Attorney Error Results in Massive Leak of Privileged Client Data

From Inconvenience to Nightmare: The New York Times Leak

In Mill Lane Management, LLC v. Wells Fargo Advisors, LLC, the defendant, a bank, received a subpoena from the plaintiff seeking documents including emails between the bank and another defendant in the case. After using an outside e-discovery service to conduct the search for relevant documents, the bank’s attorney marked what she determined to be confidential or privileged information. She then instructed the e-discovery service to produce all the emails the attorney had not marked. After receiving an encrypted CD of emails from the e-discovery service and conducting a spot check, the attorney sent the CD to the plaintiff.

While the attorney thought she had reviewed all the emails included in the search results, she had not. She had reviewed and approved for production only the first thousand documents and, as a result, inadvertently produced billions of dollars’ worth of confidential information regarding some 50,000 clients of the bank.

The plaintiff’s counsel notified the bank attorney about the disclosure: “Your firm produced a slew of documents revealing billions of dollars of client account information, from residents of numerous states and possibly Europe.” Even though the bank attorney demanded the return of the confidential documents, the plaintiff instead leaked the information to the New York Times. The Times, in turn, published an article on the accidental disclosure, reporting that the plaintiff had showed the newspaper “large portions of the data and confirmed that it included what appeared to be clients’ names, unredacted taxpayer identification numbers, assets under management, portfolio performance, mortgage information, and details on 529 education savings plans.”

Based on the plaintiff’s actions, the bank asked the Supreme Court of the State of New York in New York County to intervene. The court ordered the plaintiff to return the documents to the bank, but at that point, the damage had been done.

Attorneys Should Apply Heightened Scrutiny

While the Wells Fargo disclosure is one of the more egregious instances of inadvertent production, Section of Litigation leaders warn that this is a problem that will only worsen in the age of e-discovery. “The problem now is there is so much electronic information that it is difficult to process well,” says Scott N. Wagner, Miami, FL, cochair of the Books Subcommittee of the Section’s Pretrial Practice & Discovery Committee. “Mistakes are going to happen. It’s something that goes wrong all too often.”

While it may feel safe to completely trust a digital system, “when you are dealing with such a large volume of information there is always a risk things are going to fall through the cracks,” agrees Eric B. Levasseur, Cleveland, OH, cochair of the Newsletter and Website Subcommittee of the Section’s Pretrial Practice & Discovery Committee.

But there are ways lawyers can hedge against the problem. “While nothing is foolproof, there are several controls attorneys can put in place to make sure that only documents reviewed and designated for production are produced,” observes Wagner. “For example, tell reviewers that if they see names or Social Security numbers in a document, to flag that document so a senior attorney can review it,” he explains. Then “one of the lawyers should look at the actual media being produced for 10 to 15 minutes before it goes out, to see if something is dramatically wrong with the production,” he says. “Many times, firms have junior associates giving instruction to whoever is doing the document review, and a senior attorney needs to be involved, someone who really understands the case as well as the client’s business,” Wagner concludes.

In addition to an understanding of the case, protective orders are key. “Prior to producing ESI [electronically stored information], make sure the court has entered an appropriate protective order that has a clawback provision so that if privileged or other sensitive information is inadvertently disclosed, the disclosing party will have the right to claw that information back and it will not be subject to disclosure,” recommends Levasseur. “Protective orders are important because you want to have total control over your client’s information,” Wagner agrees. “That way, if something gets produced, you have a procedure for getting it back,” he explains.

Communicate with Your Vendor and Keep Pace with Technology

It is also important for attorneys to have a basic understanding of the technical side of e-discovery. “While you may not necessarily have in-depth knowledge of every mechanical detail, you at least need to have a broad enough higher-level understanding of the mechanics of the process so that you are comfortable as a lawyer that things aren’t falling through the cracks,” says Levasseur. “While ESI vendors can be of significant assistance, the attorney involved still needs to have a good grasp of what the vendor is doing, what categories of information are being processed, and understand how the information is processed, collected, and produced to the reviewing attorney so that the reviewing attorney understands what the full universe of potentially relevant ESI is,” he explains.

There are a couple of ways attorneys can do this. “Number one, take time to speak with the ESI vendor and have an in-depth discussion with him or her that you understand both substantively and mechanically what the vendor is doing and how it is ultimately going to be produced to you,” advises Levasseur. “It is absolutely critical to have a very clear understanding of what the vendor is collecting for production,” agrees Wagner. “An attorney should always ask the vendor to provide the logic the vendor used to pull the documents for the production set,” he says.

“Beyond that, if your organization has the ability to do it, continue to provide training on ESI-related issues,” Levasseur counsels. “Third is the duty incumbent upon any lawyer to just stay abreast of recent ESI decisions, what is being said in the press, and having a general understanding of what new technologies might exist,” he concludes.

What to Do If the Worst Happens to You

While protective orders and a good understanding of the substance of the case and mechanics of e-discovery can prevent many disclosures from occurring, mistakes happen. Should a document get inadvertently disclosed with no protective order in place, Section leaders stress the importance of acting promptly. “Go immediately to the court and request the court to sequester the documents until it can determine whether you can get the documents back,” advises Wagner. “Be candid with the court on how and why it was produced and why it should be given back,” he adds.

In addition, “it is important to consult the rules of evidence, civil procedure, and ethics in the jurisdiction where you are located to make sure you fully understand your obligations, whether you are the attorney who inadvertently disclosed the information or the attorney who received the information,” recommends Levasseur.

Catherine M. Chiccine is an associate editor for Litigation News.

Resources

• Mill Lane Mgmt., LLC v. Wells Fargo Advisors, LLC, No. 652025/2017 (N.Y. Sup. Ct. Jul. 24, 2017), available at http://bit.ly/LN432-mill-lane.
  
• Serge F. Kovaleski & Stacy Cowley, “Wells Fargo Accidentally Releases Trove of Data on Wealthy Clients,” N.Y. Times (Jul. 21, 2017), available at http://bit.ly/LN432-kovaleski.
  
• Lisa M. Gonzalo, “Inadvertent Disclosure in E-Discovery: How to Avoid Waiver of Privilege,” Com. & Bus. Litig. (Nov. 3, 2015), available at http://bit.ly/LN432-gonzalo.
  
• Andrea Donovan Napp, “The Intersection of Data Privacy and E-Discovery,” Bus. Torts & Unfair Competition (Dec. 17, 2014), available at http://bit.ly/LN432-napp.
  
• Jennifer F. Beltrami, “Are Clawback Agreements Being Used to Their Full Extent?,” Com. & Bus. Litig. (Apr. 30, 2012), available at http://bit.ly/LN432-beltrami.

_{Copyright © 2018, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).}