Privacy, Privilege And Confidentiality For Lawyers


Published on

This slide show was part of a presentation by mark Hayes at the 2011 Canadian Bar Association Annual Meeting in Halifax, Nova Scotia on August 16, 2011.

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Privacy, Privilege And Confidentiality For Lawyers

  1. 1. Privacy, Privilege, Confidentiality and Ethics<br />Canadian Bar Association Annual Meeting, Halifax, August, 2011<br />Mark Hayes, Hayes eLaw LLP, Toronto<br />
  2. 2. Privacy, Privilege and Confidentiality<br />3 distinct and overlapping concepts<br />Often confused with each other<br />Important for lawyers to understand different types of obligations<br />
  3. 3. General Concepts<br />Privilege<br />Legal right that applies in specific circumstances (e.g. solicitor/client & litigation privilege)<br />Confidentiality<br />Legal duty to hold in strict confidence and not disclose any kind of information that are subject to such duty, not just personal information<br />Privacy<br />Body of statute law governing collection, use and disclosure of personal information<br />
  4. 4. Control<br />Confidentiality<br />Controlled by client; can be waived (intentionally or otherwise)<br />Privilege<br />Controlled by client; can be waived (intentionally or otherwise)<br />Privacy<br />Controlled by individual in question; consent or exception to consent requirement<br />General reasonableness requirement<br />
  5. 5. Confidentiality<br />Source: primarily common law and professional regulations (e.g. Rules of Professional Conduct)<br />Broad in scope – Ont. RPC s. 2.03 – “all information concerning the business and affairs of the client acquired in the course of the professional relationship”<br />Waiver of duty of confidentiality & solicitor/client privilege: Harish v. Stamp, R. v. Hobbs, Osiris Inc. V. 1444707 Ontario Ltd.<br />Waiver of confidentiality does not necessarily waive privilege (if one applies)<br />
  6. 6. Privilege<br />Source: primarily common law<br />Salosky(SCC): "fundamental civil and legal right”<br />Emerges from the duty of confidentiality inherent in solicitor/client relationship<br />Sometimes permanent (e.g. solicitor/client privilege) or limited by existence of specific circumstances (e.g. litigation privilege only pending litigation)<br />Statutory limitations must be clearly and expressly provided by (Blood Tribe Dept of Health v. Canada)<br />Waiver of privilege may not affect confidentiality <br />
  7. 7. Privacy<br />Primarily statutory<br />Must obtain informed consent for collection, use or disclosure of personal information by an organization in the course of its commercial activities<br />In addition to consent requirement, collection, use or disclosure of PI must be reasonable<br />Only collect as much information as is required<br />Publicly available personal information is not exempt from consent requirement<br />
  8. 8. Privacy<br />Application: any organization engaged in commercial activity<br />Includes lawyers, unless acting as agent for individual in personal capacity (Ferenczy)<br />This conclusion not accepted by Privacy Commissioner <br />Various administrative requirements<br />Provide access to or correct PI in possession on request<br />Keep PI secure<br />Retain PI only for long as is required<br />
  9. 9. Consent Exemptions<br />For lawyers, exemptions from consent requirement are critical<br />Some important ones:<br />Required by law<br />Investigations of breach of statute or contract<br />Private purposes (if acting for individual)<br />Provincial privacy laws in BC and Alberta have additional exemptions<br />
  10. 10. Cases on Lawyers and Privacy<br />Can’t disclose PI pursuant to summons issued by an individual without jurisdiction to compel production (i.e. other lawyer) - PIPEDA Case Summary #2009-005<br />Consent not required to disclose personal information in response to writ of seizure issued by court - PIPEDA Case summary #2003-174<br />Law firms cannot collect credit reports without consent: PIPEDA Case Summary #2006-340<br />Solicitor’s lien insufficient grounds to deny access to personal information - Settled case summary #30 (2007)<br />Not reasonable to use individual’s SIN for general identification purposes – limited to payroll and income tax purposes - PIPEDA Case summary #2002-69<br />
  11. 11. Overlaps<br />Personal information subject to privilege<br />Client information subject to privilege<br />Personal information that is confidential<br />
  12. 12. Obligations Different But Consistent<br />For the most part, all of privacy, privilege and confidentiality consistent in requiring:<br />Access to information be limited<br />Appropriate security steps be taken<br />Major difference<br />Privilege and confidentiality controlled by client (who can waive rights)<br />Privacy controlled by legislation and consent of individual concerned - client cannot validly instruct lawyer to breach privacy<br />
  13. 13. Privacy and Privilege<br />Privacy statutes: individual must be given access to PI<br />Many examples of litigants requesting access from lawyers<br />What if PI is privileged?<br />PIPEDA s. 9(3) excludes access obligation if “information is protected by solicitor-client privilege”<br />But what about other privileges?<br />PIPEDA Case Summary #2008-397: also applies to litigation privilege; liberal interpretation<br />PIPEDA Case Summary #2010-001: court procedures more appropriate to deal with allegation that documents improperly withheld as privileged<br />
  14. 14. Privacy and Confidentiality<br />Confidentiality obligation subject to certain exemptions<br />E.g. Ont. RPC s. 2.03: may disclose confidential information “where a lawyer believes upon reasonable grounds that there is an imminent risk to an identifiable person or group of death or serious bodily harm, including serious psychological harm that substantially interferes with health or well-being…”<br />Privacy laws don’t contain exact same exemption<br />PIPEDA s. 7(3)(e): “made to a person who needs the information because of an emergency that threatens the life, health or security of an individual”<br />Must inform individual in writing without delay<br />
  15. 15. Builders Energy Services Ltd.<br />Alberta IPC Investigation Report P2005-IR-005<br />Lawyer acting for acquirer of company posted employee personal information on SEDAR, where it was publicly available<br />While case concentrated on whether disclosure of PI was reasonably necessary, clear that lawyer had not considered whether this PI was subject to privacy regime<br />Similar considerations often arise in litigation<br />
  16. 16. Technology and Privacy Risks<br />Service providers<br />Storage devices (servers, hard drives, sticks)<br />Laptops<br />Blackberries and smartphones<br />“Cloud computing”<br />
  17. 17. Managing Technology Risks<br />Mitigate highest and most immediate risks<br />Inventory personal data maintained by the firm<br />Employee training and management<br />Conduct risk assessment:<br />Information systems design and information processing, storage, transmission and disposal<br />Responding to and preventing attacks, intrusions and systems failures<br />Fix vulnerabilities identified through risk assessment<br />Continually evaluate and adjust information security program<br />
  18. 18. Data Retention Policies<br />Privacy laws require lawyer to retain PI for only as long as required for disclosed purposes<br />Ethical obligations require retention of client files until client releases you and all regulatory and liability issues have passed<br />Finding correct balance between hanging on too long and destroying too quickly is tricky, especially since appropriate retention periods may be different depending on nature of data<br />
  19. 19. Summary<br />Privacy issues have significant impacts in many practice areas:<br />Family<br />Civil and criminal litigation<br />Real estate<br />Estates<br />Employment law<br />Even in practices where PI of third parties is not critical, have to worry about employee privacy<br />
  20. 20. Summary<br />Think about PI issues whenever you handle PI about individuals who are not your clients<br />Know your obligations<br />Know the relevant exceptions you can use to your advantage and in your clients’ interest<br />Privacy obligations are constantly changing<br />Keep informed; PCC and provincial sites, blogs<br />Talk to the experts<br />
  21. 21. Thank You!<br />For a copy of these slides, email me at<br />