While courts and the Federal Rules of Evidence take an increasingly pragmatic approach to the question of when inadvertent disclosure of privileged information results in waiver, a recent federal magistrate’s ruling serves as a potent warning that use of a file-sharing site – without sufficient safeguards – may constitute a waiver. Harleysville Insurance Co. v. Holding Funeral Home, Inc., No. 1:15-cv-00057 (W.D. Va. Feb. 9, 2017) is the first published decision to find that the use of a file-sharing site to exchange potentially privileged information constituted a waiver of the attorney-client privilege and work product protection—because the company failed to password protect its transmission.

In a coverage dispute over a funeral home’s fire loss insurance claim, an employee of Nationwide Insurance Company placed the entire Harleysville claim and investigation file for Nationwide and Harleysville (which is owned by Nationwide) on Box, an internet file-sharing site owned by Box, Inc. The employee emailed Harleysville’s counsel a hyperlink to the Box site without password protection. The insurer conceded that anyone with the hyperlink could have accessed the Box file-sharing site.

In response to a subpoena in the insurance dispute, Nationwide produced documents to defense counsel that included the email containing the URL for the Box site.  Without notifying Harleysville, defense counsel used the URL to access the site and download the claims file and “reviewed potentially privileged information,” which it then produced back to Harleysville in response to discovery demands.

Harleysville moved to disqualify defense counsel, arguing that defense counsel’s access to the claims file – on the Box platform – was “improper, unauthorized access to privileged information requiring the disqualification of all defense counsel of record.”  In turn, defense counsel argued that the insurer waived any claim to privilege by placing the information on Box without appropriate safeguards.

The court found that the disclosure was “inadvertent” under state law because the insurer “unknowingly provided access to information by failing to implement sufficient precautions to maintain its confidentiality.”  Further, the court held that the insurer waived any claim of privilege because the site was not password protected and the information “was available for viewing by anyone, anywhere who was connected to the internet and happened upon the site by use of the hyperlink or otherwise.”

“In essence,” the court held, the insurer had conceded that its actions were “the cyber world equivalent of leaving its claims file on a bench in the public square and telling its counsel where they could find it.  It is hard to imag[in]e [sic] an act that would be more contrary to protecting the confidentiality of information than to post that information to the world wide web.”

The court found that disqualifying defense counsel would serve no practical purpose, as any replacement counsel would be entitled to receive the same claims file in discovery.   The court also chastised defense counsel for downloading the claims file because a confidentiality notice was displayed on the email message that was produced with the hyperlink.  “[B]y using the hyperlink contained in the email containing a Confidentiality Notice … defense counsel should have realized that the Box Site might contain privileged or protected information.”

The Harleysville case reinforces the importance of taking sufficient precautions when using new technologies: attorneys and their clients “should be responsible for ensuring that [their] employees and agents understand how the technology works, and more importantly, whether the technology allows unwanted access by others to [any] confidential information.”

It is worth noting that defense counsel did not come out of this unscathed.  Although they were not disqualified, the court sanctioned defense counsel and required them to pay attorneys’ fees of both parties in connection with the motion to disqualify—a modicum of relief for Harleysville after its park-bench file-sharing fiasco.