{"id":51548,"date":"2025-01-27T19:27:14","date_gmt":"2025-01-27T19:27:14","guid":{"rendered":"https:\/\/peraltafinancing.com\/business\/legal\/important-new-ontario-court-decision-on-privilege-in-incident-response-documentation\/"},"modified":"2025-01-27T19:27:14","modified_gmt":"2025-01-27T19:27:14","slug":"important-new-ontario-court-decision-on-privilege-in-incident-response-documentation","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=51548","title":{"rendered":"Important new Ontario court decision on privilege in incident response documentation"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div id=\"post-body-4417217815197419619\">\n<p>\n<iframe loading=\"lazy\" title=\"Important court decision on legal privilege in cyber incident response\" width=\"840\" height=\"473\" src=\"https:\/\/www.youtube.com\/embed\/35cAQ4ISLoI?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">The Ontario divisional court has just released a <\/span><span lang=\"EN-CA\"><a href=\"https:\/\/canlii.ca\/t\/k4bqw\"><span lang=\"EN-US\" style=\"mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">decision<\/span><\/a>,<\/span><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">\u00a0<a href=\"https:\/\/canlii.ca\/t\/k4bqw\" target=\"_blank\"><i>LifeLabs LP v. Information and Privacy Commr. (Ontario)<\/i>, 2024 ONSC 2194<\/a>, that should grab the attention of Canadian lawyers who work in cyber<br \/>\nincident response. I don\u2019t know whether it will be appealed, but the logic of<br \/>\nthe decision is pretty sound. But I expect this isn\u2019t over.\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">In a nutshell, after a significant ransomware incident, LifeLabs was<br \/>\nassisted by well-known cybersecurity and forensic consultants for the<br \/>\ninvestigation, remediation and negotiation with the ransomware bad guys. As<br \/>\nrequired by the relevant privacy laws of those provinces, they notified the<br \/>\nprivacy commissioners of British Columbia and Ontario, and the commissioners<br \/>\nstarted a joint investigation. In connection with their investigation, the<br \/>\ncommissioners demanded to see the consultants\u2019 reports and LifeLabs claimed<br \/>\nthey were privileged.\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Not surprisingly, the ransomware incident was followed by a number of<br \/>\nclass action lawsuits that were still pending at all material times.\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">In June 2020, the Commissioners issued a joint decision finding that LifeLabs<br \/>\nhad provided insufficient evidence to back up the privilege claim. They were<br \/>\nalso ordered to hand over the consultants\u2019 reports.\u00a0 So LifeLabs sought<br \/>\njudicial review of the order in the Ontario Divisional Court. The Court just<br \/>\nreleased its decision, upholding the IPC\u2019s order. I\u2019m not sure why it took so<br \/>\nlong to get to a hearing.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">According to the IPC\u2019s decision, there were five categories of records<br \/>\nat issue:<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"margin-left: 0.5in; text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">i.<span style=\"mso-tab-count: 1;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>The<br \/>\ninvestigation report prepared by the cybersecurity firm hired by LifeLabs,<br \/>\nwhich described how the cyberattack occurred.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"margin-left: 0.5in; text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">ii.<span style=\"mso-tab-count: 1;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>The<br \/>\nemail correspondence between the cyber intelligence firm and the<br \/>\ncyber-attackers after the discovery of the attack by LifeLabs.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"margin-left: 0.5in; text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">iii.<span style=\"mso-tab-count: 1;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>An<br \/>\ninternal data analysis prepared by LifeLabs on April 28, 2020 to describe which<br \/>\nindividual health information had been affected by the breach and to notify<br \/>\nthose affected pursuant to ss. 12(1) and 12(2) of the PHIPA.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"margin-left: 0.5in; text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">iv.<span style=\"mso-tab-count: 1;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>A<br \/>\nsubmission from LifeLabs to the Commissioners dated May 15, 2020 in response to<br \/>\ncertain specific questions, communicated through legal counsel.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"margin-left: 0.5in; text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">v.<span style=\"mso-tab-count: 1;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>The<br \/>\nreport of Kevvie Fowler, Deloitte LLP dated June 9, 2020 prepared as part of<br \/>\nthe representations by LifeLabs and submitted to the Commissioners for that<br \/>\npurpose.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Other than the internal LifeLabs assessments, the records were created<br \/>\nby consultants retained by LifeLabs\u2019 lawyers. The cybersecurity firm was<br \/>\nalready engaged by LifeLabs to assess the company\u2019s security, and it was<br \/>\nactually them who discovered the incident. They were instructed to provide<br \/>\ntheir reports on the incident to legal counsel.\u00a0\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">The court reviewed the IPC\u2019s privilege decision on a standard of<br \/>\ncorrectness and found that it was correct.\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Before getting into the decision, it should be noted that LifeLabs<br \/>\nclaimed \u201csolicitor client privilege\u201d and \u201clitigation privilege\u201d. They are<br \/>\nrelated and similar, but not the same.\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Solicitor client privilege protects communications that are made in<br \/>\nconfidence between a lawyer and their client (or third party acting on behalf<br \/>\nof their client). In order to be privileged, the communication must be made for<br \/>\nthe purpose of seeking or giving legal advice, and the parties must have<br \/>\nintended the communication to be confidential. Just because there\u2019s a lawyer in<br \/>\nthe mix doesn\u2019t make it privileged, and a third party\u2019s involvement, like a<br \/>\nconsultant retained by the client or the lawyer, doesn\u2019t waive that privilege.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Litigation privilege is intended to create a \u201czone of privacy\u201d within<br \/>\nwhich counsel can prepare draft questions, arguments, strategies or legal<br \/>\ntheories, in anticipation of litigation and for the purpose of preparing for<br \/>\nthat litigation. Documents created by others, to assist counsel, in preparing<br \/>\nfor litigation can also fit into this category. Notably, the privilege only<br \/>\nexists while the litigation is anticipated or ongoing.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">If you read the IPC\u2019s decision, you\u2019ll see that not much information was<br \/>\nprovided by LifeLabs (or at least not to the IPC\u2019s satisfaction) to demonstrate<br \/>\nthat the five categories of records fit into either solicitor client privilege<br \/>\nor litigation privilege.\u00a0 In large measure, the IPC decided that LifeLabs<br \/>\nHAD to investigate the incident and HAD an obligation to provide factual<br \/>\ninformation to the IPC. It doesn\u2019t look like the IPC was looking for actual<br \/>\nadvice given by counsel or anything related to LifeLabs\u2019 trial strategy for<br \/>\ntheir ongoing litigation.\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Ultimately, the decision turned on LifeLabs not providing evidence to<br \/>\nthe IPC\u2019s satisfaction to back up their privilege claims.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">The main conclusions, simplified a bit, are that:\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<blockquote style=\"border: none; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">1.<span style=\"mso-tab-count: 1;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Facts are not<br \/>\nprivileged, even if they were collected or compiled by a lawyer.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">2.<span style=\"mso-tab-count: 1;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>If you have a statutory<br \/>\nobligation to investigate and provide information to the regulator, the facts<br \/>\nthat are discovered in that investigation are not privileged.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">3.<span style=\"mso-tab-count: 1;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Solicitor client<br \/>\nprivilege only protects communications that are made for the purpose of seeking<br \/>\nor obtaining legal advice.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">4.<span style=\"mso-tab-count: 1;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Litigation privilege<br \/>\nonly protects communications and records that are created for the dominant<br \/>\npurpose of preparing for litigation.<\/span><\/p>\n<\/blockquote>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">This is not earth shattering, but it\u2019s a reminder of how the law of<br \/>\nprivilege works in Canada.\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">The court emphasized that even if certain communications or documents<br \/>\nare privileged, the facts referred to or reflected in those communications may<br \/>\nnot be privileged if they exist independently, outside of the privileged<br \/>\ncontext. Facts that have an independent existence outside of solicitor-client<br \/>\nprivileged communications are not automatically privileged.