Implicit Waiver of Privilege

Overview

Solicitor-client privilege and litigation privilege are a fundamental component of our justice system. Solicitor-client privilege is intended to provide “full, free and frank communication between those who need legal advice and those who are best able to provide it,” a concept clearly stated by the Supreme Court of Canada in Blank v. Canada (Minister of Justice). Litigation privilege, on the other hand, is intended to ensure efficacy of the adversarial process and to protect communications between a solicitor and third parties in contemplation of, or during ongoing litigation. In Kennedy v. McKenzie, the Ontario Superior Court held that a party asserting litigation privilege must establish that the documents were created for the dominant purpose of existing, contemplated, or anticipated litigation.

Expert reports, when obtained through external counsel, are generally considered privileged and will be protected from disclosure requirements in the context of litigation. However, the privilege belongs to the client and can be waived, whether implicitly by action, or explicitly by choice. The Ontario Superior Court of Justice (the “Court”) ruling in Kaplan v. Casino Rama Services Inc. (“Kaplan”), is an example of how privilege can be implicitly waived in the context of litigation.

Case Summary

Facts

A class action was launched against the defendant, the owner and operators of Casino Rama, after it notified approximately 200,000 individuals of a cyber-attack in 2016.

External counsel to the defendant had retained a third party cybersecurity firm on behalf of its client to conduct an investigation into the cyber-attack. The firm produced two written reports as part of its mandate, one of which was a summary of the firm’s observations, findings, and opinions arising out of its investigation.

In response to the certification motion, an affidavit was submitted by the defendant in which the affiant made reference to certain sections of the expert report in order to demonstrate that not nearly all of the individuals who had been notified of the cyber-attack were actually affected by the incident—a relevant consideration as to “the size and scope of the prospective class on the certification motion”. It was expressly stated in the affidavit that the affiant was not waiving any applicable privilege.

In preparation for the cross-examination of the affiant, the plaintiffs brought a motion under s.12 of the Class Proceedings Act, 1992 requesting that the defendants be ordered to produce copies of any report(s) or other supporting documentation prepared by the cybersecurity firm, any documentation prepared by Casino Rama (including those that may have been provided to the cybersecurity firm during its investigation), and any security audits conducted on Casino Rama’s operations in 2016 and/or 2017.

Decision

The Court did not opine on whether the reports in question were covered by privilege or not, explaining that the result of the motion would not be affected by such a determination. According to Justice Glustein, if the reports were privileged, the defendant had waived such privilege by producing an affidavit which referenced specific portions of the reports. If the reports were not privileged, then the doctrine of relevance would apply in order to allow the disclosure of the portions of the reports addressing the size and scope of the prospective class.

With respect to the doctrine of waiver, the Court explained, “[a] party cannot disclose and rely on certain information obtained from a privileged source and then seek to prevent disclosure of the privileged information relevant to that issue. Waiver of privilege would be required as a matter of fairness, but limited only to the issue disclosed.” In other words, reliance on one aspect of a report does not waive privilege with respect to other unrelated aspects. Accordingly, based on the doctrine of waiver, the Court would allow the production of those parts of the report that related to the information that was disclosed in the affidavit.

The Court also noted that proportionality is a concern when ordering production at the pre-certification stage. Specifically, production must be “proportionate” to the needs of the certification motion and what is necessary to the certification hearing. On that basis, the production of the relevant excerpts of the report was found to be proportionate, in that it would enable the plaintiffs to assess whether the information contained in those excerpts would allow them to test the strength of the defendant’s claims as to the size and scope of the prospective class.

As a result, the Court concluded that Casino Rama had to produce the excerpts of the report that related to the size and scope of the class since it had relied those sections in its affidavit.

Key Takeaways

In the event of a significant data or privacy breach, it is common practice to retain external counsel to run the investigation, including retaining third party vendors. One of the key reasons is the ability for counsel to assert privilege on key documents and communications that are produced in the course of the investigation. However, such privilege is not absolute and may be implicitly waived by the client.

Kaplan underscores (i) that privilege can be lifted on certain parts of an otherwise privileged document, and (ii) that careful consideration should be given to how information contained in privileged documents is used in the context of litigation.

The authors would like to thank summer student Syed Rizvi for his assistance with preparing this article.