Harleysville Ins. Co. v. Holding Funeral Home, Inc., No. 1:15cv00057 (W.D. Va. Feb. 9, 2017)

In this case, the court found that the placement of privileged information on a file share site and dissemination of the hyperlink to access that information without additional protections (e.g, password protection) constituted a failure to take reasonable steps to protect the information and that the attorney-client privilege and work-product protections were waived.  Notably, however, because defense counsel accessed the information but failed to notify Plaintiff’s counsel of the possible production of privileged materials, they were ordered to pay Plaintiff’s fees and costs in bringing the motion to disqualify them, which was denied.

In this case, Plaintiff sued Defendants seeking a declaratory judgment that it did not owe Defendants for their fire loss claim. “In an effort to share information electronically,” a senior investigator for Nationwide Insurance, Plaintiff’s owner, uploaded surveillance footage to a file share service operated by Box, Inc. (the “Box Site”) and sent an email containing a link to the site to a third party at the National Insurance Crime Bureau (“NICB”).  The transmittal email contained a statement of confidentiality (“CONFIDENTIALITY NOTICE: This e-mail contains information that is privileged and confidential …”).  The information on the Box Site was not password protected and Plaintiff conceded that anyone with access to the hyperlink could access the information and that “any person who had access to the internet could have accessed the Box Site simply by typing in the url address in a web browser.”  For a time, only the video was present on the Box Site.  However, many months later, the senior investigator uploaded Plaintiff’s entire claims file and Nationwide’s entire investigation file to the site (collectively “the claims files”), to be accessed by Plaintiff’s counsel using the same hyperlink provided to the NICB.  Unfortunately, in response to a subpoena, the NICB electronically produced the email containing the link, thus giving defense counsel access to the file share site … and the claims files.  Defense counsel subsequently accessed the site and reviewed and downloaded the entire claims file, but did not notify Plaintiff’s counsel of the possible production of privileged information.  When Plaintiff’s counsel learned of Defense counsels’ access to the claims files—because they were produced in discovery from the defendants—Plaintiff moved to disqualify them.  Defense counsel argued that disqualification was not appropriate because Plaintiff had waived privilege by placing the information on the Box Site “where it could be accessed by anyone.”

The court first addressed the question of whether the attorney-client privilege and work-product protections had been waived and concluded that they had. Summarizing broadly, the court applied Virginia state law considering the “reasonableness of the precautions to prevent inadvertent disclosures,” the “time taken to rectify the error” and the “extent of the disclosure,” and found that the attorney-client privilege was waived.  Indeed, the court characterized Plaintiff’s disclosure as “vast” because it was “accessible to anyone with access to the internet” and likened Plaintiff’s placement of the information on the Box Site without a password to “leaving its claims file on a bench in the public square and telling its counsel where they could find it.”  The court reasoned that it did not matter whether the employee who posted the information believed that the information would be available for only a short period because he had used the service before and therefore “knew—or should have known—that the information uploaded to the site was not protected in any way and could be accessed by anyone who simply clicked on the hyperlink.”  Similarly, the court concluded that Plaintiff’s counsel “knew—or should have known—that the information was accessible on the internet” based on their use of the unprotected hyperlink to download the claims file themselves. Turning to whether the work-product protection was also waived, the court applied federal law, and again concluded that the protection had been waived where it could not consider the disclosure “inadvertent” or that “reasonable steps” had been taken to prevent disclosure and therefore found that Fed. R. Evid. 502 did “not apply in this situation to prevent a waiver of the work-product doctrine.”

Despite finding that the attorney-client privilege and work-product protection were waived, the court imposed sanctions against defense counsel for failing to notify Plaintiff’s counsel of the production of potentially privileged information, which the court reasoned was apparent on the face of the email containing the link because of the “Confidentiality Notice, which should have provided sufficient notice to defense counsel that the sender was asserting that the information was protected from disclosure.”

The court holds that, by using the hyperlink contained in the email also containing the Confidentiality Notice to access the Box Site, defense counsel should have realized that the Box Site might contain privileged or protected information. This belief should have been further confirmed when defense counsel realized that the Box Site contained not only the Video, but Harleysville’s Claims File. That being the case, defense counsel should have contacted Harleysville’s counsel and revealed that it had access to this information. If defense counsel believed that the circumstances which allowed its access to the information waived any claim of privilege or protection, they should have asked the court to decide the issue before making any use of or disseminating the information. Counsel chose not to do so, however, and, therefore, the court believes that such conduct requires some sanction.

Ultimately, the court determined that disqualification was not warranted, but indicated that “defense counsel should bear the cost of the parties in obtaining the court’s ruling on the matter.”