Court shields file path information from the public (and threat actors), addresses scope of s-c privilege

On November 7th, the Newfoundland and Labrador Supreme Court issued an access to information decision with some notable points.

First, the Court held that a public body validly redacted file path information from a document set based on the security of a computer system exemption to the public right of access. The public body adduced good evidence that the paths could be used by threat actors to (a) randomly generate usernames amendable to brute forcing or similar attacks (b) identify domain administrators, and (c) map the network, all creating a real and non-speculative risk of attack. The finding is based on the evidence, but there is nothing unique about the the risk that the Court recognized.

Second, the Court affirmed a decision to apply the privilege exemption based on a solicitor-client privilege claim and despite a dispute between the public body and the Newfoundland Information and Privacy Commissioner about the scope of the so called “continuum of communication.” The Court held the following communications were within the protected continuum:

  • E-mail messages between non-lawyers that were subsequent to the direct giving and receiving of legal advice about “process and timing” (and up the e-mail thread).
  • Drafts of documents known to be subject to editing by legal counsel and from which “an informed reader could readily infer what legal counsel had advised.”
  • Notes, questions and references in documents made by an individual who gave evidence that she received legal advice in relation to all the notes, questions and references.

This finding is as sound as it is protective in my view.

Newfoundland and Labrador (Treasury Board) v. Newfoundland and Labrador (Information and Privacy Commissioner), 2024 NLSC 147 (CanLII)

Federal Court dismisses awkward solicitor-client privilege claim

Earlier this year, the Federal Court dismissed a claim that a column in a spreadsheet was subject to solicitor-client privilege because disclosure would reveal legal advice obtained prior to its development.

Solicitor-client privilege (literally) protects advisory communications between a solicitor and its client, and it can protect such communications if they find their way into other documents. For example, if two employees of a lawyer’s client discuss the (corporate) lawyer’s advice confidentially via e-mail, their description of the advice may be redacted in response to a production requirement because its disclosure would reveal the solicitor-client communication.

In this case, a corporate taxpayer argued that a column in a spreadsheet was protected by solicitor-client privilege based on the same rationale. It relied on an affidavit that explained that it received legal advice prior to the development of the column and that disclosure of the column would reveal it “by what is being computed, how the computation is done,” and “by associated text in the reacted column.” The Court exercised its discretion to review the prior legal advice and held that the column was simply the “operational outcome or end product of legal advice” and not protected.

This is a fact specific, though illustrative outcome. Even the fact of obtaining legal advice on a particular matter is sensitive and ought normally be kept secret because, once disclosed, inferences can be drawn about advice taken based on the “operational outcome” or “end product” of the advice. Of course, a lawyer’s legal advice can be either be accepted or rejected or followed precisely or loosely, but clients are often drawn to back the legitimacy of their actions by reference to their careful adherence to legal advice. That’s plainly a risk.

In this case, it is unclear whether something precipitated the (more basic) disclosure of an advisory relationship, but one can see how arguing the resulting inference can be very awkward and risky. The only way to do it is to “double down” and disclose more about the advisory relationship and the resulting inference. If not it inviting of waiver in the underlying advice (which the Court did not find here), it seems to be one step down a slippery slope to that outcome.

Canada (National Revenue) v. BMO Nesbitt Burns Inc., 2022 FC 157.

ABCA decision on defending allegations about privileged communication

On April 12th, the Court of Appeal of Alberta held that a defendant waived solicitor-client privilege by affirmatively pleading that its counsel had no instructions to agree to a time extension for filing a prospectus.

The defendant faced a lawsuit that alleged its counsel gave a time extension and had the actual authority to do so. The majority judges explained that a party faced with such an allegation about a privileged communication can make a bald denial and safely rest on its privilege. The defendant went further, thereby putting its privileged communications in issue.

PetroFrontier Corp v Macquarie Capital Markets Canada Ltd, 2022 ABCA 136 (CanLII).

Court says privilege in letters left online waived

On May 5th the Court of Appeal for Newfoundland and Labrador affirmed a finding that a party had waived its solicitor-client privilege in two letters that had been published online.

