[co-author: Alison Strongwater]
The multitude of new digital communications and social media platforms available in today’s technologically advanced world is a double-edged sword. As helpful as they are in speeding communications, opening new avenues of business, and encouraging creativity, these platforms are a breeding ground for inadvertent disclosure of otherwise confidential information and legal advice. Whether by an external hack, an unexpected “forward,” or a misguided “share,” chances are high that at some point, most businesses will face a situation in which confidential information escapes the net and falls into unexpected hands. As these disclosures can easily lead to or play a role in litigation, it is important to understand what legal protections exist to stop the use of such disclosed information as evidence in court.
Prevention is the best cure, as taking steps now to ensure appropriate communications with counsel can prevent certain disclosed information from being used as evidence in future litigation. Attorney-client privilege will shield some communications from being exposed in a legal action, while the work-product doctrine will protect some documents and communications made during the process of a lawsuit itself. These protections are strong, but brittle, and should be carefully considered when communicating with in-house or outside counsel.
It is important for businesses to understand the scope of these protections and their limitations. Misunderstanding their boundaries can lead to incorrect expectations about the potential for communications to be exposed in litigation, inefficient communication practices within the business, higher costs both in day-to-day practice and in potential future litigation, and the potential waste of time and resources.
What are the attorney-client privilege and the work-product doctrine?
Attorney-client privilege refers to the right of a client to keep certain oral and written communications between themselves and their lawyer confidential and protected during litigation. This privilege protects communications from the process of discovery—that is, from being gathered by an opponent to be used as evidence in court. The purpose of this privilege is to permit clients to speak freely and openly with their attorneys, without the fear that anything they share with their attorney will be used against them in litigation. While the other issues discussed herein are good to know, attorney-client privilege is the most broadly encountered, and the one in which the client has the most influence (and risk of accidental waiver).
Not every communication with a lawyer is guaranteed to be confidential. Per Section 502 of the Massachusetts Guide to Evidence, a communication must meet the following criteria to be protected:
- The client must be seeking or receiving legal advice from an attorney.
- The purpose of the communication is related to that legal advice.
- The communication was made in confidence.
- The client has not waived any privileges to the communication.
According to these requirements, an email to an attorney asking for thoughts on a legal matter—such as whether a potential logo is available to trademark—would likely be protected, while asking for advice regarding a non-legal decision—such as whether the potential logo would attract customers—would likely not.
Underlying facts included in communications are also not protected by attorney-client privilege if they are available from another source. As an example of what this can look like in practice, in Attorney General v. Facebook, Inc., the Massachusetts Supreme Judicial Court (SJC) required Facebook to share factual information identifying applications that the tech company had collected data on as part of an internal investigation. But the SJC only required that Facebook share that information in a spreadsheet—the actual internal communications about the apps in question were protected by attorney-client privilege.
Critically, the attorney-client privilege is held by the client, meaning, if there is a strong strategic reason to waive the privilege, it must be the client (not the attorney) who chooses such waiver. That said, the privilege is frequently waived by clients unintentionally. Sending privileged communications to, or even simply discussing privileged information with a non-privileged third party destroys the underlying privilege. The most common example is forwarding an otherwise privileged e-mail from your lawyer to an otherwise uninvolved third party. Even though that person may be friendly to your goals, the privilege has been destroyed by the act of forwarding, such that in a future litigation, your opponent may be entitled to discover the underlying e-mail from your lawyer and use it against you. The safest rule of thumb is to avoid ever discussing legal advice with third parties unless well-thought out in advance.
The work-product doctrine is not an evidentiary privilege, but rather a discovery rule that affords qualified protection from discovery with respect to documents or other tangible materials prepared in “anticipation of litigation.” This includes written documents, research, data, images, surveys, or similar products. Importantly, this doctrine can protect documents prepared by the litigating parties, or third parties engaged in the litigation, such as consultants, insurers, or sureties, so long as the documents were prepared with the expectation that they may be used in potential litigation. As with attorney-client privilege, the power of waiver sits with the holder of the privilege, in this case, whoever created the work product in question. Parties should also be aware of the same potential for accidental waiver.
It is important to note, however, that this doctrine will not always guarantee confidentiality for all work products. If the party seeking discovery can show that they have a “substantial need of the materials” to prepare a case and that they would “sustain severe hardship” if forced to obtain the materials by other means, they may receive access to otherwise protected documents.
Returning to Attorney General v. Facebook, Inc., the Court noted that the app information requested from Facebook was “clearly covered by the work product doctrine.” But because “the Attorney General [had] demonstrated a substantial need for the information and could not obtain it without undue hardship,” the Court ruled that any documents identified by the trial court as “fact” work product (as opposed to those representing the lawyers’ or clients’ opinion) would need to be disclosed.
