A Privileged Document Has Been Disclosed What Happens Next

INADVERTENTDISCLOSURE · AGUIDEFORUKLAWYERS A Privileged Document Has Been Disclosed: What Happens Next The First Hours, the Legal Framework and the Recovery Playbook for Both Sides COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES INCIDENT RECONSTRUCTION CONTAINMENT & CERTIFIED DELETION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the document that got out 03 The legal framework: CPR 31.20, mistake, obviousness and clawback 04 The disclosing party's playbook: the first hours and the evidence 05 The receiving party's position: duties, dilemmas and safe handling 06 The forensic layer: reconstruction, containment and certified deletion 07 Consequences beyond the document: waiver reach, restraint and representation 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : SPEEDANDEVIDENCEDECIDETHESEINCIDENTS : THE DISCLOSINGPARTYMOVESINHOURSWITHADOCUMENTEDACCOUNTOFTHEMISTAKE ; THERECEIVINGPARTYSTOPSREADINGANDTAKESADVICE ; ANDTHEPROTOCOL DRAFTEDLASTYEARDOESMOSTOFTHEWORK § 0 2 · FIRSTPRINCIPLES The problem in plain English: the document that got out § 0 3 · THEFRAMEWORK The legal framework: CPR 31.20, mistake, obviousness and clawback § 0 4 · THEDISCLOSINGCHAIR The disclosing party's playbook: the first hours and the evidence § 0 5 · THERECEIVINGCHAIR The receiving party's position: duties, dilemmas and safe handling § 0 6 · THETECHNICALLAYER The forensic layer: reconstruction, containment and certified deletion § 0 7 · THEBLASTRADIUS Consequences beyond the document: waiver reach, restraint and representation § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION PRODUCTION ESTATE REVIEW & RECEIVING- RECORDS TELEMETRY PRODUCTION CORRESPONDENCE SPREAD PROTOCOL ARTEFACTS RECORD MAP TERMS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEFRIDAYDISCOVERY , RUNBYTHEBOOK EXAMPLE2 · THERECIPIENTWHOREADON EXAMPLE3 · THECONTESTEDCLAIM , RESOLVEDONTHERECORD § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client (as discloser) Ask your opponent (as recipient, or of a recipient) Ask your eDiscovery / forensic provider SUGGESTEDWORDING · SAME - DAY NOTICEOFINA DV ERTENTDISCLOSURE § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The incident checklist (both chairs) Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Is privilege automatically lost once the document has been produced? We are the recipient and the document looks privileged. Must we really stop reading? What if we genuinely think the document is not privileged, or the mistake was not obvious? How fast does the disclosing party need to move? Can deletion from the opponent's systems ever really be verified? Does one inadvertent disclosure waive privilege over the whole subject matter? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY