Is Company Data a Privilege?

This Technology article considers whether company data is privileged and the importance of confidentiality.

In a world where cloud environments and external storage capacity can be spun up and subscribed to in an instance, businesses need to be mindful of the risks this can pose. Such environments and systems are awash with data and can store any number of sensitive emails and documents. Therefore, a key concern for businesses is ensuring that confidential and sensitive information is properly protected. That concern is often heightened around correspondence with lawyers when legal disputes have arisen, and businesses are obliged to disclose relevant evidence as part of the court process.  

The recent case of Jinxin Inc v Aser Media PTE Ltd is a useful reminder of the concept of "legal professional privilege" and confidentiality in such situations.

This case provides businesses with a useful reminder of the test to be applied when a claim for legal professional privilege is made. It underlines confidentiality as a key ingredient and clarifies that the law on confidentiality should not be confused with the law on privacy.

Facts

The claimant wanted a share purchase agreement (SPA) rescinded. Under the SPA, the claimant had bought 65% of MPS shares from the sellers, which included some of the defendants in this case. MPS later became involved in insolvency proceedings. 

The claimant argued that the defendants had induced it to agree to the SPA using fraudulent misrepresentation.

MPS agreed to provide the claimant with extensive information, including emails, documents and other data used by the defendants as officers of MPS. The defendants objected that around half of the 1.5m documents gathered were subject to privilege and could not be included in the proceedings. The claimant then applied for a ruling that the defendants were not entitled to claim privilege concerning the data and documents from MPS's servers.

The claimant argued that the defendants had no reasonable expectation of privacy around the information held on MPS's servers. The claimant proposed that, since a reasonable expectation of privacy was a fundamental principle of confidentiality, such data could not be confidential as the defendants had exchanged emails and documents on MPS's servers (some of it personal), knowing that MPS could monitor such emails and that other employees (such as IT and PAs) could access their emails.

Decision 

The judge disagreed with this argument. Yes, confidentiality was a requirement for the privilege to apply but a "reasonable expectation of privacy" was not a prerequisite for there to be confidentiality.

The judge confirmed that the true requirement was that the information must have been divulged in circumstances that import an obligation of confidentiality. There had not been an automatic loss of confidentiality in these circumstances merely because emails and documents had been stored in MPS systems, where MPS employees could access and monitor them.

The judge rejected the application and held that none of the factors presented by the claimant stopped confidentiality from arising.