LifeLabs Seeks Court Protection to Block Demand by BC’s Privacy Commissioner for Cyberattack Report

LifeLabs Medical Laboratory Services Inc (LifeLabs) filed a petition in British Columbia’s Supreme Court to prevent the Office of the Information and Privacy Commissioner of British Columbia from accessing a report written by CrowdStrike, a cybersecurity firm, in the wake of the LifeLabs hack discovered last October.

The petition asserts that the report was prepared under the direction of legal counsel for the purpose of providing informed legal advice to LifeLabs and should be protected by solicitor-client privilege and litigation privilege. The petition also states that “because the CrowdStrike report is privileged, the commissioner cannot compel its production.”

In the wake of the attacks, a least five class-action lawsuits and a separate civil claim have been launched against LifeLabs. The cyberattack is the largest yet in Canada affecting up to 15 million of LifeLabs’ customers. The hack accessed names, addresses, health-care numbers and, in some cases, lab reports of customers.

The Office of the Information and Privacy Commissioner of Ontario and the Office of the Information and Privacy Commissioner for British Columbia are currently undertaking a coordinated investigation into the LifeLabs cyberattack.

Under the Personal Information Privacy Act (SBC 2003 Chp 63), BC’s Privacy Commissioner has the right to launch investigations and audits into companies to determine whether they acted in compliance with the Act. However, documents developed in the context of a solicitor-client relationship for the dominant purpose of allowing counsel to provide legal advice, including advice rendered in the context of an anticipated litigation, are usually qualified as privileged information and protected from disclosure.

Summary By: Jennifer Davidson