March 15, 2017 – What happens when an office staff person inadvertently shares a link to confidential files to the opposing party in discovery?

Question

I’ve been retained by an insurance company to defend against a fire loss claim. The insurance company investigator is looking into the factual allegations, and I’ve instructed one of my office staff to work with the investigator. Time went by, and as discovery progressed, I came to learn that my office staff person had placed significant portions of our file on an online file-sharing site to share with the investigator. Unfortunately, it turns out that we produced the link to the file-sharing site to the opposing party in discovery, and now opposing counsel has accessed and downloaded the file from the file-sharing site.

Have we lost privilege with respect to those materials?

Answer

This subject is based on the facts of a recent magistrate judge’s memorandum opinion in Harleysville Insurance Co. v. Holding Funeral Home, Inc., 2017 BL 39590 W.D. Va., No. 1:15cv00057.

In that case, an employee of the insurance company uploaded the claims file to Box, a file sharing site. The employee shared the link with an investigator and Harleysville’s counsel, but the site was not password protected, and was available for viewing and downloading by anyone who came across the site. A copy of the hyperlink to the file was produced to opposing counsel as part of the response to a discovery request.

After counsel for the insurance company (Harleysville) learned that opposing counsel had accessed the file, counsel filed a motion arguing that the file materials posted on the file-sharing site were privileged, and that opposing counsel should be disqualified for accessing the materials.

Taking Reasonable Measures

In considering whether the file materials were privileged, the magistrate noted that anyone with a link to the materials could access the file, and that they were placed on the site intentionally. The magistrate’s opinion, which is worth quoting at some length, then focused on the reasonableness of precautions taken to prevent disclosure, or put another way, the steps taken to preserve the confidentiality of the information. He stated:

With regard to the reasonableness of the precautions taken to prevent the disclosure, the court has no evidence before it that any precautions were taken to prevent this disclosure. The employee who uploaded Harleysville's Claims File to the Box Site had used the site previously to share information with a third-party, the NICB. It does not matter whether this employee believed that this site would function for only a short period of time or that the information uploaded to the site would be accessible for only a short period of time. Because of his previous use of the Box Site, this employee either knew — or should have known — that the information uploaded to the site was not protected in any way and could be accessed by anyone who simply clicked on the hyperlink. Despite this, this employee purposefully uploaded the Claims File to the Box Site, making it accessible to anyone with access to the internet, thus making the extent of the disclosure vast. Also, Harleysville has stated that the Claims File was uploaded on April 26, 2016. The entire Claims File remained accessible on the Box Site until sometime after October 27, 2016, the date that Harleysville's counsel asserts that they discovered that defense counsel had the Claims File. Harleysville concedes that no action was taken any earlier than this date to block access to the Claims File despite the fact that Harleysville's counsel, themselves, used the unprotected hyperlink to access the Box Site to download the Claims File sometime after it was uploaded on April 26. Therefore, they, too, knew — or should have known — that the information was accessible on the internet. The court in Walton plainly stated, "waiver may occur if the disclosing party failed to take reasonable measures to ensure and maintain the document's confidentiality, or to take prompt and reasonable steps to rectify the error." 694 S.E.2d at 552.

Based on these facts, I find that Harleysville has waived any claim of attorney-client privilege with regard to the information posted to the Box Site. It has conceded that the Box Site was not password protected and that the information uploaded to this site was available for viewing by anyone, anywhere who was connected to the internet and happened upon the site by use of the hyperlink or otherwise. In essence, Harleysville has conceded that its actions were the cyber world equivalent of leaving its claims file on a bench in the public square and telling its counsel where they could find it. It is hard to imagine an act that would be more contrary to protecting the confidentiality of information than to post that information to the World Wide Web.

The court believes that its decision on this issue fosters the better public policy. The technology involved in information sharing is rapidly evolving. Whether a company chooses to use a new technology is a decision within that company's control. If it chooses to use a new technology, however, it should be responsible for ensuring that its employees and agents understand how the technology works, and, more importantly, whether the technology allows unwanted access by others to its confidential information.

(emphasis added)

On Disqualification

The magistrate then focused on the issue of disqualification. After considering two Virginia State Bar Ethics Opinions, as well as federal and state court rules, the opinion states as follows:

This court should demand better, and the ruling here is intended not to merely tolerate the bare minimum ethically compliant behavior, but, instead, to encourage the highest professional standards from those attorneys who practice before the court. The court holds that, by using the hyperlink contained in the email also containing the Confidentiality Notice to access the Box Site, defense counsel should have realized that the Box Site might contain privileged or protected information. This belief should have been further confirmed when defense counsel realized that the Box Site contained not only the Video, but Harleysville's Claims File. That being the case, defense counsel should have contacted Harleysville's counsel and revealed that it had access to this information. If defense counsel believed that the circumstances which allowed its access to the information waived any claim of privilege or protection, they should have asked the court to decide the issue before making any use of or disseminating the information. Counsel chose not to do so, however, and, therefore, the court believes that such conduct requires some sanction.

The magistrate then imposed the costs of hearing the motion on defense counsel.

What This Means for Confidentiality

There are a few points to take away from this opinion.

1. Take steps to ensure the confidentiality of client information.

SCR 20:1.6(d) states:

A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.

This recent addition to SCR 20:1.6 (1/1/17) imposes a black letter duty on lawyers to act reasonably to prevent the unauthorized access to client information, including client information stored in electronic form with third-party service providers, such as file-sharing sites. Needless to say, such sites where information is unencrypted and easily accessible to anyone with a link should not be used by lawyers, and while this is not a disciplinary case, it’s not difficult to apply this rule to these facts. While sharing information online is convenient, security must be a paramount concern for lawyers when it comes to client information.

See Wisconsin Ethics Opinion EF-15-01 for guidance with respect to use of such third-party service providers.

2. Make sure your staff understands your duty of confidentiality.

SCR 20:5.3 imposes a duty on lawyers to make reasonable efforts to assure that nonlawyers under their supervision conduct themselves in ways that are compatible with the lawyer’s professional duties. Thus, for example, a lawyer who entrusts the handling of client information in electronic form to nonlawyer assistants is responsible for providing reasonable training and guidance to assure that the nonlawyer protects the confidentiality of that information. This means that everyone in a law firm who handles client information and uses the internet understands the importance of security.

3. Be careful with privileged materials.

The magistrate judge in this case viewed counsel for the funeral home as having an obligation to notify counsel for Harleysville that it had received access to the claims file. But in this case, it isn’t clear that the link to the file-sharing site was inadvertently sent to counsel for the funeral home, and there is no explicit obligation under the disciplinary rules to notify opposing counsel when in receipt of privileged information that was not inadvertently sent to the recipient. SCR 20:4.4 does require such notification, but only when information is sent inadvertently.

Nonetheless, some courts have a tendency to believe that lawyers have an obligation to notify the holder of the privilege (or their lawyer) whenever they have access to privileged information. For example, in In re Eisenstein, 2016 BL 107979, Mo., the Missouri Supreme Court held that a lawyer whose client gave the lawyer copies of the opposing party’s privileged materials (thus the materials were not inadvertently sent to the lawyer) had an obligation to promptly notify opposing counsel pursuant to Missouri Supreme Court Rule 4-4.4(a), despite the fact that rule contains no notice requirement.

While the recently adopted SCR 20:4.4(c) provides guidance to lawyers who receive privileged information, the plain language of the rule limits its requirements to information that is inadvertently sent to the lawyer. Lawyers should carefully consider the handling of any materials that appear to be privileged and whether notification of opposing counsel is warranted.