ONTARIO SUPERIOR COURT OF JUSTICE

COURT FILE NO.: FS-21-26180

DATE: 20231204

RE: Stavroula Moran, Applicant

AND:

Roderick Leslie Moran, Respondent

BEFORE: Justice Kraft

Counsel: James Edney and Joseph Slavic, for the Applicant

Heather Hansen and Maureen Edwards, for the Respondent

HEARD: November 30, 2023

ENDORSEMENT

[1] The parties were married for 25 years. They separated 4 years ago, on January 2, 2020. They have 3 adult children, living independently. After the husband discovered that the wife had surreptitiously copied his private computer files, documents, emails and text messages by coming into the matrimonial home with her laptop and downloading his information onto her laptop, he brought this motion. It is agreed that the wife obtained and accessed the husband’s private correspondence with third parties and confidential information without his consent or knowledge. The extent and/or the nature of the husband’s documents the wife has accessed is unknown.

[2] By this motion, the husband seeks to compel the wife to deliver up all computer(s) she used to download his information so a third-party forensic investigator can conduct a full audit of the electronic documents she took from the husband, reviewed, deleted, extracted and/or distributed to her legal team. The goal is to inventory and identify these electronic records so the husband can learn what the wife has accessed. He seeks to choose the forensic investigator who will do this review and an order requiring the wife to pay for it. Finally, he seeks an order restraining the wife from distributing any of the surreptitiously obtained information from his computer to others and to list all the third parties to which she has sent such information.

[3] The husband’s motion was brought on the return date of two motions, which were scheduled to be heard as a long motion on November 30, 2023. The wife’s motion for temporary spousal support, an advance equalization payment and order that the husband answer outstanding disclosure and the husband’s motion for exclusive use of a recreational property, exclusive possession of the Toronto matrimonial home and orders that the wife pay her share of expenses associated with these properties, if the court is inclined to make a temporary spousal support order, were adjourned today on terms, and they will be heard as a long motion in or around March 2024.

Issues to be Determined

[4] The issues I need to decide on this motion are:

a. Which forensic investigator should be chosen to review the wife’s computer to assess the extent of the husband’s electronic documents she accessed surreptitiously and what is the nature and scope of review to be completed by this forensic investigator?

b. Who will pay for the cost of this forensic investigation?

c. Should the wife be restrained from disseminating or distributing any information she obtained from the husband’s computer to any third parties? and

d. Ancillary to (c) above, should the wife be required to produce a list of contacts information for all third parties to which she sent the husband’s electronic data?

Undisputed Background Facts

[5] Typically, when one party makes a claim that another party surreptitiously accessed his/her private and confidential information there is a threshold issue to determine whether on a balance of probabilities there is reason to believe that that allegation is true. After that, the admissibility of surreptitiously obtained evidence must be determined.

[6] In this case, it is agreed that the wife obtained private and confidential information from the husband’s computer in a surreptitious manner. The issue is that a determination cannot be made about the surreptitiously obtained evidence because the husband has no way to know what evidence was taken by the wife.

[7] The husband had a reasonable expectation that his private email and computer files on his computer, kept in the Toronto matrimonial home, where he has been exclusively residing since March of 2021, would be confidential and not subject to prying eyes.

[8] The Toronto matrimonial home is in the wife’s name. However, the evidence on the record is that in March 2021, the wife voluntarily left the Toronto home and the husband has been exclusive residing in that home. There were times when the wife was asked by the husband to come into the home and access certain documents on his computer but those occasions were in 2021.

[9] The parties were each Questioned on November 7, 2023 on the affidavits they filed in support of their long motions, yet to be heard. The husband was Questioned in the morning. During his Questioning, the wife’s counsel put several documents to the husband about which he had no recollection nor had he shared with his counsel. One of these documents was a letter between the husband and a business partner, relating to accounting practices between them in 2015, 5 years before the separation. The wife’s counsel also asked the husband a series of questions about private text messages he had with two of his friends in 2020. It was clear from the documents that they were taken from the husband’s computer or iCloud account and had been exchanged between him and third parties around the time of separation. The wife attached these text messages are Exhibits to her affidavit, filed in support of her motion.