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">The court quoted and agreed with paragraph 49 of the IPC\u2019s decision:<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"margin-left: 0.5in; text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Even if the communication is privileged,<br \/>\nthe facts referred to or reflected to in those communications are not<br \/>\nprivileged if they exist outside the documents and are relevant and otherwise<br \/>\nsubject to disclosure. Some facts have a life outside the communication between<br \/>\nlawyer and client but have also been communicated within the solicitor-client<br \/>\nrelationship. Facts that have an independent existence outside of<br \/>\nsolicitor-client privileged communications are not privileged. When deciding if<br \/>\nsuch facts are privileged, one must keep one eye on the need to protect the<br \/>\nfreedom and trust between solicitor and client and another eye on the potential<br \/>\nuse of privilege to insulate otherwise discoverable evidence. While privilege<br \/>\nis jealously guarded it must be interpreted to protect only what it is intended<br \/>\nto protect and nothing more.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">The court further clarified that simply depositing a document or<br \/>\nproviding counsel with a copy of a document does not automatically extend<br \/>\nprivilege to the original document. The protection of privilege is intended to<br \/>\nsafeguard the communication between lawyer and client and the adversarial<br \/>\npreparation for litigation, not the underlying facts themselves.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Therefore, the court concluded that facts concerning the investigation<br \/>\nor remediation, even if communicated within a privileged context, may not be<br \/>\nprivileged if they have an independent existence outside of privileged<br \/>\ndocuments.\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">If an organization has a legal obligation to investigate, remediate and<br \/>\nreport to the privacy commissioner, interjecting lawyers into the process does<br \/>\nnot relieve the organization of its obligation to report to the commissioner.<br \/>\nThis obligation includes cooperating with the commissioner&#8217;s inquiries and<br \/>\nproviding information necessary for investigations.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">The Court wrote:<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"margin-left: 0.5in; text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">[76] \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<br \/>\nHealth information custodians, such as LifeLabs, cannot defeat these<br \/>\nresponsibilities by placing facts about privacy breaches inside privileged<br \/>\ndocuments. Although the claims of privilege here were rejected, even if they<br \/>\nhad been accepted, this would not have defeated the ON IPC\u2019s duty to inquire<br \/>\ninto the facts about the data breach within the control and knowledge of LifeLabs.<br \/>\nThis result flows not only from the ON IPC\u2019s statutory mandate, but also from<br \/>\nhow litigation privilege and solicitor client privilege function.<\/span><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"margin-left: 0.5in; text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">\u2026<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"margin-left: 0.5in; text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">[79] \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<br \/>\nThus, the IPC\u2019s statutory duty to inquire, and LifeLabs\u2019 duty to respond, does<br \/>\nnot permit a claim of litigation privilege over facts obtained through its<br \/>\nlawyers, even where those facts might also play a role in defending against<br \/>\nparallel civil litigation. As Nordheimer, J. wrote in <i>R. v. Assessment<br \/>\nDirect<\/i>, at para. 10, \u201cthe privilege does not protect information that would<br \/>\notherwise have to be disclosed\u201d.\u00a0 LifeLabs did not identify any litigation<br \/>\nstrategy that would be disclosed in the Investigation Report because of the<br \/>\nPrivilege Decision.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">On this point, the Court agreed with the findings of the IPC:<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"margin-left: 0.5in; text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">[80] \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<br \/>\nSimilarly, solicitor-client privilege does not extend to protect facts that are<br \/>\nrequired to be produced pursuant to statutory duty. The ON IPC correctly<br \/>\narticulated the law when it stated at para. 49:<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"margin-left: 1in; text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">\u2026 Facts that have an independent existence<br \/>\noutside of solicitor-client privileged communications are not privileged. \u2026<br \/>\nWhile privilege is jealously guarded it must be interpreted to protect only<br \/>\nwhat it is intended to protect and nothing more.\u201d<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Furthermore, the court emphasized that organizations cannot use claims<br \/>\nof privilege to shield facts about privacy breaches from the commissioner. Even<br \/>\nif privilege is claimed over certain documents or information, it does not<br \/>\nabsolve the organization from its duty to cooperate with the commissioner&#8217;s<br \/>\ninvestigation and provide relevant facts. The court noted that placing<br \/>\nunpalatable facts within privileged documents to avoid investigative orders<br \/>\nwould undermine the purpose of regulatory oversight and accountability.