Page 1
INADVERTENTDISCLOSURE · A GUIDE FOR UK LAWYERS A Privileged Document Has Been Disclosed: What Happens Next The First Hours, the Legal Framework and the Recovery Playbook for Both Sides COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES INCIDENT RECONSTRUCTION CONTAINMENT & CERTIFIED DELETION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the document that got out 03 The legal framework: CPR 31.20, mistake, obviousness and clawback 04 The disclosing party's playbook: the first hours and the evidence 05 The receiving party's position: duties, dilemmas and safe handling 06 The forensic layer: reconstruction, containment and certified deletion 07 Consequences beyond the document: waiver reach, restraint and representation 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: SPEEDANDEVIDENCEDECIDETHESEINCIDENTS: THE DISCLOSINGPARTYMOVESINHOURSWITHADOCUMENTEDACCOUNTOFTHEMISTAKE; THERECEIVINGPARTYSTOPSREADINGANDTAKESADVICE; AND THE PROTOCOL DRAFTEDLASTYEARDOESMOSTOFTHEWORK
§ 02 · FIRST PRINCIPLES The problem in plain English: the document that got out
§ 03 · THE FRAMEWORK The legal framework: CPR 31.20, mistake, obviousness and clawback
Page 2
§ 04 · THEDISCLOSINGCHAIR The disclosing party's playbook: the first hours and the evidence
§ 05 · THERECEIVINGCHAIR The receiving party's position: duties, dilemmas and safe handling
§ 06 · THETECHNICALLAYER The forensic layer: reconstruction, containment and certified deletion
§ 07 · THEBLASTRADIUS Consequences beyond the document: waiver reach, restraint and representation
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION PRODUCTION ESTATE REVIEW & RECEIVING- RECORDS TELEMETRY PRODUCTION CORRESPONDENCE SPREAD PROTOCOL ARTEFACTS RECORD MAP TERMS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEFRIDAYDISCOVERY, RUNBYTHEBOOK EXAMPLE2 · THERECIPIENTWHOREADON EXAMPLE3 · THECONTESTEDCLAIM, RESOLVEDONTHERECORD
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client (as discloser) Ask your opponent (as recipient, or of a recipient) Ask your e Discovery / forensic provider SUGGESTED WORDING · SAME - DAY NOTICEOFINA DV ERTENTDISCLOSURE
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The incident checklist (both chairs) Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Is privilege automatically lost once the document has been produced? We are the recipient and the document looks privileged. Must we really stop reading? What if we genuinely think the document is not privileged, or the mistake was not obvious? How fast does the disclosing party need to move? Can deletion from the opponent's systems ever really be verified? Does one inadvertent disclosure waive privilege over the whole subject matter?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, A Privileged Document Has Been Disclosed What Happens Next, Computer Forensics Lab, https://e-discovery.uk/library/a-privileged-document-has-been-disclosed-what-happens-next/pdf.