[10] During the wife’s Questioning, the husband’s counsel asked her how she obtained these documents since she was not copied on the correspondence and they were not provided to her by the husband or his counsel. Under oath, the wife admitted the following:

a. She entered the matrimonial home, where the husband resides exclusively, at some point between January and March 2022 (2 years after separation) and made a copy of the husband’s computer. This included copies of private and confidential emails, documents, text messages, etc.

b. She accessed this information on a “network” that the husband had set up in the home, to which she still had access. The husband’s evidence is that there is no such “network” in the house. He believes the wife is either referring to the iCloud network or the “backup” feature on Apple products, which allows a person to obtain or access their computer remotely by accessing a backup copy that had either been automatically or manually saved.

c. She brought her daughter’s old laptop computer, which she had been using as her own computer, into the matrimonial home where the husband had been residing exclusively, at a time when the husband was not home and she did not tell the husband.

d. When she was at the house, the wife copied or downloaded all the information on the husband’s computer onto the laptop she was using, took the laptop home with her, reviewed the documents, deleted some documents, and shared documents with her counsel and litigation team.

e. While she denied looking at any solicitor-client privileged documentation during her Questioning, it is clear that she said she “deleted” this information “because [she]knew…”, presumably meaning that she knew and understood that looking at privileged information was not permitted. Specifically, the wife’s evidence was that she plugged into a network and “did a backup” and that “Macs keep everything, pictures, emails”.

f. In paragraph 18 of her affidavit, sworn on November 27, 2023, the wife stated that “[She] accessed the home network and was able to see [the husband]’s computer. When she saw [the husband]’s computer pop up, she accessed his directory and performed a backup, which had the effect of downloading the files on [the husband]’s computer that were viewable.” The wife goes on to explain that it was commonplace for her to access the husband’s computer via the home network, pull the files she needed including emails during the marriage and even after separation. She justifies doing this by blaming the husband’s actions in the proceedings leaving her with no other option “but to make a copy of his computer/directory through the family network” because he had been deliberately evasive with respect to his financial disclosure. In paragraph 24 of her affidavit, she states, “But for me accessing this information, I would have had no other way of proving it.”

[11] Not only does the wife admit to surreptitiously accessing the husband’s private electronic files and documents from his computer, she blames him for her having to take these steps to do this and is not remorseful about it. The wife disputes accessing the husband’s solicitor-client privileged information. In paragraph 25 of her affidavit, the wife states that she did not read, obtain, or review any emails sent between him and his lawyers. That statement is inconsistent with the answers given during her Questioning, where she said she “deleted” these communications.

[12] The husband is entitled to know what documents the wife took from his computer, what she reviewed, deleted, and shared with her legal team. The wife’s counsel argued that she did not “steal” the documents because a copy remains in the husband’s possession. I do not accept this argument. It is, frankly, disingenuous. The wife clearly copied and accessed the husband’s private and confidential information, downloaded it off his computer, copied it onto her computer so he would not know she had taken his electronic records, read the documents, shared the documents with her legal team, attached it as Exhibits to her affidavit in support of spousal support and then her counsel put some of these documents to the husband during his Questioning.

[13] The question that cannot be answered is what documents the wife accessed and/or shared? A violation of privilege poses a significant threat to the administration of justice. To avert this risk, the courts must act “swiftly and decisively”; Celanese Canada Inc. v Murray Demolition Corp., 2006 SCC 36, [2006] 2 S.C.R. 189, para 34.

[14] Although the wife claims that she did not copy any solicitor and client communication from the husband’s computer, she did acknowledge during his Questioning that she had privileged documents and stated that she deleted them. Without a complete review of the wife’s computer, it is impossible for the husband to know the extent of privileged materials she obtained.

[15] The legal test to decide the appropriate remedy where privileged information is received by an opposing party or its counsel is set out in Celanese and more recently, in Continental Currency Exchange Canada Inc. v. Sprott, 2023 ONCA 61. The Ontario Court of Appeal, set out a three part test for resolving issues of unauthorized access to privileged documents; 2177546 Ontario Inc. v. 2177545 Ontario Inc., 2023 ONCA 693, at para. 11-16:, citing Continental and Celanese,:

a. At the first stage, the moving party (in this case, the husband) must establish that the opposing party (in this case, the wife) obtained access to relevant privileged material. In this case, the wife has acknowledged that she had privileged documents, but states she deleted them. Without the forensic review of what was taken by the wife surreptitiously, it is impossible for the husband to know the extent of privileged materials that she ahs obtained.

b. At the second stage, the risk of significant prejudice is presumed and the husband does not have the onus of proving “the nature of the confidential information” disclosed: Celanese, at paras. 42 and 48. Rather, the wife has the onus to rebut the presumed prejudice flowing from receipt of privileged information: Celanese, at para. 48. The presumption of prejudice can be rebutted by the wife identifying “with some precision” that: (i) she did not review any of the privileged documents in their possession; (ii) she reviewed some documents, but they were not privileged; or (iii) the privileged documents reviewed were nevertheless “not likely [to] be capable of creating prejudice”: Celanese, at para. 53. The evidence must be “clear and convincing” such that “[a] reasonably informed person would be satisfied that no use of confidential information would occur”: MacDonald Estate v. Martin, 1990 32 (SCC), [1990] 3 S.C.R. 1235, at pp. 1260-63; see also, Celanese, at para. 42. “A fortiori undertakings and conclusory statements in affidavits without more” do not suffice:MacDonald Estate, at p. 1263.

c. Where the precise extent of privileged information is unknown and possibly unknowable, the court should infer that confidential information was imparted unless the solicitor has satisfied the court that no information was imparted which could be relevant: MacDonald Estate, at p. 1290. The husband cannot assess what has been taken from him, without a third-party review of the electronic records being conducted. Once a complete review of the computers is undertaken, and depending on the outcomes of that review, the husband may be entitled to seek a stay of proceedings or seek to remove the wife’s legal team. The scope of what was taken by the wife cannot yet be determined. As summarized in Celanese, at paras. 49-51, there are compelling reasons for the presumption of prejudice and the reverse onus on the appellants in receipt of privileged information including:

i. Requiring the husband whose privileged information has been disclosed or accessed to prove actual prejudice would require them to disclose further confidential or privileged materials;

ii. Placing the burden on the wife who has access to the privileged information is consonant with the usual practice that “the party best equipped to discharge a burden is generally required to do so”; and

iii. The husband does not have to bear “the onus of clearing up the problem created by” the wife’s actions.

d. The third stage of the analysis is to fashion an appropriate remedy.

[16] It is only after there is a complete record of the extent of the surreptitiously obtained evidence by the wife, through the forensic audit that the three-part test to determine the admissibility of that evidence can be applied, as set out in in Eizenshtein v. Eisenshtein, 2008 3108 (ONCS).

Issue One: Which forensic investigator should be chosen to review the wife’s computer to assess the extent of the husband’s electronic documents she accessed surreptitiously and what is the nature and scope of review to be completed by this forensic investigator?

[17] The husband seeks to retain ellewood Evidence Inc. (“Ellewood”) in Toronto to conduct the third-party forensic review of the wife’s computer and the electronic records contained on it. Ellewood is a forensic consultancy company that assists with the collection, preservation and analysis of electronic evidence. Once the wife delivers up her computer(s), the husband argues that Ellwood will be able to review the computers, and determine when the wife downloaded the documents, which documents she accessed and when, when she deleted documents and all associated metadata. The wife is opposed to the husband retaining Ellewood because she claims he is somehow connected to someone involved with the company. There is no information on the record about whether the husband is, in fact, connected to Ellewood.

[18] Counsel for the wife confirms that her laptop has been in the possession of his law firm since the Questioning for safekeeping and to ensure that the electronic records were preserved. The wife’s counsel has not looked at any of the documents on the laptop so as to prevent any potential conflict of interest.

[19] The wife did not agree to deliver up the computer during her Questioning when she was asked to give that Undertaking. Instead, she undertook to make best efforts to make production of a complete electronic record of what documents of the husband she removed via the home network at the matrimonial home.

[20] To fulfil that undertaking, the wife has proposed retaining independent counsel, Heuristica Discovery Counsel LLP (“Heuristica”) to assist with the process of producing an electronic record of the files/documents that were copied by her of the husband’s computer. The wife attached an eDiscovery proposal from Heuristica dated November 24, 2023 as Exhibit “G” to her affidavit, sworn on November 27, 2023.

[21] The husband’s counsel acknowledged during the motion that the Heuristica eDiscovery proposal is thorough and appropriate but maintains that the husband should have the choice of who he wishes to conduct this forensic investigation and, further, he submits that the Heuristica eDiscovery proposal is not of the same scope as he seeks set out in his Notice of Motion.

