Login | June 18, 2018

Unprotected documents waive attorney-client privilege

Technology for Lawyers

Published: May 19, 2017

Discovery. ESI. The cloud. Unsecured documents. Unchecked discovery transmission.

Those five things should never be put together by lawyers. When you do that, as in Harleysville Insurance Company v. Holding Funeral Home Inc (W.D. Virginia, 2017), really bad things can happen.

This was a civil arson case, in which the insurance company denied coverage for a fire. At issue was whether or not defense counsel was entitled to access to the entire claims file, as well as motions for sanctions against defense counsel.

During the course of discovery, Harleysville transmitted documents to Holding that contained a link. That went to a Box account. That contained the insurance company’s video surveillance footage of the fire loss scene. That were not secured by encryption or password. That affected the outcome of the case. That made me laugh that, in this day and age, something like that can happen. Cause lawyers are smart.

Issue: was this data protected by attorney-client privilege rules?

Answer: no, it is not. Ouch.

Sub-answer: you turned discovery over without reading through the documents and finding that link. Nice lawyering. You lose. Go find a malpractice defense attorney, quick.

Reasoning. The court wrote: “(T)he information uploaded to this site was available for viewing by anyone, anywhere who was connected to the internet and happened upon the site by use of the hyperlink or otherwise…. It is hard to image (sic) an act that would be more contrary to protecting the confidentiality of information than to post that information to the worldwide web…. I cannot find that Harleysville, or its counsel, took reasonable steps to prevent its disclosure or to rectify the situation. Therefore, I find that Rule 502 does not apply in this situation to prevent a waiver of the work-product doctrine.”

However, the court did find that, at the same time, the court found that the Holding lawyers’ actions in not contacting the Harleysville lawyers when they discovered that link warranted sanctions under inadvertent discovery rules, saying: “defense counsel should have realized that the Box Site might contain privileged or protected information…and should have contacted Harleysville's counsel and revealed that it had access to this information.”

Sanctions were only that the costs of the action were placed on the defendant, but defense counsel got to keep the video. Interesting and well-written case, if you want to Google it.