Intellectual Property Singapore Document Number: 1438662Document Number: 1438662 Client Alert March 2016 For further information please contact Andy Leck +65 6434 2525 Andy.Leck@bakermckenzie.com Cheah Yew Kuin Local Principal +65 6434 2644 Yew.Kuin.Cheah@bakermckenzie.com Baker & McKenzie.Wong & Leow 8 Marina Boulevard #05-01 Marina Bay Financial Centre Tower 1 Singapore 018981 www.bakermckenzie.com Can privileged and confidential information posted on the Internet by hackers be used as evidence? Overview In HT S.R.L. v Wee Shuo Woon  SGHC 15, the High Court held that privileged and confidential information hacked from a computer system and posted online may nevertheless be precluded from use by an opponent in a pending suit under the law of confidence. This applies even where the opponent is not responsible for the information leak. Background The Plaintiff, HT SRL, sued the Defendant, Wee Shuo Woon for breaches of an employment contract. The Plaintiff's computer systems were subsequently hacked by a third party and information obtained from the systems was uploaded on the Internet. The uploaded information included privileged and confidential emails between the Plaintiff and their solicitors pertaining to the pending suit. The Defendant accessed the emails and sought to rely on its contents to strike out the bulk of the Plaintiff's claims. The Plaintiff applied for an order to have the emails expunged from the Defendant's affidavits in support of the striking out action. Relevant Issues In coming to its decision, the Court considered the following issues: (1) Did common law rules on legal professional privilege apply? (2) Did the common law provide the Plaintiff with any basis in the application to expunge? If so, what are the principles? (3) Did the fact that the emails were generally available to the public on the Internet preclude the grant of an application to expunge? The Court's Decision Applicability of rules on legal professional privilege On the first issue, the Court relied on Yap Sing Lee v Management Corporation Strata Title Plan No 1267, and held that common law rules on legal professional privilege applied to affidavits filed in interlocutory proceedings which precede a trial such as a striking out action. Legal bases for expunging emails In addressing the second issue, the Court considered both Singapore and English cases where the owner of confidential information contained in privileged documents sought to prevent their unauthorised use in court 2 Client Alert proceedings. As a starting point, the Court took pains to point out that the admissibility of evidence and privilege are distinct concepts. Specifically, the fact that a privileged document is admissible in evidence did not affect the Court's equitable jurisdiction to grant an injunction to restrain their disclosure or use on the basis that they contained confidential information which had been improperly obtained. However, a party who seeks an injunction to restrain the use and disclosure of his privileged and confidential information had to do so before the evidence is "used". "Use" in this case refers to the information becoming part of the record in any court proceedings. This is because the granting of an injunction is based on the law of confidence. Once the documents have entered into evidence, their exclusion would be governed by the common law rules of evidence. On the facts, the emails being objected to had not been "used" even though they had been incorporated in an affidavit filed in respect of the striking out application because the hearing for the striking out had not taken place. As such, the emails had not been formally admitted into evidence. Were emails published on the Internet still protected by confidentiality? The Court then went on to consider the third issue. That is, whether the principle of confidentiality still applied in this case since the emails were generally available to the public on the Internet. The Court noted the principles espoused in the landmark Spycatcher case that the duty of confidentiality is subject to the limitation that “confidentiality only applies to information to the extent that it is confidential”. In particular, once the information has entered the public domain, the principle of confidentiality generally has no application. However, the Court is of the opinion that the “public domain” concept is not an inflexible rule and accessibility is just one factor impacting the scope of the duty of confidentiality. Citing various English cases, the Court concluded that the crux of matter was not so much the accessibility of the information per se, but whether there is still a point in enforcing the obligation of confidence. After considering the circumstances of the case, the Court concluded that the imposition of an obligation of confidence remained just and reasonable, notwithstanding that the information was freely available online. In particular, the Plaintiff had a compelling interest in restraining the use of the emails, that is, to prevent his privileged and confidential discussion with his solicitor from being used against him. The Court also took into account the fact that the Plaintiff was a victim of cybercrime, had not waived privilege in the documents, and the Defendant had used the emails even though he was aware of their privileged and confidential nature as well as the circumstances which led to their leak. After deciding that it had the jurisdiction to expunge the emails, the Court considered if it had any discretion in whether to grant such relief and the extent of such discretion. The Court concluded, based on previous case law, that the preservation of legal professional privilege prevailed over public interest in having the maximum relevant material available to the Court. Therefore, the Court did not have the discretion to refuse relief unless there are other reasons affecting the granting of an injunction which is an equitable remedy. In view of the above, the Court affirmed the Assistant Registrar's decision to have the emails expunged from the Defendant's affidavits. 3 Client Alert Comments In this day and age where cybercrime is increasingly common, it is heartening to see the Court taking a pragmatic approach in deciding that the imposition of an obligation of confidence remained just and reasonable in the circumstances despite the information being freely available online. Having said that, companies need to be mindful of the ease with which confidential information in electronic form can be circulated on the Internet, whether as a result of criminal means, or by sheer inadvertence. Simple steps, such as ensuring that sensitive information is encrypted and passwords are kept secure, or stating clearly on such documents that the contents are confidential, can go a long way towards ensuring that the requisite duty of confidence can be imposed on any third party who gains unauthorised or inadvertent access to such confidential documents. ©2016. All rights reserved. Baker & McKenzie.Wong & Leow is a member of Baker & McKenzie International, a Swiss Verein with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “partner” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.