Client Confidentiality and Legal Privilege at the Printer

Confidentiality and privilege are usually discussed in terms of email, disclosure exercises and court hearings. The shared copier by the kitchen rarely features. Yet it handles advice letters, counsel’s opinions and witness evidence every working day and a careless moment there can undo protections the firm has worked hard to maintain.

This article explains the professional duty of confidentiality, how it differs from legal professional privilege and why the distinction matters at the point where paper is printed, copied or scanned. It then maps the common risk points around a device and the controls that reduce them. It is general information for practice managers and compliance teams, not legal advice. Questions about whether privilege applies to a particular document or has been lost should go to a suitably qualified lawyer.

The professional duty of confidentiality

Paragraph 6.3 of the SRA Code of Conduct for Solicitors requires solicitors to keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents. The SRA Code of Conduct for Firms places an equivalent duty on the firm itself, together with a wider expectation that firms have effective systems and controls. SRA guidance on confidentiality says clients should be protected from any real risk of their information being disclosed, while accepting that total protection is not possible.

The duty is broad. It covers everything the firm knows about a client’s affairs, whatever the source and whatever the format. A printed engagement letter, a scanned passport and a draft will are all within it. It also continues after the retainer ends. For print that means the duty applies to every page in a tray, every image on a device drive and every sheet in the confidential waste sack.

How legal professional privilege differs

Legal professional privilege is narrower but, where it applies, much stronger. It is a right to withhold certain communications from disclosure, including in court proceedings. In England and Wales it has two main limbs.

• Legal advice privilege. Protects confidential communications between a lawyer and client made for the dominant purpose of giving or receiving legal advice. It does not depend on litigation being in view.
• Litigation privilege. Protects confidential communications between lawyer and client and with third parties, such as experts and witnesses, made for the dominant purpose of litigation that is under way or reasonably in contemplation.

The two are connected. Confidentiality is a precondition of privilege. A communication that is no longer confidential cannot normally attract privilege, which is why careless handling of a privileged document is more than a housekeeping issue.

How privilege can be put at risk

Privilege is not usually lost because a page sat in a tray for ten minutes. The courts look at whether confidentiality has actually been lost and, in litigation, at the circumstances of any disclosure. Even so, careless handling can create arguments the other side may try to use and can turn a simple case into a costly dispute.

Where privileged documents are disclosed by mistake during litigation in England and Wales, CPR 31.20 provides that the receiving party may use them only with the court’s permission. Case law, including Al Fayed v Commissioner of Police of the Metropolis, has developed an obvious mistake test: the court is more likely to grant permission to use a document where it would not have been obvious to a reasonable solicitor that it was disclosed in error. The safest position is never to be relying on that test. Prevention at the point of printing, copying and scanning is far cheaper than an application to court.

Printer risk points in a legal practice

The following points are where client confidentiality and privileged material are most exposed around print, copy and scan equipment.

• The output tray. Uncollected advice letters or witness drafts readable by colleagues on other matters, visitors or contractors.
• The glass and document feeder. Originals left behind after copying, often the most sensitive page of all.
• Scan to email. An auto completed address sends a scanned opinion to the wrong recipient in seconds.
• Shared scan folders. Network folders visible to everyone, including teams behind an information barrier.
• Device storage. Hard drives and memory holding images of documents long after they were printed.
• Bundle and disclosure production. Privileged material copied into a bundle or disclosure set by mistake during a rushed print run.
• Home and third party printing. Papers printed at home or sent to an outside print bureau without agreed handling terms.
• Disposal. Spoilt copies in ordinary recycling and devices returned without a certified wipe.

Controls that close the gaps

Most of these risks have a straightforward technical or procedural answer. A managed print service should deliver the technical side and support the procedures.

1. Hold every job until the owner is present. Secure release removes the tray as a risk point for everyday printing.
2. Lock down scan destinations. Limit scan to email to the user’s own address and send matter scans straight into the DMS rather than open folders.
3. Respect information barriers. Mirror DMS permissions in scan workflows so teams cannot see each other’s material.
4. Prompt for originals. Devices can display a reminder to remove originals and some models sense a page left on the glass.
5. Encrypt and wipe. Use encrypted drives, automatic overwrite of job data and a certificate of data destruction at removal.
6. Check bundles before release. Build a privilege check into bundle and disclosure workflows before any large print run is sent out.
7. Keep logs. Print and scan logs help the firm understand what happened if a concern is ever raised.
8. Train and remind. Short, regular reminders about the copier glass and scan addresses do more than an annual policy email.

Litigation teams face particular pressure during bundle deadlines. Our guide on Secure Printing for Court Bundles and Case Files looks at controls for large print runs and reprographics rooms.

Putting it into your compliance framework

Print controls should appear in the same places as other confidentiality controls: the risk register, the information security policy, induction training and supplier due diligence. A COLP reviewing arrangements should be able to see which devices exist, how they are secured and what happens to their data at end of life. The print provider should support that with a written data processing agreement, security settings documentation and wipe certificates. If you would like to review those controls with a specialist, our Managed Print Services for Legal Firms page explains how CopyBox Document Systems works with legal practices.

For further articles on security, compliance and day to day print management, visit the Legal Firm MPS Guidance collection.

Protecting confidentiality and privilege at the printer takes a few well chosen controls and consistent habits. To review yours, visit our Managed Print Services for Legal Firms page or call our Bedford team. This article is general information and not legal advice.