Case Report – Sask QB rejects spoliation claim

On November 23rd, the Saskatchewan Court of Queen’s Bench held there is no independent tort of spoliation in dismissing a claim against a doctor for destroying patient charts and other hospital records.

The Court dismissed the claim because there was no duty to preserve the records at the time they were destroyed, which was before litigation was filed, apparently pursuant to a routine records management process and in accordance with a compliant records retention period. The Court did not comment on whether litigation was reasonably foreseeable at the time the records were destroyed.

In the alternative, the Court cited the British Columbia Court of Appeal’s decision in Endean v. Canadian Red Cross Society for the proposition that spoliation is only a rule of evidence, not an independent tort. It did not deal with the Ontario Court of Appeal’s decision in Spasic (Estate) v. Imperial Tobacco Ltd., where the Court held it was not plain and obvious that a pleading based on the tort of spoliation discloses no reasonable cause of action and therefore that claims based on the tort should be allowed to proceed to trial.

Galenzoski v. Awad, 2007 SKQB 436 (CanLII).

Information Roundup – December 27, 2007

Here’s a new feature that I’ll resolve to keep with for the next while. Every one or two weeks I’ll post a handful of articles or blog posts that have caught my interest and are related to the subject matter of this blog. Here are some from my holiday readings (in no particular order):

Alan Taneja, Buying typical storage for video surveillance? Rethink that! A nice synopsis of new records management issues associated with video surveillance.

David Hecheler, Lockheed Employee’s YouTube Video Sounds Ethics Alarm. A thorough account of the story of whistleblower Michael DeKort.

Ron Ashkenas, Simplicity-Minded Management from the December 2007 Harvard Business Review. About simplifying business structures, products and business processes. The processes part has a bit about information management, which reminded me of a comment that came up in a recent conversation with a friend of mine who’s a GC. It went something like, “The mass of available information and the pace of business is leading to a crises of quality decision making.” I like this topic.

Kelly D. Talcott, Cutting out Privacy in the Office. Locking down work e-mail systems, the subject of this article, is a hugely important issue. I’d like to thank my managing partner, Stephen Shamie, for passing this one on.

Joe Bartling, Post-Termination Employment Forensics. Very prescriptive blog post on an important topic.

Ralph Losey, Best Buy Wins Key e-Discovery Ruling in Fraud Case. Here’s Mr. Losey’s summary of the much-discussed Best Buy Stores L.P. v. Developers Diversified Realty Corp. e-discovery award, a case on the duty to preserve a litigation database that is likely to be useful in subsequent litigation.

Enjoy!

Regulation permitting issuance of electronic pay statements proposed

On December 15th, the federal Minister of Labour proposed a regulation that will permit federally-regulated employers to issue electronic pay statements. Currently, employers without seeking a ministerial exemption.

The government is relying on the provision in Part 2 of the Personal Information Protection and Electronic Documents Act that deems a legal requirement that a document be in writing to be satisfied by an electronic document where (among other things) a regulation establishing the conditions for use of an electronic document is put in place.

The proposed regulation establishes the following conditions for use:

the employer must inform each employee where electronic pay statements are stored
the pay statement must be readable and printable only by the employee
the pay statement must remain accessible by the employee through electronic means for a period of at least three years from the first date it is made available
the pay statement must be readable and printable on a computer and printer to which the employer shall provide the employee with private access

The Regulatory Impact Analysis Statement and the proposed regulation can be found here.

The property torts and disputes about business information

What happens when someone puts his or her electronic documents on another’s computer system, gets locked out and then wants the documents back?

This is a common problem today, and often arises in the context of departing employee disputes. It also engages one of the more interesting developing legal issues within this blog’s domain: do the traditional property torts – trespass, detinue and conversion – protect rights associated with intangible property?

While this could be the subject of a good paper, I’d simply like to point out a couple of developments South and North of the border.

In the United States, the New York Court of Appeals recently issued an opinion in Thyroff v. Nationwide Mutual Assurance Company in which it held that the tort of conversion should apply to intangible property – an insurance agent’s customer list in the circumstances in dispute.

