Legal Issues Related to Developing Safety Management Systems and Safety Risk Management at U.S. Airports (2013)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

28 that evidenced PANYNJ’s exercise of police power in- cluded its constant communication with federal and state police agencies, involvement of law enforcement personnel in internal investigations, commission of se- curity reports to identify vulnerabilities, and procure- ment of expert security recommendations.283 In re- sponse to those reports, the PANYNJ’s top security officials met with law enforcement personnel to assess safety at the WTC, including safety within the parking garage.284 Second, the Court of Appeals found PANYNJ’s secu- rity decision-making to be discretionary because the determinations its officials made regarding the alloca- tion of police resources “involve[d] reasoned considera- tion of varying alternatives.”285 For example, the offi- cials rated different locations at the WTC as low- or high-risk for the possibility of terrorist attacks or de- struction to property and human life.286 They also “weighed the costs, benefits, and feasibility of various recommendations” before concluding what security measures to implement.287 As a matter of policy, the Court continued, “to expose the Port Authority to liabil- ity because in the clarity of hindsight its discretionary determinations resulted in harm would engender a chilling effect on government and dissuade public enti- ties from investigating security threats and exercising their discretion.”288 The courts in both WTC III and WTC IV relied on Miller v. State of New York to provide the legal stan- dard for the dichotomy between a governmental entity’s proprietary and governmental responsibilities: A governmental entity’s conduct may fall along a contin- uum of responsibility to individuals and society deriving from its governmental and proprietary functions. This begins with the simplest matters directly concerning a piece of property for which the entity acting as landlord has a certain duty of care, for example, the repair of steps or the maintenance of doors in an apartment building. The spectrum extends gradually out to more complex measures of safety and security for a greater area and populace, whereupon the actions increasingly, and at a certain point only, involve governmental functions, for ex- ample, the maintenance of general police and fire protec- tion. Consequently, any issue relating to the safety or se- curity of an individual claimant must be carefully scrutinized to determine the point along the continuum tiffs seek to hold the Port Authority liable stem directly from its failure to allocate police resources as these failures lie, not within the safety measures that a reasonable landowner would implement, but within security operations featuring extensive counterterrorism planning and investigation that required dis- cretionary decision-making with respect to the strategic alloca- tion of police resources. 283 Id. at 747. 284 Id. 285 Id. at 749. 286 Id. 287 Id. at 750. 288 Id. that the State’s alleged negligent action falls into, either a proprietary or governmental category.289 To determine in which role PANYNJ acted, the New York courts in the WTC cases focused on “the specific act or omission out of which the plaintiffs’ injuries are claimed to have arisen, and the capacity in which that act, or failure to act, occurred.”290 In jurisdictions where governmental immunity is recognized, the Court of Appeals’ reasoning may be transferrable to the SMS context. To craft a successful defense of governmental immunity, an airport operator would need to assert that the specific acts that allegedly caused tortious injury were part and parcel of the op- erator’s exercise of a governmental function. Second, the airport operator would need to prove that those acts were discretionary in nature. Similar to PANYNJ’s se- curity operations at the WTC, airport operators’ imple- mentation of SMS will “feature[] policy-based decision- making involving due consideration of pertinent factors such as the risk of harm, and the costs and benefits of pursuing a particular allocation of resources.”291 How- ever, each time a public entity is accused of tort liability and asserts the defense of governmental immunity, the courts will be required to inquire into the governmental nature of each of the entity’s alleged “precise fail- ures.”292 This individualized inquiry will make predict- ability for airport operators in ascertaining which of their failures can be defended with governmental im- munity (and which cannot) difficult to achieve, as the determination of what risks are “acceptable” to an air- port operator will inherently be a