interview protocol and must be finalized before any substantive interviews of TWA personnel are conducted.
As a further note, the document-collection delays reported by Dimitra Karavelis-Stavrou on August 15, 2022, cited concerns regarding compliance with Ivorian data-privacy law as one of the principal reasons for the delay in producing documents from the Abidjan office. The guidance obtained from Maître Dossou during these preliminary consultations, once formalized in a written legal opinion following formal retention, should provide a clear and actionable roadmap for resolving those delays and proceeding with data collection and transfer in a manner that is compliant with Ivorian law.
For reference, the total estimated third-party costs across all local-counsel jurisdictions — including Papadakis & Lekkas LLP (Greece), Dossou & Mensah Avocats (Côte d'Ivoire), and Okafor Bassey & Partners (Nigeria), together with the fees of Northpoint Forensic Advisors LLC (forensic accounting and e-discovery) — are estimated at $225,000–$400,000, as set forth in the Interim Status Memorandum dated September 12, 2022. The Ivorian local-counsel costs described in this memorandum represent a subset of that total estimate.
— End of Memorandum —

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP

MEMORANDUM

I. BACKGROUND

II. KEY LEGAL ISSUES

III. PRACTICAL RECOMMENDATIONS FROM MAÎTRE DOSSOU

IV. NEXT STEPS

Record

Parties

Dates

Amounts