There’s no judgement of equivalent strength in Canada yet, but the Prince Edward Island Supreme Court – Trial Division issued a decision in July called HZPC Americas Corp. that is consistent with the direction endorsed in Thyroff. (HZPC has not yet been published on CanLII.) In rejecting the defendant’s motion to strike a conversion claim, the Court challenged the traditional idea that an owner’s ability to control intangible property (including confidential business information) is not sufficient to justify application of the tort. It said:

The Defendants refer to infringement of intellectual property while the Plaintiff refers to conversion of commercial property interests. The Plaintiff’s claim is not based on infringement of a statutory right in intellectual property; but rather is classified by it as a proprietary right in commercial property. It is not necessary for the Plaintiff to plead or rely upon legislative provisions to pursue its claim based on a common law tort. The federal legislation can be viewed as providing additional benefits, and not exhausting a person’s civil remedies.

The Court quoted Professor David Vaver, who says that the traditional view is “pettifoggery” – a sure signal that there will be more on this issue to come.

Case Report – Employer owns mixed contact list stored on its system

In this United Kingdom departing employee case from this June, the High Court held that an employer had exclusive ownership of a contact list alleged by an employee to be his personal contact list because it was maintained on its computer system.

The defendant was a journalist who worked in trade publication and conference buisnesses for a number of years before joining the claimant, who operated a similar business. He gave evidence that he maintaned a personal contact list, updated it from time to time, and had over eight years of editorial and industry contacts amassed when he commenced employment with the claimant. Nine years later, and after transferring the list to an MS Outlook database maintained by the claimant and adding work-related contacts, the defendant left with two other employees to start a competing business. In addition to suing to recover damages for the defendant’s pre-departure breach of loyalty and fidelity, the claimant disputed his ownership of the list.

Although it held that the company had not effectively incorporated its computer use policy into the defendant’s contract of employment, the court nonetheless found it had exclusive ownership of the list. It made the following broad statement:

I am satisfied that where an address list is contained on Outlook or some similar program which is part of the employer’s e-mail system and backed up by the employer or by arrangement made with the employer, the database or list of information (depending whether one is applying the Database Regulations or the general law) will belong to the employer…

In all those circumstances, I find that such lists will be the property of the employer and may not be copied or removed in their entirety by employees for use outside their employment or after their employment comes to an end.

Because this is not likely to be appreciated by many employees, it is in my judgment highly desirable that employers should devise and publish an e-mail policy…

In the absence of such a laid down policy, I next have to consider the status of contact details which have been put on to an employer’s system by an employee for their own use outside their employment, in ignorance of the fact that they would thereby become part of the Claimant’s property…

In my judgment it is reasonable to imply in the absence of any laid down guidance a term that an employee will at the end of their employment be entitled to take copies of their own personal information and, where the information is person [sic.] and confidential to them, such as details of their doctor, banker or legal adviser, to remove them from the employer’s system.

Most forms of e-mail system will permit the creation of compartmentalised address books, so that ordinarily an employee will be able to put their own personal contact details of friends, relations, and the like into a personal address book. In those circumstances, in the absence of clear evidence of an e-mail policy, I would be inclined to the view that ownership of that part of the database resided with the employee…

In assessing the facts, the Court held that the defendant copied the entire mixed list for the purpose of competing with the defendant and that it would not be appropriate for it to parse the list. It ordered the sequestered database to be delivered up to the claimant and enjoined the defendant from using it except for contact information “known by other means.”

Pennwell Publishing (UK) Ltd v. Ornstien, [2007] EWHC 1570 (QB).

Data breach response – a multidisciplinary perspective

In some chance timing given the release of the report on the Canadian investigation into the TJX breach, I presented today at a lunch meeting of the Association of Certified Forensic Investigators of Canada together with David Malamed of Grant Thonrton. We called the presentation “Data Breach Response: A Multidisciplinary Perspective.”

This is the first presentation David and I have given on an project we started at the beginning of the summer together with Karen Gordon, an expert crises communicator from Squeaky Wheel Communications. The idea we are promoting is that organizations should be using multi-disciplinary teams to manage breach response and, whether internal or external experts are used, the team should be defined in a formal breach response plan.

I’ve posted a copy of the presentation here.