[22] A summary of the Heuristica eDiscovery proposal is as follows:

a. Heuristica will be retained to act as an independent third-party solicitor to collect, process, review and produce the documents to the respective parties.

b. While the wife had access to the Moran home network, she downloaded some of the husband’s emails and documents (which may include privileged and non-privileged information). Heuristica acknowledges that the parties need to understand what documents the wife has, protect the husband’s privilege, and deliver copies of the documents to the husband’s counsel.

c. Heuristica can collect identified folders of documents and email data without the expense or need for a mirror image of the entire laptop, and estimates it can be complete this in about 3-4 hours;

d. The collected data can be processed in RelativityOne, a leading eDiscovery tool. During processing, the data can be deduplicated to decrease the volume of data for hosting and review. It estimates taking 2-4 hours to process this data and set up a database for review.

e. As a neutral third-party solicitor review, they would receive instructions from counsel or the husband regarding the privileged information anticipated, including names of firms, experts, counsel and subject matter of any legal issues beyond the family law litigation.

f. They would receive instructions jointly from counsel regarding the identification of documents relevant to the family law litigation;

g. Counsel for the husband can be provided access to the whole of the database and counsel for the wife can be provided access to documents ultimately considered relevant to the family law litigation, that are not privileged.

[23] The husband has an issue with the scope of the Heuristica eDiscovery process as proposed because he is specifically looking for the forensic review to do the following (as outlined in paragraph 2 of his Notice of Motion):

a. A full review and an inventory of all records on the computer(s) and set out the identity of each record, when each record was created, the file size, when it was reviewed, for how long etc. and that this information is delivered to both counsel;

b. Examine the computer and identify if any records were deleted on or about January 1, 2022, and if so, identify each record, when each record was deleted, when each record was created, the file size, when it was reviewed, for how long, etc. and that this information is delivered to both counsel;

c. Create a mirror image of the wife’s computer and that, if possible, preserve all original metadata; and

d. Identify and extract all of the husband’s data from all computers.

[24] Counsel for the wife argues that this is too far-reaching. Specifically, the wife’s concern is that she has her own documents and files on the laptop in question, and he submits that her privacy must be preserved. Accordingly, creating a mirror image of the wife’s computer and giving the husband access to any information that does not relate to the information the wife stole from him is not appropriate and is a “fishing expedition.”

[25] While it is reasonable for the husband to “choose” the forensic investigator, there was no evidence put forward on the record as to the process Ellewood would engage and/or whether that process would be different from the eDiscovery process put forward by Heuristica. The husband’s counsel acknowledges that the Heuristica proposal is thorough and appropriate but wants to expand the scope of its review.

[26] I find that the proposal put forward by Heuristica is appropriate but that items 2a. 2b. and 2d. set out in the husband’s Notice of Motion ought to be added to its scope.

Issue Two: Who should pay the costs of this Forensic Audit?

[27] In terms of the costs of this process, the husband asks the wife to be responsible and the wife does not agree. The wife is however agreeable to paying for the cost of the Heuristica eDiscovery process.

[28] I find that the wife should pay the upfront costs of the forensic audit by Heuristica, subject to reapportionment at trial.

Issue Three: Should the wife be restrained from disseminating or distributing any information she obtained from the husband’s computer to any third parties?

[29] The husband wants to the wife to be restrained from sending any of his private electronic records to any third parties. The wife submits that a restraining order is not necessary and the husband is “overreaching” by seeking such an order.

[30] Section 46(1) of the Family Law Act, R.S.O. 1990, c.F.3 (“FLA”), provides the court with jurisdiction to make an interim restraining order. While generally restraining orders in family law matters are made against a spouse or former spouse restraining that spouse from having direct or indirect contact with the other spouse, s.46(3) permits the court to make a restraining order that contacts any other provisions that it considers appropriate.

[31] The test for whether a restraining order should be granted under s.46 of the FLA is whether the moving party “has reasonable grounds to fear for his or her own safety or for the safety of any child in his or her lawful custody.” In Khara v. McManus, 2007 CarswellOnt (C.J.), a trial of an application for a restraining order, Dunn, J. stated at para 33, that

When a court grants a restraining order in an applicant's favour, …it is not necessary for a respondent to have actually committed an act, gesture or words of harassment, to justify a restraining order. It is enough if an applicant has a legitimate fear of such acts being committed. An applicant does not have to have an overwhelming fear that could be understood by almost everyone; the standard for granting an order is not that elevated. However, an applicant's fear of harassment must not be entirely subjective, comprehended only by the applicant. A restraining order cannot be issued to forestall every perceived fear of insult or possible harm, without compelling facts. There can be fears of a personal or subjective nature, but they must be related to a respondent's actions or words. A court must be able to connect or associate a respondent's actions or words with an applicant's fears.