policy-based decision involving consideration of factors such as the risk of harm and the costs and benefits of pursuing a particu- lar allocation of resources that may be the subject of second-guessing by plaintiffs and their attorneys. VII. DATA PROTECTION AND SMS Because most Part 139 airport operators are state or local governmental entities, the vast majority of com- mercial service airports in the United States must dis- close most information (including safety information) held by those airport operators upon request. As dis- cussed below, state sunshine laws and FOIA generally mandate that all information, data, documents, and other materials (collectively, “information”) held by a governmental entity be disclosed upon request, unless such information falls within one of a very few statuto- rily enumerated exceptions.293 State sunshine laws are 289 Miller v. State of New York, 62 N.Y.2d 506, 467 N.E.2d 493 (1984); see, e.g., WTC IV, 957 N.E.2d at 744–45 (quoting Miller, 467 N.E.2d at 496). 290 WTC III, 776 N.Y.S.2d at 732 (citing Miller, 467 N.E.2d at 497). 291 See WTC IV, 957 N.E.2d at 747. 292 See id. at 745. 293 See, e.g., 5 U.S.C. § 552(a)(3)(A) …except as provided in subparagraph (E), [relating to intelli- gence agencies] each agency, upon request for records which (i)

29 modeled on the Federal FOIA, although each state’s act differs in certain particulars. In general, aviation safety information is not an exception to disclosure under state sunshine laws, other than certain limited statuto- rily created exceptions. Thus, it is likely that the safety data gathered by Part 139 airports will be disclosable upon request. One strategy, discussed in more detail below and in Section VIII below, is to “de-identify” cer- tain aspects of the data collected before it is recorded, so that the records maintained by the airport operator do not contain certain information, such as the name of the person reporting an incident or the identities of the en- tities involved in an incident. Thus, although the de- identified data must be disclosed upon request, it would not contain certain deleted identifying information. It should be noted that as part of the recently adopted FAA Modernization and Reform Act of 2012, Congress expanded the scope of aviation safety data exempt from disclosure under Federal FOIA to include “reports, data, or other information produced or col- lected for purposes of developing and implementing a safety management system acceptable to the Adminis- trator [of the FAA].”294 This broad exception evidences a congressional intent and understanding that the protec- tion of aviation safety data from disclosure will promote a more vigorous gathering and submission of such data. The exception has limitations, however, as the new pro- tections only apply to data or other information that is submitted to the FAA voluntarily and that is not re- quired to be submitted to the FAA under any other pro- vision of law. Moreover, these provisions only apply to the Federal FOIA, not to the various cognate state sun- shine laws.295 As discussed, where data provided is held in confi- dence, reporting is improved.296 The success of the reasonably describes such records and (ii) is made in accordance with published rules stating the time, place, fees (if any), and procedures to be followed, shall make the records available to any person.” (emphasis added). Section 552(b) goes on to state that § 552 does not apply to matters that are listed under nine separate listed exceptions, most of which are narrowly drawn, including matters that are “specifically exempted from disclosure by statute…provided that such statute (A) requires that the mat- ters be withheld from the public in such a manner as to leave no discretion on the issue, or (B) establishes particular criteria for withholding or refers to particular types of matters to be withheld.” (§ 552(b)(3)). Safety information in general is not a specific exception to the federal FOIA, but § 40123 provides for exceptions to FOIA. 294 FAA Modernization and Reform Act of 2012, § 310(a), Pub. L. No. 112-95, 126 Stat. 11 (Feb. 14, 2012) (adding new 49 U.S.C. § 44735; see § 44735(b)(4)). 