In connection with a declaratory judgment lawsuit wherein the Harleysville Insurance Company sought a ruling that it did not have to pay a loss claim for an October 2014 fire at a funeral home, United States Magistrate Judge Pamela Meade Sargent ruled, in a February 9, 2017 decision, that the Harleysville Insurance Company waived any claim of privilege to materials uploaded to an unprotected file-sharing site, which anyone with a hyperlink to the site was able to access.  Specifically, Harleysville’s privilege problems stemmed from an investigator for its parent company, Nationwide Insurance, who wanted to share information electronically.  The investigator uploaded video surveillance footage of the fire scene to Box Inc. and sent a hyperlink to an employee at the National Insurance Crime Bureau (“NICB”). Later, the senior investigator uploaded the insurance claims file and investigation file to the same Box site, and sent the same hyperlink to Harleysville’s lawyers. Defense lawyers for the funeral home obtained the link from the NICB after they sought the file related to the fire. The NICB forwarded the email from the Nationwide investigator with the hyperlink, which also included a confidentiality notice that the email included privileged and confidential information. When the funeral home lawyers used the hyperlink, they gained access to the entire claim file. They proceeded to download the file – ignoring the confidentiality notice – and reviewed the file without notifying Harleysville or Harleysville’s counsel.

In reaching her decision, Judge Sargent wrote, “[I]n essence, Harleysville has conceded that its actions were the cyber world equivalent of leaving its claims file on a bench in the public square and telling its counsel where they could find it. It is hard to imagine an act that would be more contrary to protecting the confidentiality of information than to post that information to the world wide web.”

According to the American Bar Association BNA’s Lawyers’ Manual on Professional Conduct, Judge Sargent’s decision “should make lawyers think twice before putting confidential documents in a file-sharing site without password protection.”

Importantly, Harleysville was not the only litigant criticized in Judge Sargent’s opinion.  Judge Sargent scolded defense counsel for its improper and potentially unethical decision to access the  materials and use them without notifying lawyers for Harleysville.  In fact, Harleysville only learned that opposing counsel had the claims file only when they received a thumb drive of documents from the defense lawyers, which in turn caused Harleysville to file a motion to disqualify the defense lawyers.

Sargent, however, declined to disqualify defense counsel because of her decision on the privilege waiver. Instead, she said, defense counsel would have to pay the parties’ cost of obtaining her ruling on the matter.

This decision serves as an important reminder of the potential pitfalls inherent in our ever-growing digital world.   As attorneys, we should internalize the important lesson of properly securing documents before utilizing document sharing repositories and data rooms even those hosted by law firms, accounting firms and other trusted professionals.  It is critically important that we take the necessary precautions (i.e., encrypting documents, applying password protections, requiring double sign-on credentials) when we are handling and sharing documents that contain privileged information and other sensitive data (for example, personal identifying information).