Best practices for protecting privilege

Lawyers have an ethical duty to keep communications with their clients confidential. But sometimes that duty can be subverted, whether it’s because a border agent seized your phone or because someone forwarded an email to someone who shouldn’t have seen it.

A panel discussion at the recent CCCA conference in Toronto addressed the particular issues faced by in-house counsel in terms of privilege – in-house counsel are often business advisors as well as legal advisors, and it can be difficult to separate the threads between the two in a way that everyone understands and properly appreciates.

“Privilege is a cloak that counsel get to wrap around information that they collect and legal advice that they give, to keep that information and advice from the prying eyes of courts and opposing counsel,” said moderator Steven Rosenhek, a partner with panel sponsor Fasken. Other participants were Mark Pontin, a partner with Fasken, Judy Naiberg, Vice-President Legal at Rogers Communications, and Anthony Ruffalo, Senior Manager and General Counsel with Honda Canada.

The trick, said Rosenhek, is to implement policies within the company to make privilege more secure and that cloak fit more exactly. While the discussion dealt with in-house counsel, in particular, the panel offered up some best practices that could be applicable across the bar.

In general

• Think about it all the time: “The business people you are dealing with may not always be thinking about privilege, but we need to think about it all the time,” said Naiberg. “It’s easy to forget how important it is until it’s too late.
• Training is key: When you’re having discussions with clients where some of the discussion is legal advice and some is not, lay out ground rules for how you’re going to deal with that, for example, in minutes of the meeting.
• Establish privilege early: When there are several parties, get a common-interest agreement in place as soon as possible.

In emails

• BCCs multiply like weeds: Don’t ever BCC privileged information, said Pontin, who noted that one of the ways the courts decide whether there’s been a waiver of privilege is the care that’s been taken to keep the information confidential. Only circulate an email containing privileged information to the people who need to know it.
• It’s worth it to try to withdraw an email that was sent in error: “Anything that evidences your intention is helpful down the line,” said Rosenhek. An audience member cautioned, however, that if you’re dealing with U.S. courts, a U.S. attorney is obligated to use the information, even if received in error, in court.
• Mark up your emails: Put “PRIVILEGED AND CONFIDENTIAL” and “DO NOT FORWARD” in the subject line (yes, use all caps, you do want to shout it), and make sure the first line of the email repeats the message.
• Don’t over-claim privilege: Pontin said he thinks of everything from a litigation perspective, “How am I going to prove this to a judge?” If it’s stamped confidential, that should prove your intention to a judge. But don’t be too free with that stamp, because you’ll lose the judge’s trust. “I don’t try to cloak things that are clearly not privileged in privilege, because that can backfire.”

Quick points:

In meetings

• Know going in whether everyone invited can be privy to confidential information. If not, ask people to leave the room or take the discussion offline after the meeting.
• In the minutes, frame the discussion as a legal discussion, i.e., “this was a meeting so that I could provide legal advice on particular issues.”
• Send an email after the fact to summarize, “this is what was discussed, this was the advice provided.”
  • Ask people not to take notes, offer to circulate a summary after the meeting.
  • If there is a combined legal and business discussion, for example, separate it out in your notes, and ask people taking notes to do the same.

At the border

• Create a policy in the organization for travelling with privileged information.
• Talk to your technical people about setting up a secure process for accessing information remotely so that it is not stored on your device
• Maintain separate devices for work and personal use
• For more information on crossing borders with privileged information, see the new CBA Border Alert toolkit