295 49 U.S.C. § 44735(a). Note that the Proposed Rule does not require airport operators to submit safety data directly to the FAA. 296 See, e.g., Werfelman, supra note 52 (“the majority of the information on which such [safety] enhancements now depend would not surface at all if not voluntarily disclosed.” Quoting Independent Review Team, Managing Risks in Civil Aviation: A Review of the FAA’s Approach to Safety, Sept. 2, 2008); Id. at ASAP and ASRS programs, through which safety data are not subject to public disclosure and are de-identified before being used, amply demonstrate that reporting increases significantly where data are held in confi- dence. Furthermore, the requirement that public air- port operators provide information on request pursuant to state sunshine laws significantly inhibits most pri- vate entities from participation in a voluntary program of self reporting safety-related information to such air- port operators. Thus, safety data gathered by airport tenants, such as air carriers and ground handlers, are not likely to be made available to an airport operator absent protection from mandatory disclosure of such data under state sunshine laws. As described above, in Canada, where most large airports are owned and oper- ated by private entities, safety data are more readily shared by tenants. Thus, Canadian safety analysis has the opportunity to review a much greater scope of data for trends. By stripping out, or de-identifying, certain data that identify the person reporting a hazard or incident or the entities that may have been involved in an incident before such data are recorded in an airport operator’s records, an airport operator may be able to encourage more reporting. As discussed in more detail below, in- formation held by a governmental entity, including air- port operators, is presumed to be a public record and disclosable. However, where data-gathering processes are established in a manner so that certain identifying data are not recorded, that information will not be dis- closable. The disadvantage of this approach, though, is that because such data are not recorded, follow-up with the person reporting and trend analysis showing recur- ring incidents by the same entity can be difficult. Set forth below is an examination of both Federal FOIA and the public records or sunshine laws in three states: Massachusetts, California, and Florida. In gen- eral, the laws are similar and provide a presumption that data held by a governmental entity will be made available to the public upon request, unless such data are subject to a specific exception. Certain exceptions that may apply to aviation safety data are examined. In addition, certain privileges such as the public interest privilege, a qualified privilege for safety data under federal common law, and the attorney-client privilege are examined to determine if certain aviation safety data may be exempted from disclosure under state or federal public records laws. Other states, however, may provide for broader ex- ceptions to disclosure that may permit airport operators to protect safety-related data under certain circum- stances. For example, the Wisconsin Open Records Act excludes drafts, notes, preliminary computations, and like materials from the definition of “records” subject to 43 (“The [Flight Safety] Foundation and others have estimated that about 98 percent of the safety information obtained from voluntary disclosure programs would no longer be available if participants were subject to prosecution and penalties.”).

30 the disclosure requirements of the Act.297 Further, Wis- consin’s law has been interpreted to permit custodians of public records to withhold such records under a bal- ancing test where the custodian determines that the disclosure would potentially be more harmful than the presumed benefit of public openness.298 One factor in such a balancing test is an exception to disclosure un- der Federal FOIA.299 Thus, the recent congressional action protecting SMS data from disclosure under FOIA may provide an argument under Wisconsin law for pre- venting disclosure of such safety data under the Wis- consin Open Records Act. Note, however, that most state sunshine laws provide a presumption that public records should be disclosed, and exceptions to disclosure are generally narrowly interpreted. Airport operators will need to be familiar with the provisions of and ex- ceptions to the sunshine law applicable to their jurisdic- tion. A. FOIA and State Sunshine Laws 1. Federal FOIA The Federal FOIA requires that, with certain speci- fied exceptions, each federal agency, “upon request for records which (i) reasonably describes such records and (ii) is made in accordance with published rules stating the time, place, fees (if any), and procedures to be fol- lowed, shall make the records available to any per- son.”300 FOIA presumes that public records held by a federal agency will be made public, absent a specified exception. Thus, safety data provided to the FAA will be made public upon request, absent a specified exception. Congress enacted legislation (Section 40123) that protects certain voluntarily-submitted aviation safety- or security-related information from disclosure.301 The FAA has implemented Section 40123 through regula- tions.302 Under those regulations, FAA has adopted sev- 297 See WIS. STAT. 19.32(2) (definition of “Record”). 