In an earlier post, Company Policy, Personal Emails, and Privilege Protection, I discussed take-aways from a federal-court decision that an employee had no reasonable expectation of privacy—and therefore no privilege protection—for emails sent to her personal attorney on her employer’s email system. But just a few days later, the Oregon Supreme Court issued an opinion in Gollersrud v. LPMC, LLC, No. S069796, 2023 Ore. LEXIS 665 (Dec. 21, 2023), available here, taking a different view.
The court, interpreting Oregon’s rule-based attorney–client privilege (which many states also employ), eschewed any per se rule that emails sent over an employer’s email server lacked the requisite confidentiality. On the contrary, the court held that an employee’s emails with her personal attorney were presumptively confidential and shifted the burden to the employer to make a rather heavy “evidentiary showing” that the emails lacked confidentiality. Let’s discuss the circumstances here and how this privilege may differ depending on whether state or federal privilege law applies.
Subpoena to Third-Party Employer
David Gollersrud and his mother, Inez, sued several defendants, including Salem-based Landmark Professional Mortgage Company, for alleged wrongdoings in their real-estate investment relationship. As part of the discovery process, LPMC issued subpoenas to Mr. Gollersrud’s former employers seeking relevant email communications.
Gollersrud moved to quash these subpoenas claiming that some of the emails sent through his employers’ servers included privileged communications with his personal attorneys. In support, he submitted a declaration that said, in part, this—
I cannot recall all of the email communications I have sent to, received from or which include my mother over the course of almost ten years. However, I expect many of these communications would involve: Communications including privileged communications with attorneys in this case, related cases, and other unrelated family and business legal matters.
Trial Court Ruling, a Second Declaration, and Mandamus
The trial court apparently thought little of Gollersrud’s declaration and motion and ruled that the “communications to be recovered from the employers’ servers are not privileged.” So, Gollersrud sought clarification and an evidentiary hearing, and submitted a much better declaration stating the following—
- None of his employers monitored his email;
- He received no notices that his employers monitored his email;
- No third parties had the right to access the employers’ email servers; and
- His emails on the employers’ servers were password protected.
Importantly, LPMC submitted no countering evidence.
The trial court remained unimpressed and denied Gollersrud’s clarification and hearing requests. So, Gollersud sought relief from the Oregon Supreme Court.
Oregon’s Attorney–Client Privilege
The federal attorney–client privilege remains a creature of common law because Congress in the mid-1970s rejected including a set of privilege rules in the Federal Rule of Evidence. See FRE 501. Common-law application generally requires the privilege proponent to prove a confidential communication within an attorney–client relationship made for legal-advice purposes. And as explained in my prior discussion, many federal courts hold that sending a personal email to your attorney through an employer’s server lacks the requisite confidentiality necessary to sustain the privilege.
But Oregon, like many states, houses its attorney–client privilege within a set of evidence rules. And while Oregon Rule of Evidence 503(2) defines the privilege as covering “confidential communications made for the purpose of facilitating the rendition of professional legal services,” Rule 503(1)(b) specifically defines a “confidential communication” as—
A communication not intended to be disclosed to third persons other than those to whom disclosure is in furtherance of the rendition of professional legal services to the client or those reasonably necessary for the transmission of the communication.
So, does this specifically defined term affect whether a employee’s communication to his attorney through the employer’s email server is sufficiently confidential to remain privileged?
Ruling
Yes, the supreme court said. And here’s why. The court saw its job as one of statutory construction—interpreting the meaning of “confidential communication” in the employer-email setting.
Relying on a marital-privilege decision in State v. Serrano, 210 P.3d 892 (2009), the supreme court interpreted Rule 503(1)(b)’s language “communication not intended to be disclosed to third persons,” which is admittedly “framed in the negative,” as creating a presumption of confidentiality. And with this presumption, the burden shifted to the party seeking the privileged emails, here LPMC, to overcome the confidentiality presumption.
No Per Se Lack of Confidentiality
LPMC instead argued for a blanket, per se rule that renders non-privileged emails sent over an employer’s server because of an inherent lack of confidentiality. The court rejected this approach, finding that Oregon’s privilege rule was “grounded in practicalities and pragmatism” and that a per se no-confidentiality rule “ignores the practical realities of modern life, and it does not reflect how many Oregonians live and work.”
The common practice of telework has brought employer computer systems and employer paid network access into the home, with an accompanying blurring of the lines between private and work communication, and the network infrastructure supporting each.
In other words, “personal and work business is increasingly conducted from devices and accounts that are not clearly delineated.”
And No Proof
Overcoming the confidentiality presumption, according to the court, presents no small task. It must arise from “a particular evidentiary showing” focusing on the context for the communications and the circumstances surrounding them. Importantly, the privilege-busting party “must establish more than a risk that privileged communications might be disclosed.”
And LPMC did not meet the required “particular evidentiary showing. The only evidence in the record was Gollersud’s second declaration attesting—generally—to his understanding of his employers’ various email policies. It does not appear that LPMC deposed the employers to ascertain their policies or whether Gollersrud acknowledged a lack of confidentiality.