Involvement of lawyers in incident response investigations is not enough to make the findings privileged

On April 30, 2024, the Ontario Divisional Court decided the victim of a serious cyber security incident was required to produce to privacy regulators numerous records created in the course of a cyber security incident investigation and response – despite the victim’s vigorous claims of privilege. The Court’s decision in LifeLabs LP v. Information and Privacy Commr. (Ontario) serves as a reminder: you can’t throw a blanket of privilege over everything associated with incident response by simply involving lawyers. It should cause lawyers who practice in the space to consider what steps they can take to protect their clients’ confidentiality. 

Read more here.