298 See Public Records Law, WIS. STAT. §§ 19.31–19.39, Compliance Outline Aug. 2007, Department of Justice, Attor- ney General Report 28, http://www.doj.state.wi.us/AWP/ 2007OMCG-PRO/2007_PR_Outline.pdf. 299 Id. 300 5 U.S.C. § 552(a)(3)(A). 301 See 49 U.S.C. § 40123(a), Notwithstanding any other provision of law, neither the Ad- ministrator of the Federal Aviation Administration, nor any agency receiving information from the Administrator, shall dis- close voluntarily-provided safety or security related information if the Administrator finds that—(1) the disclosure of the infor- mation would inhibit the voluntary provision of that type of in- formation and that the receipt of that type of information aids in fulfilling the Administrator’s safety and security responsibili- ties; and (2) withholding such information from disclosure would be consistent with the Administrator’s safety and security re- sponsibilities. 302 See 14 C.F.R. pt. 193 (Protection of Voluntarily Submit- ted Information). eral safety programs, notably including ASAP,303 for air carriers and their employees. As described above, in the most recent FAA reauthorization act, Congress ex- panded the scope of Section 40123 to exclude a wide variety of voluntarily-provided aviation safety informa- tion from disclosure under FOIA, including “reports, data, or other information produced or collected for pur- poses of developing and implementing a safety man- agement system acceptable to the Administrator [of the FAA].”304 Given both the fact that the Proposed Rule does not require data to be provided to the FAA and that the scope of the exception to FOIA for aviation safety data was recently expanded by Congress, the implementa- tion of SMS by Part 139 airports is unlikely to be af- fected by FOIA. 2. Massachusetts Public Records Law The Massachusetts law regarding public inspection and copies of records is codified at Massachusetts Gen- eral Laws ch. 66, Section 10 (2012) (Public Records Law), with associated regulations located at 950 Massa- chusetts Code of Regulations 32.00–32.09 (2012). The Public Records Law only applies to governmental enti- ties, and the burden lies on each entity to show that the Public Records Law does not apply.305 Under the Public Records Law, any person with custody of public records must permit any segregable portion of an independent public record to be inspected and examined by any one person, under the custodian’s supervision, and must furnish a copy of the record for a reasonable fee.306 Any- one who requests records under the Public Records Law must pay the actual expenses of any search the custo- dian performs of the public records.307 The custodian must comply with or deny a request within 10 days fol- lowing receipt of the request.308 Custodians may not require proof of the requester’s identity or require the requester to disclose the reasons for which it seeks access to the records.309 Therefore, if a record is public, unless an exemption applies, the re- 303 See FAA Order 8000.82 Designation of Aviation Safety Action Program (ASAP) Information as Protected from Public Disclosure Under 14 CFR Part 193 (Sept. 3, 2003) (“Order 8000.82”). 304 FAA Modernization and Reform Act of 2012, § 310(a), Pub. L. No. 112-95, 126 Stat. 11 (Feb. 14, 2012) (adding new 49 U.S.C. § 44735; see § 44735(b)(4)). 305 A GUIDE TO THE MASSACHUSETTS PUBLIC RECORDS LAW 5, www.sec.state.ma.us/pre/prepdf/guide.pdf (hereinafter, “GUIDE”); see 950 MASS. CODE REGS. 32.03 (defining govern- mental entity as “any authority established by the General Court to serve a public purpose, any department, office, com- mission, committee, council, board, division, bureau, or other agency within the Executive Branch of the Commonwealth, or within a political subdivision of the Commonwealth”). 306 MASS. GEN. LAWS ch. 66, § 10(a). 307 Id. at 32.08(1). 308 Id. at 10(b). 309 950 MASS. CODE REGS. 32.05(5).

