Recent case law from Ontario confirms that a party seeking to rely on parts of an otherwise privileged document cannot simultaneously claim privilege over the same document.

In Kaplan v. Casino Rama Services Inc., 2018 ONSC 3545, the Ontario Superior Court of Justice determined that the Defendants had impliedly waived privilege over portions of expert reports commissioned in the wake of a data breach (the “Reports”).

In making a limited order for production, Justice Glustein declined to address whether or not the Reports were in fact privileged. The Court found that a party cannot rely on information obtained from an expert report, then subsequently seek to prevent its disclosure on the basis of privilege. Regardless of privilege, the principles of fairness and/or relevance require those portions of the Reports to be disclosed.

The Defendants are the owners and operators of Casino Rama Resort. In 2016, the Plaintiffs launched a class action after the Defendants notified approximately 200,000 individuals of a cyberattack.

Following the breach, the Defendants hired a cyber-security firm to investigate the incident and generate the Reports, which included findings, opinions, and recommendations.

The Defendants filed affidavit evidence relying on the Reports in multiple respects, including in connection with the experts’ findings as to the “size and scope of the prospective class”, which is a relevant consideration at the certification stage of a class action.

Prior to the certification hearing, the Plaintiffs filed a motion requiring the Defendants to produce the Reports. The Defendants opposed the request on the basis that the Reports were covered by either solicitor-client privilege or litigation privilege.

Ultimately, the Court partially sided with the Plaintiffs and made an order for limited disclosure of the Reports.

Justice Glustein began his reasons by stating that whether or not the Reports were privileged was irrelevant at the certification stage of the proceedings, as the outcome would be the same. If the Reports were privileged, the doctrine of waiver of privilege applied; if not, the doctrine of relevance applied, and only those parts of the Reports relevant to certification issues would be required to be disclosed.

In applying the doctrine of waiver of privilege, Justice Glustein held that an application of the “fairness test”[1] required the Defendants to disclose the parts of the Reports that they had relied upon in their evidence. Otherwise, it would be unfair to the Plaintiffs to ask the Court to accept that evidence. By the same token, only the parts of the Reports relied upon must be disclosed, as it would be conversely unfair to force disclosure of any irrelevant aspects.

A guiding principle in the Court’s decision was fairness: the Defendants could not fairly ask the Court to accept information as evidence that they simultaneously refused to disclose, even if that information was in fact privileged. Accordingly, the issue was not whether there was disclosure of facts contained in an expert report (generally, not privileged) or findings, opinions, and conclusions of an expert report (potentially privileged). Similarly, the fact that section 5(3) of the Class Proceedings Act compels parties to proffer their “best” evidence of the size of the class did not protect privilege. Rather, the decision turned on the fact that the Defendants chose to rely on the Reports in their evidence, and, as such, any privilege attaching to those aspects of the Reports was waived.

This decision highlights a few important points:

  • The difficulty in maintaining privilege over expert reports in situations where reliance on that expert’s opinion or conclusion may be the best or only way for a party to explain their case.
  • The importance of relying only on what is absolutely necessary when providing evidence in the early stages of litigation proceedings.

Ultimately, the decision indicates that any reliance on third party reports in litigation may require those reports to be disclosed to some extent. This is particularly important in the context of a data breach, where expert investigation may be a necessary follow-up procedure for an organization.