Privacy breaches are becoming commonplace in today’s business landscape and cybersecurity is top of mind for many organizations— and for good reason. The 2022 Canadian Internet Registry Authority (CIRA) Cybersecurity Survey found that the number of breaches involving customer and employee information nearly doubled after the pandemic, and more businesses are reporting loss of customers from cyberattacks. This situation is exacerbated by the risk of litigation, as lawsuits are a legitimate consequence of a privacy breach. Ongoing activity in the privacy breach litigation space calls for organizations to re-examine their privilege strategies and prepare for potential scrutiny that may occur in the event of a dispute.
The Ongoing Litigation Risk
In 2022, Canadian courts continued to see litigation resulting from privacy breaches, with class actions being certified on the basis of a broad range of claims, including systemic negligence and breach of contract. There have also been significant developments in the jurisprudence for privacy breaches, such as the landmark release of three Ontario Court of Appeal decisions (Owsianik v Equifax Co., 2022 ONCA 813; Obodo v Trans Union of Canada, Inc., 2022 ONCA 814; and Winder v Marriot International, Inc., 2022 ONCA 815) in late 2022 that clarified the scope of liability in data breach class actions for the tort of intrusion upon seclusion.
The continued litigation reminds organizations and lawyers to ensure their privacy breach response plans conform with best practices. This is not only limited to having a robust IT framework, but includes adopting legal procedures to provide adequate protection and support. Privilege is an essential component of privacy breach litigation and should be a priority in a response strategy. In a privacy breach, legal privilege permits an organization to obtain legal advice about the incident without having to worry that such communications and related documents will be disclosed to others. This is crucial for breach response efforts, when the fast-paced environment requires candid conversations between counsel and client. Privilege is also an essential aspect for litigation preparation, by allowing lawyers to create necessary resources without fear that these materials may be disclosed and potentially used against their clients.
A Brief Review of Legal Privilege
Solicitor-client privilege and litigation privilege are two types of privilege that are involved in privacy breach litigation.
- Solicitor-client privilege protects communications between the lawyer and client; entails the seeking or giving of legal advice; and is intended to be confidential. It does not depend on on-going or anticipated litigation, and it is permanent once applied, unless waived by the client.
- Litigation privilege protects documents and communications that were created or collected for the dominant purpose of litigation that is on-going or reasonably anticipated. The privilege terminates once the respective litigation ends.
Please log in to read the full article.