The letters contained legal opinions to a defendant to an outstanding civil action. They were authored about five and nine years before the action was commenced, but apparently are “highly relevant” to the action. The plaintiffs downloaded the letters from the internet and produced them back to the defendant, which provoked the defendant’s privilege claim.

The defendant had learned the documents were circulating about six months prior to receiving the plaintiffs’ production when contacted by a CBC reporter and one of the plaintiffs (who also posted the letters on her Facebook). It decided not to attempt to take down the letters from the internet because of the expense and, in the Court’s words, because “the genie was out of the bottle and control over the documents would be virtually impossible to maintain.” Strangely, the defendant did not advise its defence counsel of the problem, so defence counsel only asserted privilege after receiving production (again, about six months later).

In these circumstances, the Court of Appeal held that privilege had been waived. Its key findings were as follows:

    • The defendant itself was aware of the publication of the letters well before the plaintiffs produced the letters in the litigation, but did not assert privilege against the plaintiffs. That defence counsel did not know that the letters were circulating until the plaintiffs produced them was irrelevant. Privilege belongs to the client, not its counsel.
    • Plaintiff counsel’s act of downloading of the letters from the internet for use in the litigation ought not be presumed to be improper. Although the Court confirmed that opposing counsel are obliged not to take advantage of an inadvertent disclosure of privileged communications, in this case the letters were somewhat old and it appears that the existence of an inadvertent disclosure was simply not reasonably apparent.
    • It was not wrong for the application judge to consider the lack of evidence about safeguarding efforts in deciding the waiver issue against the defendant: “A privilege-holder ought to be able to provide some evidence of how the privileged documents were safe-guarded to protect the privilege for it is within its power to do so.”

This is a careful judgement that’s directed at the facts. In my reading of it, the Court leaves some (though perhaps limited) room to assert privilege against an opposing party in litigation even though documents make their way inadvertently to the internet and are left there because “the genie is out of the bottle.”

Federation of Newfoundland Indians Inc. v Benoit, 2020 NLCA 16 (CanLII).

Legal Privilege and Data Security Incident Response – Law and Practice

I’m off to a cyber conference in Montreal this week to sit on a panel about threat exchanges. My role will be to address the legal risks associated with sharing threat information and a university’s ability to effectively assert a confidentiality interest in the same information. I’m genuinely interested in the topic and have prepared not just one, but two papers!

Here is the first one – a nuts and bots presentation on privilege and data security incident response. I hope it is useful to you. Feedback welcome through PMs.

Man CA gives broad protection to lawyers’ reporting letters

On June 29th, the Court of Appeal of Manitoba held that the law has evolved such that reporting letters in real estate transactions (though often primarily summarizing facts) should be presumptively subject to solicitor-client privilege. It said, “Such correspondence is the direct result of a lawyer providing legal advice or otherwise acting as a lawyer, is descriptive of the services provided by the lawyer and arises as a result of the solicitor-client relationship.” This represents a change in Manitoba law, though is consistent with case law in other jurisdictions, including Ontario. 

R v Douglas, 2017 MBCA 63 (CanLII).

BCCA issues decision on implied waiver of privilege

On November 29th, the Court of Appeal for British Columbia held that a party must voluntarily inject into the litigation legal advice it received or its understanding of the law before waiver of solicitor-client privilege can be implied. It is not enough, according to the Court, for the privilege holder’s state of mind to be relevant. The Court therefore held that a party had not waived privilege over legal advice obtained that related to a misrepresentation by another that it pleaded it had reasonably relied upon.

Soprema Inc. v. Wolrige Mahon LLP, 2016 BCCA 471 (CanLII).

Lawyer’s communications with witnesses to harassment privileged, privileged waived

In late June of last year, Arbitrator Moore held that communications between a lawyer retained to investigate a harassment complaint and various bargaining unit members were subject to solicitor-client privilege, but that the employer waived privilege by relying on the investigator’s conclusions in its discipline letter.