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Just saying something is privileged does not make it privileged.<br \/>\nIncluding a lawyer in a conversation does not make it privileged. Having the<br \/>\nlawyer hire the consultant does not automatically make it privileged.\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">The IPC and the Court noted that the cybersecurity consulting firm had a<br \/>\nprior retainer with LifeLabs related to what it was doing before the incident,<br \/>\nduring the incident and afterwards. Simply having the report related to the<br \/>\nincident addressed to counsel didn\u2019t make that report privileged. The IPC<br \/>\nreferred to a US case called <i>In re Capital One<\/i>, which LifeLabs said was<br \/>\nan error. The court disagreed with LifeLabs, and reached the same conclusion as<br \/>\nthe IPC:\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p class=\"MsoNormal\" style=\"margin-left: 0.5in;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">[90]<span style=\"mso-spacerun: yes;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>I disagree. The <i>In<br \/>\nre Capital One<\/i> case affords persuasive authority to support a finding that<br \/>\nwhere a company has a prior retainer with a cybersecurity firm to provide<br \/>\nessentially the same services before and after a breach, inserting<span style=\"mso-spacerun: yes;\">\u00a0 <\/span>counsel\u2019s name into the contract and stating<br \/>\nthat the deliverables would be made to counsel on behalf of the client, does<br \/>\nnot render any report prepared subject to the U.S. work product doctrine, which<br \/>\nis akin to Canada\u2019s litigation privilege.<\/span><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Interestingly, the IPC in their <\/span><span lang=\"EN-CA\"><a href=\"https:\/\/canlii.ca\/t\/j64dl\"><span lang=\"EN-US\" style=\"mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">March<br \/>\n2020 decision<\/span><\/a><\/span><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">\u00a0on privilege<br \/>\nleft the door open for LifeLabs to prove that portions of the records may<br \/>\ninclude information that is subject to solicitor client or litigation<br \/>\nprivilege.\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">I would have liked to have seen a bit more analysis of what is<br \/>\nreasonably contemplated litigation and dominant purpose, in the context of the<br \/>\ndiscussion of litigation privilege. The reality is that in the aftermath of an<br \/>\nincident like this, litigation is almost certain to follow. Much of the<br \/>\nresponse or even the approach to the incident response is informed by that<br \/>\nlikelihood. Many records are created in anticipation of defending litigation,<br \/>\nbut those records are also useful for (or maybe necessary for) dealing with the<br \/>\ncommissioner\u2019s investigation. Is 50\/50 dominant enough? And some of these<br \/>\nrecords would be created because that\u2019s what\u2019s expected of a reasonably prudent<br \/>\ncompany. Is 33\/33\/33 dominant enough? Should we create different tracks in<br \/>\nincident response, assigning certain investigators to the litigation track and<br \/>\nothers to the commissioner reporting track?<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">Maybe we should consider amending our privacy laws (or Evidence Acts<br \/>\nmore generally) to say that the provision of information to a regulator<br \/>\npursuant to a statutory duty does not amount to a waiver of privilege as far as<br \/>\nthird parties are concerned.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">I think lawyers who work in this area will have some interesting<br \/>\ndiscussions about this decision.<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">It will be interesting to consider how this affects certain activities<br \/>\nthat take place outside of the context of dealing with an active incident. For<br \/>\nexample, I may be retained by a client to provide them with my assessment of<br \/>\nwhether they are complying with their safeguarding obligations under privacy<br \/>\nlaws. Often, an engagement like that involves working with expert consultants<br \/>\nwho examine the network security, do penetration testing and benchmark against<br \/>\nbest practices. New facts are uncovered that will be included in my opinion and<br \/>\nadvice to the client, and at that stage there is no obligation to assist any<br \/>\nprivacy regulator in that endeavour. The new facts were \u201cuncovered\u201d or<br \/>\ndiscovered only for the purpose of providing legal advice. I think there are arguments<br \/>\nthat can be made in both directions regarding whether those new facts can be<br \/>\nprivileged. That\u2019s a discussion for another day \u2026<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p align=\"left\" class=\"MsoNormal\" style=\"text-align: left;\"><span style=\"color: black; mso-ansi-language: EN-US; mso-bidi-font-family: Arial; mso-fareast-font-family: &quot;Times New Roman&quot;;\">I should add this decision doesn\u2019t create any new law about privilege.