Best Practices to Maintain Confidentiality and Privilege Over Videoconference

Here are some best practices to ensure that trade secrets or privileged information discussed via videoconference remains protected.

In the new work-from-home world, videoconferencing is rapidly gaining in popularity. For example, within the first two weeks, daily usage of Zoom Videoconferencing Communication, Inc.’s software reportedly grew by over 300%. (Emily Barry, MarketWatch [Mar. 30, 2020]).  Corporate and non-corporate Americans alike now routinely host “Zoom Meetings” and even “Zoom Cocktail Parties.” And, were there any doubt that many are still on the steep learning curve of ubiquitous conference-call etiquette, one need only look to a recent SNL skit for confirmation. Or at the recent headline-making story about a Good Morning America reporter who broadcast from home—without pants.

For better or worse, while videoconferences replicate many qualities of face-to-face interactions, they also have key differences: When attending a live meeting, it is easy to know and control who is present, who hears the discussion, whether the meeting is recorded, what written materials are distributed, and whether anyone takes notes. By contrast, videoconferences are mediated through complicated technology with hidden settings and rely on cameras allowing only a partial view of participants. For casual conversations, this may be unproblematic. But it has potentially huge implications for trade secrets and privileged communications.

Trade secrets and attorney-client privileged communications both require careful control over their audience. A trade secret’s owner must take reasonable steps to protect its confidentiality—which typically involves limiting the number of people who may access it and controlling what recipients do with it—or risk losing protection. See, e.g., Brain Injury Ass’n of California v. Yari, No. CV 19-5912-MWF (JCX), 2019 WL 4544419, at *4 (C.D. Cal. Aug. 9, 2019). And privileged information may only be shared with recipients who share a privileged relationship or that protection is lost. See, e.g., Cal. Evid. Code. §952. For corporations, the persons who share a privileged relationship are generally the corporation’s lawyers plus officers, directors, managers, and personnel involved in the privileged matter in the scope of their employment.  See D. I. Chadbourne v. Superior Court of City & Cty. of San Francisco, 60 Cal. 2d 723, 736–37 (1964).

Thus, to maintain trade secret or privilege protection, a company must carefully control the audience that receives protected information. Videoconferences complicate this in some obvious ways: They are accessed via online invites that can often be forwarded, participants can take written notes without the organizer’s knowledge, and participants may join from environments that are not private (including spaces within others’ earshot). Videoconferences have other, less obvious pitfalls: Meetings may be hacked by non-invitees who guess the meeting number (e.g., “Zoombombing”), videoconference platforms may automatically record or transcribe meetings, videoconference platforms may require participants to opt in to security features like private meeting spaces and encryption, and participants may be able to use other devices or screen-capture technologies to record aspects of the meeting without the host’s knowledge. This creates potential for privacy breaches due to intentional misdeeds and unintentional mistakes even from social videoconferences, made even more possible by the fact that many work-from-home spaces double as a dining or living room.

Below are some best practices to ensure trade secret or privileged information discussed via videoconference maintains its protection:

• Investigate each videoconference platform’s security features and purchase the level of service that has the desired/necessary security features;
• Check security settings, enable encryption and any available privacy controls (especially those limiting who can join the conference), and ensure that default settings are set by company management;
• Check each videoconference platform’s recording features and disable recording or ensure that recording is on a company-controlled server. Inform participants if the videoconference will be recorded;
• Instruct employees not to forward videoconference invites without the host’s permission (or restrict forwarding, if possible);
• Provide written policies and periodic reminders requiring employees to keep videoconferences private from other household residents by using (a) a private room; (b) headphones; and/or (c) privacy shields for screens;
• Check whether the videoconference platform automatically creates transcripts and either disable that feature or set policies controlling who may access the transcript and how it is used. Inform participants of any transcription;
• If a trade secret will be discussed, ensure the only participants in the videoconference are those who (a) are bound to keep the secret confidential (such as employees who have signed an NDA) and (b) are those who reasonably need access to the trade secret;
• If privileged information will be discussed or shown, ensure the only participants are those who share a privileged relationship (plus at least one lawyer who actively participates). As noted, for a corporation, privileged persons typically include officers, directors, managers, and the personnel involved in the privileged matter in the scope of their employment;
• Provide written policies and periodic reminders regarding the recording in any way of videoconferences, including the use of screen capture tools, cameras, and microphone-equipped electronic devices to record the videoconference;
• Provide written policies and periodic reminders informing employees about proper handling of videoconference notes, including limiting access to handwritten notes and shredding notes that contain trade secret or privileged information;
• Train employees and provide periodic reminders to ensure that privileged or trade secret documents are not visible to others on videoconferences, including on after-hours social videoconferences—which may occur in the employee’s work-from-home space.
• These are unprecedented times and there are no set rules for what constitutes “reasonable” steps, but implementing some simple steps can help protect confidentiality, and ensure employees participating in videoconferences understand the pertinent risks and appropriate behavior to avoid them.