The employer used a very strong retainer letter that clearly established the investigator’s mandate was to gather facts and evidence for the purpose of providing legal advice. The letter (admitted into evidence by the Union without challenge) was sufficient to establish that the sought-after communications were privileged. Significantly, Arbitrator Moore held that communications with unionized employees undertaken for the purpose of providing legal advice can still be privileged communications:

Thus, I have not been referred to any authority that supports the proposition that employees, by virtue of being unionized, are to be regarded as third parties.  While the legal rights of unionized employees are certainly impacted by the exclusive representational rights accorded to unions by statute, and may be further altered by collective agreement provisions, the employees are, in my view, still fundamentally employees of the employer.Accordingly, I do not find the fact that the employees are unionized to be a relevant consideration.  It does not alter my conclusion that they are not third parties.  The communications between the lawyer and the employees, therefore, took place within the relationship between the solicitor and the client and fall within the scope of the privilege.

Arbitrator Moore also rejected a very bold argument from the union that arbitrators should apply a distinct concept of solicitor-client privilege that provides “practical labour relations results for the participants.” Arbitrator Moore reasoned that the license given to labour arbitrators was not so broad “as to abrogate a principle as fundamental and protected as solicitor-client privilege.”

Although the employer established solicitor-client privilege and did not seek to rely on the investigator’s report at arbitration, Arbitrator Moore held that it waived privilege by relying on the investigator’s conclusion in its disciplinary letter. The letter read as follows:

The investigator concluded that your  conduct towards the complainant violated  Metro Vancouver’s Workplace Harassment Prevention Policy and directly contributed to a detrimental  work  environment  for  the  complainant  while he  was  employed  by  Metro Vancouver. Specifically, the investigator found that you were responsible for creating a harassing and discriminatory posting about the complainant and placing it in the Coquitlam guard house. In addition, the investigator found that you made discriminatory and harassing statements about the complainant in the work place. The investigator also concluded that you were not fully forthcoming with him during the investigation process. We accept the investigators [sic] findings and conclusions regarding your conduct. We conclude that your behaviour has been both discriminatory towards the complainant and has also violated Metro Vancouver’s expectations of appropriate employee behaviour.

As effective as the employer’s retainer letter was at establishing privilege, the employer’s discipline letter was a clear invitation to a waiver finding. This employer’s efforts nonetheless leaves other employers with a good road map for investigating sensitive internal matters under the protection of solicitor-client privilege. The retainer letter used by the employer is included in the award. It is a good model.

Vancouver (Regional District) v Greater Vancouver Regional District Employees’ Union, 2015 CanLII 87692 (BC LA).

Alberta OIPC lacks power to compel production to resolve solicitor-client privilege appeals

On April 2nd, the Court of Appeal of Alberta held that the Alberta Freedom of Information and protection of Privacy Act does not give the Alberta OIPC the power to compel the production of records over which a public body has asserted solicitor-client privilege.

The Court considered the power granted by the following provision:

Despite any other enactment or any privilege of the law of evidence, a public body must produce to the Commissioner within 10 days any record or a copy of any record required under subsection … (2).

It held that this language was not clear, unequivocal and ambiguous enough to overcome the presumption against abrogation of solicitor-client privilege. The ratio, at paragraph 48, is very clear and simple: “This [authorization of infringement] requires specific reference to solicitor-client privilege.”

Also of significance, the Court held that the chambers judge (below) erred by construing provision according to “modern approach,” which it said cannot be reconciled with the rule of strict construction established by the Supreme Court of Canada in Blood Tribe. The Court allowed the appeal and ordered the OIPC to pay the institution’s costs.

University of Calgary v JR, 2015 ABCA 118.

The scope of solicitor-client privilege, advice versus information and Trillium Motor World

Here’s a handout for an internal (Hicks Morley) talk I’m doing tomorrow on solicitor-privilege, “the continuum of communications” concept and the Ontario Superior Court of Justice’s recent decision in Trillium Motor World.

In Trillium Motor World the Court held that legal information (versus advice) conveyed from a firm to its client was not privileged. In short, my conclusion is that the decision is an outlier driven by a unique context and that in more ordinary circumstances a court will not (and should not) parse the subject matter of communications related to an ongoing retainer so delicately.

Yesterday’s post on Justice Stratas’s recent Canada (Public Safety and Emergency Preparedness) decision is another good one to read on this topic.