Case Report – Data breach investigation report released

The Privacy Commissioner of Canada and the Office of the Information and Privacy Commissioner of Alberta have released their joint report into the TJX/Winners data breach. They found that TJX breached the collection, retention and safeguarding rules in both the federal and Alberta commercial privacy statutes.

With respect to TJX’s system for preventing the fraudulent return of goods, the commissioners held that TJX breached both statutes by collecting drivers license and other provincial ID numbers to identify individuals who returned goods without a receipt. While they accepted the importance of identifying such individuals for purposes of fraud control, they also held that retaining this sensitive data was not necessary and that TJX also did not give adequate notice of the purposes for its collection. The commissioners said:

A driver’s license is proof that an individual is licensed to operate a motor vehicle; it is not an identifier for conducting analysis of shopping-return habits. Although licenses display a unique number that TJX can use for frequency analysis, the actual number is irrelevant to this purpose. TJX requires only a number—any number—that can be consistently linked to an individual (and one that has more longevity and is more accurate than a name and telephone number).

Moreover, a driver’s license number is an extremely valuable piece of data to fraudsters and identity thieves intent on creating false identification with valid information. After drivers’ license identity numbers have been compromised, they are difficult or impossible to change. For this reason, retailers and other organizations should ensure that they are not collecting identity information unless it is necessary for the transaction.

Having made this finding, they accepted TJX’s proposal to create unique identifiers from provincial ID numbers by using cryptographic hashing and approved of a three-year retention period for this information.

On the collection and retention of payment card information for processing purposes, the commissioners held that TJX’s retention of information for 18 months in accordance with its contractual obligations to financial institutions was reasonable, but were critical of TJX’s practice of retaining the information for longer periods for “troubleshooting” purposes. They reasoned that TJX had not clearly established “troubleshooting” as a primary purpose for collection, nor had it established the need to retain information in order to troubleshoot.

Finally, the commissioners held that TJX did not meet the safeguarding standard in both acts, primarily because it failed to upgrade its wireless encryption protocol within a reasonable period of time. Version 1.1 of the Payment Card Industry Data Security was released in September 2006 and endorsed the “Wi-fi Protected Access” or “WPA” encryption protocol. The commissioners said that TJX should have been adhering to this standard by “late 2006.” They commented:

TJX relied on a weak encryption protocol and failed to convert to a stronger encryption standard within a reasonable period of time. The breach occurred in July 2005, conversion began in October 2005, and the pilot project was completed in January 2007. We are also aware that the final conversion to a higher level of encryption will be completed soon.

Furthermore, while TJX took the steps to implement a higher level of encryption, there is no indication that it segregated its data so that cardholder data could be held on a secure server while it undertook its conversion to WPA.

TJX had a duty to monitor its systems vigorously. If adequate monitoring of security threats was in place, then TJX should have been aware of an intrusion prior to December 2006.

This comes just days after a settlement was announced in the related class action lawsuit.

Report of an Investigation into the Security, Collection and Retention of Personal Information (26 September 2007, C.P.P. and Alberta O.I.P.C.).

Sedona Conference search and retrieval draft paper

I direct your attention to this very informative August 2007 draft/public comment paper by the Sedona Conference Working Group 1. In discussing best practices in the use of search and information retrieval methods in discovery, the paper advocates the use of automated search and retrieval methods as an alternative to manual search and suggests eight practice points.

Here are some key quotes made in advocating for automated search:

A consensus is forming in the legal community that human review of documents in discovery is expensive, time consuming, and error-prone. There is growing consensus that the application of linguistic and mathematic-based content analysis, embodied in new forms of search and retrieval technologies, tools, techniques and process in support of the review function can effectively reduce litigation cost, time, and error rates.
It is not possible to discuss this issue without noting that there appears to be a myth that manual review by humans of large amounts of information is as accurate and complete as possible – perhaps even perfect – and constitutes the gold standard by which all searches should be measured. Even assuming that the profession had the time and resources to continue to conduct manual review of massive sets of electronic data sets (which it does not), the relative efficacy of that approach versus utilizing newly developed automated methods of review remains very much open to debate. Moreover, past research demonstrates the gap between lawyers’ expectations and the true efficacy of certain types of searches. The Blair and Maron study (discussed below) reflects that human beings are less than 20% to 25% accurate and complete in searching and retrieving information from a heterogeneous set of documents (i.e., in many data types and formats). The importance of this point cannot be overstated, as it provides a critical frame of reference in evaluating how new and enhanced forms of automated search methods and tools may yet be of benefit in litigation.
There is no magic to the science of search and retrieval: only mathematics, linguistics, and hard work. If lawyers do not become conversant in this area, they risk surrendering the intellectual jurisdiction to other fields.

