Lawyers are entrusted with a great deal of private information about people who are not our clients: other litigants in our cases, non-parties whose records we subpoena, and others who just "show up" in documents or other evidence we receive. Are we obliged to exercise discretion with respect to nonclients' sensitive information?
There is an alphabet soup of federal privacy laws for special purposes or specific types of information, from G-L-B to COPPA, HIPAA to GINA, CLIA to FCRA, and too many others to list, let alone spell out, in this space. These primarily affect financial, health and other regulated organizations. (HealthIT.gov offers a handy chart for health-related federal laws and regulations.) California has its own privacy laws - Article I, Section 1 of our Constitution being the prime example.
Aside from the statutory and regulatory restrictions on revealing certain types of information that apply generally to businesses, do lawyers and law firms have unique obligations to keep mum about nonclients' private information? The California State Bar Association has proposed a detailed set of standards (Proposed Rule of Professional Conduct 1.6) governing when an attorney may reveal his or her client's sensitive information, but it would not extend to nonclients.
Act to Redact
The Federal Rules of Civil Procedure require that court filings be redacted to obscure all but the last four digits of Social Security or tax ID numbers, the names of minors (though initials are permitted), the year of an individual's birth, and the last four digits of a financial account number. There are stated exceptions.
California Rule of Court 1.20requires the same partial redactions of Social Security and financial account numbers, but does not mention other taxpayer IDs. The rule does not require that minors' names be limited to initials.
The redaction rules don't establish a duty of care owed to anyone other than the courts, and, besides, redaction failures may be remedied through the prompt filing of amended papers and stipulations to excise the unredacted versions from the record. When court rules are violated, the courts have a direct method of remedying the lapse. But redaction requirements illustrate the increasing recognition that even in a public justice system, litigants and witnesses expect some information to remain private.
Some Other Privacy Laws
There are other privacy laws on the books that are not based on the confidentiality of sensitive financial or medical information, protection of minors, or thwarting identity theft.
The California Invasion of Privacy Act (CIPA) prohibits the recording of confidential communications - those made in private settings where the speaker reasonably does not expect to be overheard - without the speaker's permission, including cellular phone calls. (Penal Code Sections 630 et seq.) In addition to the threat of jail time for violators, CIPA allows civil remedies of $5,000 per violation without proof of actual harm or treble the amount of actual harm.
Class actions have been brought under CIPA against collection agents who surreptitiously record conversations with debtors. Although $5,000 in statutory damages may not sound like a weighty deterrent, a class action brought on behalf of a thousand unknowing recording stars could result in an eight-figure verdict.
California also recognizes a right of publicity, that is, the right to make commercial use of one's own "name, voice, signature, photograph, or likeness" in any "products, merchandise, or goods, or for purposes of advertising or selling, or soliciting purchases of, products, merchandise, goods or services, without such person's prior consent." Cal. Civil Code Section 3344.
Most of us don't lose much sleep worrying about our images appearing on Wheaties boxes without our permission. If General Mills decided to put my face on the cereal box, I would be entitled under the statute to $750 or my actual damages and profits realized by the company from the use of my image. Fortunately, the statute would not me liable for the steep decline in the sales of Wheaties caused by the unauthorized use of my less-than-Olympian image.
Under California common law there is a much broader right to the use of one's own identity, which is not limited to one's "name, voice," etc. as in the statute. Cases have held that unapproved use of a photo of a well-known racecar that is associated with a particular driver violates the driver's right of publicity. The use need not be commercial nor the plaintiff famous, but those two factors affect whether the case is one of simple public expression - as in First Amendment - or usurpation of another's rights.
If a lawyer takes the video-recorded deposition of a celebrity, and, without permission, posts it on the firm's website to increase visitors, the next lawsuit may be against the lawyer.
It's a Privilege
Lawyers' actions in the course of representing clients are protected by two similar statutes, the anti-SLAPP law (Code of Civil Procedure Section 425.16; SLAPP standing for "Strategic Lawsuit Against Public Participation") and the litigation privilege (Civil Code Section 47 (b)). Do these protections outweigh nonclients' privacy rights? Two unpublished appellate cases illustrate this fact pattern.
In a 2014 decision, the 4th District Court of Appeal considered an attorney who had allegedly misused a defendant's financial information to pressure his sister, also a defendant, into settling a real estate mismanagement case, then continued to assert the case against the brother.
After the brother prevailed he filed a suit for malicious prosecution and abuse of process. The attorney sought dismissal under the anti-SLAPP and litigation privilege statutes. The trial court dismissed the abuse of process claim, finding both statutes to apply, but allowed the malicious prosecution case to proceed because the brother had shown a probability of prevailing on that claim. Both sides appealed.
On appeal the court upheld both rulings. The sister (property manager) effected the transactions under a power of attorney for the property owner. The brother thus had no reason to believe they were unauthorized, and the attorney lacked probable cause to maintain the suit against him. As to abuse of process, the brother asserted that examining his private finances in his deposition violated of his privacy rights under the state constitution, but the court found the "absolute" litigation privilege to apply because the financial questions, though improper, were in the course of a judicial proceeding. Kahn v. Dillon, unpub., D062715 (2014).
The Kahn opinion does not directly address the alleged collateral use of the brother's financial information - to create embarrassment and wring a settlement from the sister, though that use was also in the course of a judicial proceeding.
The second unpublished case, Van Taylor v. Ivie, 2nd District B239275 (2014), arose from a protracted and heated property line dispute between two neighbors. During a court-ordered property inspection, an arborist hired by one party used a telephoto lens to take pictures of the other party in his yard and the contents of his open garage. The aggrieved neighbor sued for invasion of privacy. The case was dismissed, the court finding that the invasion was "not very intrusive" and that the plaintiff had no reasonable expectation of privacy as to the contents of his open garage. Thus, the photos "did not constitute a serious invasion of any privacy interest."
It does not take great imagination to tweak the facts of these cases and conceive of different outcomes. The embarrassing financial information might have been published in social media, or the neighbor might have been sunbathing completely al fresco, so to speak.
The outcomes of privacy cases are less instructive than their existence. These cases had to be defended, in the trial court and on appeal. Time and money were consumed, perhaps needlessly.
Concerns about privacy are growing - ironically, perhaps, as many people freely expose personal information online, ranging from the trivial to the self-incriminating. But that is their choice.
Legal ethics have yet to delineate what lawyers may do outside the litigation context with nonclients' personal information. Until they do, lawyers may avoid privacy lawsuits by applying "golden rule" ethics.