File Sharing

A district judge holds that an e-discovery fluke did not waive privileges

By Pierre Grosdidier

A district judge sustained key objections to a magistrate judge’s order that held that an insurer, Harleysville Insurance Company, waived the attorney-client privilege and the work product doctrine’s protection when opposing counsel for Holding Funeral Home, Inc., gained access to Harleysville’s claims and investigation file concerning a coverage dispute.1 A third-party, the National Insurance Crime Bureau, or NICB, unwittingly granted Holding’s counsel access to Harleysville’s file by producing a live Box hyperlink to the file in an unredacted email through discovery. A Harleysville agent had sent the “sharing” hyperlink to the NICB to provide access to an unprivileged video. Later, the agent used the same hyperlink to send Harleysville’s file to its counsel. Holding found the hyperlink in the NICB’s production and accessed and read the file.

Harleysville sought to disqualify Holding’s counsel for improperly accessing and reviewing privileged information in the file, for concealing this access, and for refusing to delete the file when asked. The magistrate judge denied the motion, holding that Harleysville waived any existing privilege when it “uploaded the files to a publically accessible, nonpassword- protected website.”2

Addressing the attorney-client privilege under Virginia state law, the judge agreed with the magistrate judge that Harleysville’s disclosure was inadvertent because it was unknowing and unintentional. But analyzing the disclosure through three of the Supreme Court of Virginia’s five Walton factors, the judge held that there was no waiver of privilege.3 Harleysville had taken reasonable protective measures to preserve the file’s confidentiality when it loaded the file on a Box cloud account accessible only via a lengthy randomly generated hyperlink. Even though anyone with the hyperlink could access the folder, the hyperlink’s complexity acted as a de facto password. The judge found “inapposite” the magistrate judge’s metaphor that Harleysville had effectively left the file on a public bench and given away the directions.

The judge also noted that the agent believed that the hyperlink he sent to Harleysville’s counsel was unique and different from the one that he had sent earlier to the NICB. The agent, inexperienced with Box’s file sharing service, had also assumed that the NICB hyperlink had expired after a few days. Finally, the privileged and confidential material in the files was marked as such, as was the agent’s confidential email to counsel. The judge concluded that Harleysville took “reasonable precautions to prevent an inadvertent disclosure of the Claims File and that this factor weigh[ed] against a finding of waiver.”4

Addressing the other two Walton factors, the judge found that Harleysville acted timely when it asked Holding to rectify the error merely four days after discovering the breach. Harleysville also limited the extent of the inadvertent disclosure because it only disclosed the file to Holding (the NICB could have accessed the file, but did not). These factors all weighed against a waiver.5

The judge next analyzed the workproduct privilege waiver issue under Federal Rule of Evidence 502(b), which requires, inter alia, that “the disclosure [be] inadvertent.” The judge examined the meaning of “inadvertent” under this rule in light of the sparse applicable caselaw and held that Harleysville’s disclosure was inadvertent because Harleysville intended to maintain its file’s confidentiality and was unaware of Holding’s access. Moreover, Harleysville fulfilled the other conditions enumerated in Rule 502(b) because it “took reasonable steps to prevent disclosure” and “promptly took reasonable steps to rectify the disclosure.”6 The judge again declined to find a waiver.

Finally, the judge scrutinized Holding’s counsel’s conduct in this discovery dispute and in light of the latter’s “odd circumstances.”7 The judge found that counsel “had an obligation to ‘promptly return, sequester, or destroy’ the privileged materials,” and also a duty to reveal their disclosure, but did neither and “fell far short of their [ethical] responsibility.” 8 But despite using these and other harsh words to condemn Holding’s conduct, the judge denied the motion to disqualify, concluding that evidentiary sanctions were more appropriate. The privileged documents contained no “smoking gun” that would decide the case, the insured would be unjustly penalized by their counsel’s disqualification, the disclosure was inadvertent, and Harleysville’s agent was not blameless.9

The practical takeaway in this case remains the same: always use fused hyperlinks to share files via internet, as Harleysville’s agent assumed he was.TBJ


1. Harleysville Ins. Co. v. Holding Funeral Home, Inc., No. 1:15-CV-00057, 2017 WL 4368617, at 1 (W.D. Va. October 2, 2017) (slip op.); see also Pierre Grosdidier, Protect the contents of cloud file-sharing accounts with fused hyperlinks, Texas Bar Journal, October 2017, p. 586.

2. Harleysville, 2017 WL 4368617, at 3; see generally, Harleysville, No. 1:15-cv-00057, 2017 WL 1041600 (W.D. Va. February 9, 2017) (mem. op.).

3. Id. at 6 (citing Walton v. Mid-Atl. Spine Specialists, P.C., 694 S.E.2d 545, 552 (Va. 2010)). The judge noted that two of the five factors were inapplicable to the case.

4. Id. at 7.

5. Id at 7-8.

6. Id. at 10.

7. Id. at 11.

8. Id. at 13-14.

9. Id. at 14-16 (analyzing attorney disqualification through the six factors in In Re Meador, 968 S.W.2d 346, 351- 52 (Tex. 1998)).


Matthew E. EilersPIERRE GROSDIDIER is counsel to Haynes and Boone’s business litigation practice group in Houston. He divides his practice between construction litigation and construction contract drafting and belongs to the first group of attorneys who were certified in construction law by the Texas Board of Legal Specialization in 2017. Grosdidier’s practice also includes litigating unauthorized computer access and software copyright infringement claims. Prior to practicing law, he worked in the process control industry. Grosdidier holds a Ph.D. from Caltech and a J.D. from the University of Texas. He is a member of the State Bar of Texas and is a registered professional engineer in Texas (inactive).

{Back to top}

We use cookies to analyze our traffic and enhance functionality. More Information agree