<br \/>\nNor does it put a dizzying spin on privilege law, but it serves as a reminder<br \/>\nthat you can\u2019t throw a blanket of privilege over everything associated with<br \/>\nincident response. I also don\u2019t think it does away with privilege in connection<br \/>\nwith incident response. I have provided a lot of advice to a lot of<br \/>\norganizations, and I\u2019ve worked with a lot of outside consultants in that<br \/>\ncontext. I remain confident that my communications with my clients, in the<br \/>\ncontext of them seeking my legal advice, is untouched by this decision.\u00a0<\/span><span style=\"font-family: &quot;Times New Roman&quot;,serif; font-size: 12pt; mso-ansi-language: EN-US; mso-fareast-font-family: &quot;Times New Roman&quot;;\"\/><\/p>\n<p class=\"MsoNormal\"><span lang=\"EN-CA\"><\/p>\n<p>\u00a0<\/p>\n<p><\/span><\/p>\n<p><\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>The Ontario divisional court has just released a decision,\u00a0LifeLabs LP v. Information and Privacy Commr. (Ontario), 2024 ONSC 2194, that should grab the attention of Canadian lawyers who work in cyber incident response. I don\u2019t know whether it will be appealed, but the logic of the decision is pretty sound. But I expect this isn\u2019t [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":51549,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[97],"tags":[410,18355,30326,6342,16297,17460,30325,14964],"dealstore":[],"offerexpiration":[],"class_list":["post-51548","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-legal","tag-court","tag-decision","tag-documentation","tag-important","tag-incident","tag-ontario","tag-privilege","tag-response"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Important new Ontario court decision on privilege in incident response documentation - Som2ny Network<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fivemor.com\/?p=51548\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Important new Ontario court decision on privilege in incident response documentation - Som2ny Network\" \/>\n<meta property=\"og:description\" content=\"The Ontario divisional court has just released a decision,\u00a0LifeLabs LP v. Information and Privacy Commr. (Ontario), 2024 ONSC 2194, that should grab the attention of Canadian lawyers who work in cyber incident response. I don\u2019t know whether it will be appealed, but the logic of the decision is pretty sound. But I expect this isn\u2019t [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fivemor.com\/?p=51548\" \/>\n<meta property=\"og:site_name\" content=\"Som2ny Network\" \/>\n<meta property=\"article:published_time\" content=\"2025-01-27T19:27:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/01\/AEn0k_t_sNcNJJcKO7NpUin9bYaa_M2YmTddEkMbzS8fzosdPWACNwtowyM3BX0z-mRxDKBu9HATHToz9ih6KI8D9l9U6nixkjmt.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"480\" \/>\n\t<meta property=\"og:image:height\" content=\"360\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fivemor.com\/?p=51548#article\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/?p=51548\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\"},\"headline\":\"Important new Ontario court decision on privilege in incident response documentation\",\"datePublished\":\"2025-01-27T19:27:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=51548\"},\"wordCount\":2168,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=51548#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/01\/AEn0k_t_sNcNJJcKO7NpUin9bYaa_M2YmTddEkMbzS8fzosdPWACNwtowyM3BX0z-mRxDKBu9HATHToz9ih6KI8D9l9U6nixkjmt.jpeg\",\"keywords\":[\"Court\",\"Decision\",\"documentation\",\"Important\",\"Incident\",\"Ontario\",\"privilege\",\"Response\"],\"articleSection\":[\"Legal\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fivemor.com\/?p=51548#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fivemor.com\/?p=51548\",\"url\":\"https:\/\/fivemor.com\/?p=51548\",\"name\":\"Important new Ontario court decision on privilege in incident response documentation - Som2ny Network\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=51548#primaryimage\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=51548#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/01\/AEn0k_t_sNcNJJcKO7NpUin9bYaa_M2YmTddEkMbzS8fzosdPWACNwtowyM3BX0z-mRxDKBu9HATHToz9ih6KI8D9l9U6nixkjmt.jpeg\",\"datePublished\":\"2025-01-27T19:27:14+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fivemor.com\/?p=51548#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fivemor.com\/?p=51548\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/?p=51548#primaryimage\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/01\/AEn0k_t_sNcNJJcKO7NpUin9bYaa_M2YmTddEkMbzS8fzosdPWACNwtowyM3BX0z-mRxDKBu9HATHToz9ih6KI8D9l9U6nixkjmt.jpeg\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/01\/AEn0k_t_sNcNJJcKO7NpUin9bYaa_M2YmTddEkMbzS8fzosdPWACNwtowyM3BX0z-mRxDKBu9HATHToz9ih6KI8D9l9U6nixkjmt.jpeg\",\"width\":480,\"height\":360},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fivemor.com\/?p=51548#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/fivemor.com\/?bp_activities=1\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Important new Ontario court decision on privilege in incident response documentation\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fivemor.com\/#website\",\"url\":\"https:\/\/fivemor.com\/\",\"name\":\"Som2ny Network\",\"description\":\"Daily Deals\",\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fivemor.