31 quest for the record must be honored—even if made for a commercial purpose or to assist the requester in a lawsuit against the record holder.310 If the custodian denies a request for any portion of records that are not public, he or she must make such denial in writing, setting forth the reasons for the de- nial, and specifically identifying the exemption in the definition of public records upon which the denial is based. The custodian’s failure to make written response within 10 days is deemed a denial.311 Requests for re- cords may be made orally or in writing, but if denied, only requests submitted in writing can be appealed to the Supervisor of Records.312 Public records are broadly defined in Massachusetts as: …all books, papers, maps, photographs, recorded tapes, financial statements, statistical tabulations, or other documentary materials or data, regardless of physical form or characteristics, made or received by any office or employee of any agency, executive office, department, board, commission, bureau, division or authority of the commonwealth, or of any political subdivision thereof, or of any authority established by the general court to serve a public purpose….313 Certain materials and data are exempt from this definition, including: (a) [those] specifically or by necessary implication ex- empted from disclosure by statute;…. (d) inter-agency or intra-agency memoranda or letters re- lating to policy positions being developed by the agency; but this subclause shall not apply to reasonably com- pleted factual studies or reports on which the develop- ment of such policy positions has been or may be based;…[and] (n) records including, but not limited to, blue prints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons, buildings, structures, facilities, utilities, transportation or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the custodian, sub- ject to review by the supervisor of public records under subsection (b) of section 10 of chapter 66, is likely to jeop- ardize public safety.314 These three exemptions are those most likely to have bearing on the public records airport operators create pursuant to SMS requirements, as discussed below. a. Statutory Exemption—(26)(a).—Currently no Mas- sachusetts statute specifically exempts records created pursuant to SMS from disclosure under the Public Re- cords Law, so this narrow exemption would not cur- rently apply. However, the recent federal exemption of 310 GUIDE at 7. 311 Id. 312 Id. at 32.05(3), 32.08(2). 313 MASS. GEN. LAWS ch. 4, § 7(26) (2012). 314 Id. SMS data from FOIA may allow an argument that Massachusetts state law should follow the federal lead. b. Policy-Making Exemption—(26)(d).—Also known as the Deliberative Process Privilege, this exemption was included in the Public Records Law instead of and as a rejection of the broader attorney work product privilege.315 The purpose of exemption (26)(d) is “to fos- ter independent discussions between those responsible for a governmental decision in order to secure the qual- ity of the decision.”316 If used to protect SMS data, this exemption would only apply to memoranda or correspondence reflecting policy deliberations occurring before an airport operator takes a specific policy position regarding SMS risks. Therefore, the exemption could potentially be used to protect memoranda and letters used by the airport op- erator in developing its SMS program. However, the final program, including decisions and actions taken regarding mitigation, would likely not be exempted from disclosure. In addition, the underlying factual studies and reports—those that collected information and identified risks—would likely not be exempted and would therefore be subject to disclosure. c. Public Safety Exemption—(26)(n).—Exemption (26)(n) was added in response to the events of Septem- ber 11, 2001.317 It is intended to secure the safety of persons and public places by restricting access to re- cords that may have been previously open to public in- spection.318 This exemption affects only public build- ings, public transportation, and public areas.319 The public safety exemption does not allow records custodi- ans to reject outright all requests for the exempt docu- ments; rather, it gives a custodian the right to ask a requester to voluntarily provide information about him- self or herself and the reason for the request.320 The custodian is still prohibited from requiring that the re- quester provide this additional information.321 A custodian may deny a public records request under the public safety exception because in his or her “rea- sonable judgment” the disclosure of the requested re- cords “is likely to jeopardize public safety.”322 Such a denial, which must be in writing and must articulate with specificity the reasons for denial, must also clearly address the factors surrounding the custodian’s “rea- sonable judgment” and why the custodian believes that access to the requested records is “likely to be used” to 315 Suffolk Constr. Co. v. Div. of Capital Asset Mgmt., 449 Mass. 444, 457, 870 N.E.2d 33, 43–44 (2007). 316 Gen’l Elec. Co. v. Dep’t of Envtl. Protec., 429 Mass. 798, 807, 711 N.E.2d 589, 595 (1999). 317 Supervisor of Public Records, SPR Bulletin No. 04-03 (Apr. 1, 2003), http://www.sec.state.ma.us/arc/arcrmu/rmubul/ bul403.htm. 318 Id. 319 Id. 320 Id. at Action 5. 321 Id. 322 MASS. GEN. LAWS ch. 4, § 7(26)(n).