[32] The strength of the evidence in support of the restraining order was considered in Callon v. Callon, [1999] O.J. No. 3108 (Div. Court) which was a motion for leave to appeal an order restraining a party from communicating to third parties about the moving party. The court considered the issue of an interim restraining order under s.46 of the FLA. The panel stated that “purpose of s.46 as it relates to interim orders is to permit both litigants the opportunity to conduct their litigation in as reasoned an atmosphere as may be possible.” In P.F. v. S.F., 2011 ONSC 154, McDermot, J. interpreted Callon to mean, “the reason for a restraining order is to provide the litigants with some element of order in the context of difficult and acrimonious litigation.”

[33] The wife’s lawyer argues that the restraining order being sought by the husband is entirely inappropriate and premature.

[34] I do not agree. The record is clear that the wife took these electronic records from the husband’s computer without his consent. She has already demonstrated that she has no difficulty disseminating this information to third parties. Allowing her to continue to distribute the husband’s private electronic records would not be fair in these circumstances, Given that the wife has admitted during her Questioning and in her affidavit that she provided copies of the husband’s electronic record to her lawyers and to accountant, Jim Debresser and his team, the husband is entitled, in the context of this acrimonious litigation, from knowing, at least until the forensic audit is completed, that the wife will be restrained from distributing any of his documents to any third parties.

Issue Four: Should the wife be required to produce a list of contacts information for all third parties to which she sent the husband’s electronic data?

[35] I find that it is reasonable that the wife be ordered to produce a list of all contacts, including their names and contact information to identify the individuals to whom she sent the husband’s electronic records.

ORDER

[36] This court makes the following order:

a. Counsel for the Applicant shall deliver the laptop computer and any other device onto which she copied the Respondent’s electronic documents to Heuristica Discovery Counsel LLP within 24 hours of the release of this Endorsement.

b. The Applicant shall engage Heuristica Discovery Counsel LLP to engage in the proposed eDiscovery process which includes the following:

i. Heuristica will be retained to act as an independent third-party solicitor to collect, process, review and produce the documents to the respective parties.

ii. The purpose of the process is to identify the Respondent’s electronic records that the Applicant downloaded (which may include privileged and non-privileged information) in an effort to both identify what documents the Applicant has, protect the Respondent’s privilege, and deliver copies of the documents to the Respondent’s counsel.

iii. Heuristica shall collect identified folders of documents, texts and email data and process these documents in RelativityOne. During processing, the data can be deduplicated to decrease the volume of data for hosting and review. Heuristic shall then set up a database for review by counsel of both parties.

iv. As a neutral third-party solicitor review, Heuristica shall receive instructions from counsel or the Respondent regarding the privileged information anticipated, including names of firms, experts, counsel and subject matter of any legal issues beyond the family law litigation.

v. Heuristica shall receive instructions jointly from counsel regarding the identification of documents relevant to the family law litigation.

vi. Counsel for the Respondent shall be provided access to the whole of the database and counsel for the Applicant can be provided access to documents ultimately considered relevant to the family law litigation, that are not privileged.

vii. Heuristica shall conduct a full review and an inventory of all records on the Applicant’s computer and set out the identity of each record, when each record was created, the file size, when it was reviewed, for how long, and this information shall be delivered to both parties’ counsel.

viii. Heuristica shall examine the computer and identify if any records were deleted on or after January 1, 2022 and if so, to identify each record, when each record was deleted, when each record was created, the file size, when it was reviewed, for home long and this information shall be delivered to both parties’ counsel.

ix. Heuristica shall identify and extract all of the Respondent’s data from the computer delivered to Heuristica.

c. The Applicant shall pay for the costs incurred by Heuristica related to compliance with this order, without prejudice to either party arguing at trial that these costs shall be reapportioned.

d. The applicant shall, on a temporary basis, be restrained from sharing or distributing any and all documents and information that she obtained surreptitiously.

e. The Applicant shall provide the identity of and contact information (phone number, address or email address) for any individual to whom she provided the documents or information she obtained surreptitiously.

f. The parties shall attempt to reach an agreement on costs. If they are unable to do so, they shall exchange cost submissions in writing, of no more than 3 pages in writing, not including Bills of Costs or Offers to Settle within ten days of the release of this Endorsement. The parties shall serve and file responding costs submissions of no more than 1 page within 5 days of being serving with costs submissions.

M. Kraft, J.

Released: December 4, 2023