It is critical to remember that different standards apply to each type of protection, and that once the proverbial cat is out of the bag, it’s very difficult to put things back as they were.
Where did Google go wrong? - An Example of Bad Practice
Google’s recent legal difficulties provide an illustrative example of the kind of communication practices that can waste valuable time and resources if a company gets caught up in litigation. As part of its antitrust suit against the company, the Department of Justice (DOJ) accused Google of attempting to hide communications under attorney-client privilege by disguising “ordinary-course business communications” as requests for legal advice. Google, DOJ alleged, instructed employees to label communications as privileged, cc in-house counsel, and add a “generic request” for advice regardless of whether “any legal advice [was] actually needed or sought.” Consequently, DOJ requested that the court sanction Google and require the company to produce any email where an in-house attorney was included but did not respond.
Although Google ultimately avoided sanction by a judge, they still bore a tremendous cost by having to litigate the issue, rereview over 20,000 emails, and present a sample of these emails to the judge. These costs may have been avoided had Google adopted more effective communication practices, particularly practices that adequately distinguished privileged from non-privileged communications. Moreover, it is important to note that simply adding counsel to a communication is not a clever panacea to guarantee privilege.
What should you do instead?
If you are seeking legal advice, you can help protect attorney-client privilege for a communication by:
- Having a clear purpose for the communication.
- Addressing the communication to the attorney directly.
- Asking the attorney for advice or an opinion.
- Labeling the communication as privileged and confidential.
- Limiting the number of people included on the communication.
Merely marking a communication as privileged and confidential is insufficient to guarantee privilege. To best ensure that you retain privilege over a communication with an attorney, it is important to consider all the steps listed above.
You also must maintain the confidentiality of a communication. If you share the communication with a third party – for example, by forwarding an email to someone outside of your business – you can lose the protection of attorney-client privilege. For this reason, it is also important to be careful making public statements related to communications or work products, as it may jeopardize future protection.
In short, when you communicate with an attorney about a legal issue, and you expect the communication to be protected, you must be careful of who has access to the communication and whether the communication is “intended to be shared.” When in doubt, consult with your attorney about whether your proposed course of action will protect the privilege.
Keeping these considerations in mind can help develop practices that maintain privilege without wasting time and resources by including in-house and outside counsel on communications that will not receive protection. It can also help ensure that communications remain legally privileged even when unauthorized access or inadvertent exposure occurs by demonstrating that the business has taken adequate steps to maintain the confidentiality of the communication.
 Carly Page, A Hacked Kaiser Permanente Employee’s Emails Led to Breach of 70,000 Patient Records, TechCrunch (June 14, 2022) (describing a data breach at the health plan provider that exposed the health information of almost 70,000 patients); Comstar, LLC Provides Notices of Data Breach, PR Newswire (June 14, 2022) (reporting the unauthorized access of servers that contained the personal information of individuals); David McAfee, Confidential Record Leak Leaves CalBar, Lawyers, Clients Exposed, Bloomberg Law (June 16, 2022) (detailing data breaches at the state bar websites of Georgia and California).
 Massachusetts also protects communications to or from a client’s representative or an attorney’s representative.
 Attorney General v. Facebook, Inc., 487 Mass. 109 (2021).
 Mass. Guide to Evid. Section 523(a).
 An exception to this type of waiver is if there is an unintentional disclosure of a privileged communication and reasonable precautions were taken to prevent the disclosure. Mass. Guide to Evid. Section 523(c)(2). An example would be having lawyers review documents before producing them to the opposing party during litigation and withholding all privileged documents with the exception of one that slipped through based on human error. That document would be recoverable with the privilege intact.
 Not to be confused with the litigation privilege, which protects attorneys, witnesses, and parties from civil liability for written or oral communications and actions related to and made as part of an actual or proposed judicial proceeding. See Bassichis v. Flores, No. SJC-13175, 2022 WL 2379417, at *5-*10 (Mass. July 1, 2022).
 See Adoption of Sherry, 435 Mass. 331, 336 (2001).
 Mass. R. Civ. P. 26(b)(3).
 Facebook, 487 Mass. at 129.
 Plaintiffs’ Mot. to Sanction Google and Compel Disclosure of Documents Unjustifiably Claimed, United States v. Google LLC, No. 1:20-cv-03010-APM (D.D.C.), ECF 326.
 Bryan Koenig, No Sanctions for Google’s ‘Privilege’ Labeling, Law360 (May 13, 2022).
 Advisory on July 2007 SJC Ruling Regarding Confidential Communications Between Public Entities and their Attorneys, Mass. Att’y Gen. (last updated Aug. 27, 2017).