Use of a file-sharing site without password was found to constitute a waiver of attorney-client privilege and work product protection

On February 9, 2017, a Virginia District Court deemed that the posting of privileged information on the web without protection results in a waiver.

In this case, Harleysville Insurance Company, (“Harleysville”) sued the defendants, Holding Funeral Home, Inc. seeking a declaratory judgment that it did not owe them fire loss claim. (Incidentally, the District Court had to decide whether the facts and circumstances surrounding the defense counsel’s access to Harleysville’s entire claims file required the disqualification of defense counsel.)

In an effort to share information electronically, Harleysville uploaded documents onto an internet-based electronic file sharing service accessible to anyone who had the hyperlink to access the folder.

Harleysville conceded that any person who used the hyperlink to access the folder had access to the electronic information stored there. The information was not password protected. Harleysville also conceded that any person who had access to the internet could have accessed the folder by simply typing in the URL address in the web browser.

Defense lawyers for the funeral home obtained the link and admittedly accessed the entire claims file. They downloaded the file and did not reveal to Harleysville’s counsel that they had obtained and reviewed the claims file.

The judge deemed that Harleysville waived any claim of attorney-client privilege with regard to the information posted to the folder. “It has conceded that the Box Site was not password protected and that the information uploaded to this site was available for viewing by anyone, anywhere who was connected to the internet and happened upon the site by use of the hyperlink or otherwise. In essence, Harleysville has conceded that its actions were the cyber world equivalent of leaving its claims file on a bench in the public square and telling its counsel where they could find it. It is hard to image an act that would be more contrary to protecting the confidentiality of information than to post that information to the world wide web.”

“When a client makes a decision—albeit an unwise or even mistaken, decision—not to maintain confidentiality in a document, the privilege is lost due to an overall failure to maintain a confidence.”

The court believed that defense counsel should have realized that the folder might contained privileged or protected information and should therefore have contacted Harleysville’s counsel and revealed that it accessed this information. “If defense counsel believed that the circumstances which allowed its access to the information waived any claim of privilege or protection, they should have asked the court to decide the issue before making any use of or disseminating the information.” However, counsel chose not to do so and the court deemed that such conduct should be sanctioned. Based on the decision that the posting of the claims file to the internet waived any attorney-client privilege or any work-product protection over the information contained in the file, the judge found that the disqualification of defense counsel was not warranted as it would have been an extreme sanction. Therefore, the judge deemed a more reasonable sanction that defense counsel bear the cost of the parties in obtaining the court’s ruling on the matter.


Harleysville Insurance Co. v. Holding Funeral Home, Inc., No. 1:15-cv-00057 (W.D. Va. Feb. 9, 2017) is available at…


For more information on attorney- client privilege, contact Francesca Giannoni-Crystal