In Harleysville Insurance Co. v. Holding Funeral Home, Inc., et. al., Case No. 15-00057 (W.D. Va., Feb. 9, 2017), Plaintiff sued to determine that it does not owe Defendants for their fire loss insurance claim because the fire was a result of arson, and also because Defendants made material misrepresentations and failed to cooperate. Defendants filed counterclaims for breach of contract and bad faith.
Thomas Cesario, a senior investigator for Plaintiff uploaded video surveillance footage of the fire loss scene to an internet-based file sharing service operated by Box, Inc. Cesario later emailed a link to the Box video to Wes Rowe, an agent of the National Insurance Crime Bureau (NICB). The email contained a confidentiality notice. Anyone who had access to the link could view the information stored on Box, and the information was not password protected. When Rowe accessed the site, the only information stored there was the video.
In April 2016, Cesario uploaded the entire claims file and Nationwide’s investigation file for Defendants’ fire loss to the Box site so Plaintiff’s counsel could access the files using the same link sent to Rowe.
During the case, Defendants subpoenaed the NICB requesting its entire file related to the fire. NICB complied, and its response included the email from Cesario to Rowe containing the link to Box. Defendants’ counsel, without permission, clicked the link and accessed the site, which included the entire claims file and the entire investigation file. He then downloaded the claims file and reviewed it without notifying Plaintiff’s counsel that he had done so. He later produced a flash drive to Plaintiff’s counsel that inadvertently contained privileged information; he contacted Plaintiff’s counsel and asked that it be destroyed, and Plaintiff’s counsel did so, discovering that Plaintiff’s own claims file was on the drive. Plaintiff’s counsel asked Defendants’ counsel to destroy the claims file, and Plaintiff disabled the Box drive. Plaintiff filed a Motion to disqualify defense counsel for improperly accessing privileged and confidential information; Defendants’ counsel argued that privilege was waived by placing the information on the Box drive.
While the court found that the disclosure was inadvertent, it still held that any attorney/client privilege was waived, because the information was uploaded to an internet site where anyone with internet access could potentially view the information. No safeguards were put in place to protect the information. The court concluded that Plaintiff had committed “the cyber world equivalent of leaving its claims file on a park bench in the public square and telling its counsel where they could find it.”
The court made its findings under Virginia law regarding attorney/client privilege, and expressly noted that its ruling did not extend to federal law. Regardless, the court admonished defense counsel for viewing what he must have known was confidential and inadvertently produced information. The court held that although the privilege was waived, defense counsel deserved sanctions and accordingly ordered defense counsel to pay Plaintiff’s fees related to the Motion.