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/fivemor.com\/#organization\",\"name\":\"Som2ny Network\",\"url\":\"https:\/\/fivemor.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"width\":300,\"height\":86,\"caption\":\"Som2ny Network\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/fivemor.com\"],\"url\":\"https:\/\/fivemor.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Important new Ontario court decision on privilege in incident response documentation - Som2ny Network","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fivemor.com\/?p=51548","og_locale":"en_US","og_type":"article","og_title":"Important new Ontario court decision on privilege in incident response documentation - Som2ny Network","og_description":"The Ontario divisional court has just released a decision,\u00a0LifeLabs LP v. Information and Privacy Commr. (Ontario), 2024 ONSC 2194, that should grab the attention of Canadian lawyers who work in cyber incident response. I don\u2019t know whether it will be appealed, but the logic of the decision is pretty sound. But I expect this isn\u2019t [&hellip;]","og_url":"https:\/\/fivemor.com\/?p=51548","og_site_name":"Som2ny Network","article_published_time":"2025-01-27T19:27:14+00:00","og_image":[{"width":480,"height":360,"url":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/01\/AEn0k_t_sNcNJJcKO7NpUin9bYaa_M2YmTddEkMbzS8fzosdPWACNwtowyM3BX0z-mRxDKBu9HATHToz9ih6KI8D9l9U6nixkjmt.jpeg","type":"image\/jpeg"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fivemor.com\/?p=51548#article","isPartOf":{"@id":"https:\/\/fivemor.com\/?p=51548"},"author":{"name":"admin","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371"},"headline":"Important new Ontario court decision on privilege in incident response documentation","datePublished":"2025-01-27T19:27:14+00:00","mainEntityOfPage":{"@id":"https:\/\/fivemor.com\/?p=51548"},"wordCount":2168,"commentCount":0,"publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"image":{"@id":"https:\/\/fivemor.com\/?p=51548#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/01\/AEn0k_t_sNcNJJcKO7NpUin9bYaa_M2YmTddEkMbzS8fzosdPWACNwtowyM3BX0z-mRxDKBu9HATHToz9ih6KI8D9l9U6nixkjmt.jpeg","keywords":["Court","Decision","documentation","Important","Incident","Ontario","privilege","Response"],"articleSection":["Legal"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fivemor.com\/?p=51548#respond"]}]},{"@type":"WebPage","@id":"https:\/\/fivemor.com\/?p=51548","url":"https:\/\/fivemor.com\/?p=51548","name":"Important new Ontario court decision on privilege in incident response documentation - Som2ny Network","isPartOf":{"@id":"https:\/\/fivemor.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/fivemor.com\/?p=51548#primaryimage"},"image":{"@id":"https:\/\/fivemor.com\/?p=51548#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/01\/AEn0k_t_sNcNJJcKO7NpUin9bYaa_M2YmTddEkMbzS8fzosdPWACNwtowyM3BX0z-mRxDKBu9HATHToz9ih6KI8D9l9U6nixkjmt.jpeg","datePublished":"2025-01-27T19:27:14+00:00","breadcrumb":{"@id":"https:\/\/fivemor.com\/?p=51548#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fivemor.com\/?p=51548"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/?p=51548#primaryimage","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/01\/AEn0k_t_sNcNJJcKO7NpUin9bYaa_M2YmTddEkMbzS8fzosdPWACNwtowyM3BX0z-mRxDKBu9HATHToz9ih6KI8D9l9U6nixkjmt.jpeg","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/01\/AEn0k_t_sNcNJJcKO7NpUin9bYaa_M2YmTddEkMbzS8fzosdPWACNwtowyM3BX0z-mRxDKBu9HATHToz9ih6KI8D9l9U6nixkjmt.jpeg","width":480,"height":360},{"@type":"BreadcrumbList","@id":"https:\/\/fivemor.com\/?p=51548#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/fivemor.com\/?bp_activities=1"},{"@type":"ListItem","position":2,"name":"Important new Ontario court decision on privilege in incident response documentation"}]},{"@type":"WebSite","@id":"https:\/\/fivemor.com\/#website","url":"https:\/\/fivemor.com\/","name":"Som2ny Network","description":"Daily Deals","publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fivemor.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/fivemor.com\/#organization","name":"Som2ny Network","url":"https:\/\/fivemor.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","width":300,"height":86,"caption":"Som2ny Network"},"image":{"@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","caption":"admin"},"sameAs":["https:\/\/fivemor.com"],"url":"https:\/\/fivemor.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/51548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=51548"}],"version-history":[{"count":0,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/51548\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/media\/51549"}],"wp:attachment":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=51548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=51548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=51548"},{"taxonomy":"dealstore","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fdealstore&post=51548"},{"taxonomy":"offerexpiration","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fofferexpiration&post=51548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}