Halifax to Toronto in five podcasts all about information

We took young Hugo on his first surf trip to Halifax recently, and after enjoying a couple of weeks of beautiful weather and very bad surf, it took me about fifteen and a half hours from the time I dropped him and Seanna off at the Halifax airport to drive to our door in Toronto. (Dad travels with surfboards while mom travels with baby. And yes, I am a type “A” personality.)

Tom Petty’s newest, Highway Companion, pretty much blows my mind, but there’s only so many times I could listen to it (and sing along loudly enough to keep me alert) before seeking relief in the modern equivalent of talk radio. Here are the information-related podcasts that I listened to on the way home, listed in order of appreciation.

“Electronic Evidence,” ABA Book Briefs Podcast (14 August 2007). An interview with Sharon Nelson and John Simek, co-authors of The Electronic Evidence and Discovery Handbook. Includes a good practical discussion on managing forensic experts.
“Attorney-Client Privilege and the Work-Product Doctrine,” ABA Book Briefs Podcast (10 July 2007). An interview with Edna Epstien, Author of Attorney-Client Privilege and the Work-Product Doctrine. Good for issue identification. One good one: When an in-house lawyer sues for wrongful dismissal and alleges she was terminated for whistleblowing, in what circumstances will the records containing her advice be producible?
“Negotiating Tip: Negotiating with Email,” Negotiating Tip of the Week (5 May 2007). This podcast series is by Dr. Josh Weiss, Associate Director of the Global Negotiation Project at the Program on Negotiation at Harvard. This one is really about negotiation, but has an outside link to records management. The last of the five tips: don’t negotiate by e-mail unless you have to.
“What Hewlett-Packard’s Spying Scandal Tells Us about the Limitations of Corporate Boards,” Knowledge@Wharton Audio Articles (23 October 2006). Primarily about governance but describes the context for a much-discussed privacy issue.
“Ten Rules for Managing Electronically Stored Information,” Litigation Podcast: Tips and Tactics (29 March 2007). Tips on proactive ESI management.

On employees and home computers

Here is a good law.com article that raises the question, “Just when should an employer have access to a departed employee’s home computer or personal e-mail account?”

Consider a disability claim where an employer (as disability benefits insurer and defendant) seeks information about the time a departed employee who is claiming he has a total disability spends surfing the internet. Assume that seeking production of the employee’s home computer is a rational request because the employee has given evidence in discovery that he lives alone and is the sole user of his home computer. Is production of the home computer for forensic analysis justified or is this a just fishing expedition?

In Canada, there is a trio of British Columbia cases with facts not unlike this scenario: see Park v. Mullin, 2005 BCSC 1813, Ireland v. Low, 2006 BCSC 383 and Desgane v. Yuen, 2006 BCSC 955. In all three cases the British Columbia Supreme Court declined to order production of hardware after weighing the evidentiary value of the proposed production against the plaintiffs’ privacy rights.

It’s one thing, however, to fish for an employee’s personal information because it might be assistive. It’s another to seek production of evidence that’s not particularly personal or sensitive and that is central to the claim.

Now consider an employer who sues a departing employee for breach of confidence. An employee who takes business records needs to put them somewhere. The most obvious receptacle is his or her home computer.

Assuming the claim has merit, should the employer be entitled to know for sure whether the employee has (or has ever had) custody of its records? Is the probative value of the proposed production not very high given the difficulty in proving misuse of confidential information? In the context, is production of the actual computer warranted despite all the personal information it is likely to contain? I’m not aware off-hand of any Canadian breach of confidence cases in which production of a departed employee’s home computer has been ordered, but in the Ameriwood case cited in the law.com article a Missouri court answered these questions in the affirmative.