32 jeopardize public safety.323 If the requester provides additional information in response to a denial showing why the public safety would not be in jeopardy, the cus- todian may reverse the initial denial and grant access to the records.324 d. Protective Orders Can Protect Documents from Public Records Law.—The Massachusetts Supreme Judicial Court has ruled that the Public Records Law does not abrogate judicial protective orders.325 Because the Public Records Law is silent as to protective orders, the Court upheld this “long-standing and fundamental power of the judiciary.”326 Judges may permit interven- tion if a records requester—who is otherwise unin- volved in the litigation in which the protective order was issued—wishes to challenge the order.327 Permis- sive intervention need not be granted in every case where a third party intervenes for this purpose. Rather, a judge may consider factors such as “a party’s delay in seeking intervention (and the circumstances of such delay), the number of intervention requests or likely intervention requests, the adequacy of representation of the intervening party’s interests, and other similar fac- tors.”328 If the judge grants permissive intervention, the re- quester may challenge whether the materials he seeks are validly covered by the standing protective order.329 The judge undertakes the same inquiry as he or she would into whether to issue a protective order, but as- sessed at the time of intervention.330 The judge may therefore consider changed circumstances that may render certain materials no longer validly protected (e.g., material is no longer a trade secret) and consid- eration of a party’s reasonable reliance on the order in producing information it would not otherwise have dis- closed.331 3. California Public Records Act The California Public Records Act (CPRA)332 is simi- lar to the Massachusetts Public Records Law and gen- erally presumes that public records will be made avail- able upon request. Each agency covered by the CPRA must respond to a request for a copy of records within 10 days of receipt of the request, and must make any reasonably segregable portion of a record available for inspection after deleting the portions exempted by law or make a copy of the records available upon payment of 323 SPR Bulletin No. 04-03, at Action 6-7. 324 Id. at Action 5. 325 Commonwealth v. Fremont Investment & Loan, 459 Mass. 209, 220, 944 N.E.2d 1019, 1027 (2011) 326 Id. at 1024. 327 Id. at 1026. 328 Id. 329 Id. at 1027. 330 Id. 331 Id. 332 Codified at CAL. GOV’T CODE §§ 6250–6276.48 (West 2012). fees.333 Access to records may not be limited based on the purpose of the request alone.334 If an agency denies a written request for inspection or copies, in whole or in part, the denial must be in writing.335 The CPRA defines public records to include “any writing containing information relating to the conduct of the public’s business prepared, owned, used, or re- tained by any state or local agency regardless of physi- cal form or characteristics.”336 Under the CPRA, “writ- ing” is defined as: any handwriting, typewriting, printing, photostating, photographing, photocopying, transmitting by electronic mail or facsimile, and every other means of recording upon any tangible thing any form of communication or representation, including letters, words, pictures, sounds, or symbols, or combinations thereof, and any record thereby created, regardless of the manner in which the record has been stored.337 The CPRA is meant to be broadly applied, though it specifically exempts from disclosure more categories of documents than do the public records laws of either Massachusetts or Florida. An agency must either justify withholding a record by one of these express exemp- tions or by demonstrating that “on the facts of the par- ticular case the public interest served by not disclosing the record clearly outweighs the public interest served by disclosure of the record.”338 The exemptions are meant to be narrowly construed, and an agency oppos- ing disclosure bears the burden of proving that they apply.339 Disclosure of a public record that would otherwise be exempt from disclosure under the CPRA constitutes a waiver of the exemption, unless the record is disclosed in legal proceedings or disclosure is made to a govern- mental agency that agrees to treat the disclosed mate- rial as confidential.340 Therefore, airport operators in California should exercise care when determining whether to disclose a particular record in response to the first request for such a record, as even if it had sat- isfied an exemption, that record must thereafter be dis- closed to all requesters. a. Deliberative Process Exemption.—The CPRA ex- empts from disclosure “[p]reliminary drafts, notes, or interagency or intra-agency memoranda that are not retained by the public agency in the ordinary course of business, if the public interest in withholding those records clearly outweighs the public interest in disclo- sure.”341 Its purpose is to provide a measure of agency 333 CAL. GOV’T CODE § 6253(a), (b), (c). 334 CAL. GOV’T CODE § 6257.5. 335 CAL. GOV’T CODE § 6255(b). 336 CAL. GOV’T CODE § 6250(e). 337 CAL. GOV’T CODE § 6250(g). 338 CAL. GOV’T CODE § 6255(a). 339 County of Los Angeles v. Super. Ct., 82 Cal. App. 4th 819, 825, 98 Cal. Rptr. 2d 564, 568 (2000). 340 CAL. GOV’T CODE § 6254.5. 341 CAL. GOV’T CODE § 6254(a).

33 privacy for written discourse concerning matters pend- ing administrative action.342 If the preliminary materials are retained in the or- dinary course of business—if they are not customarily discarded or have not in fact been discarded—they must be disclosed.343 California airport operators thus may want to consider creating a standard policy for the de- struction of preliminary SMS recommendations used to prepare final reports on SMS hazards and mitigation strategies, and ensure that preliminary materials are destroyed in compliance with that policy. To the extent that facts contained in preliminary materials can be severed from the recommendations they juxtapose, those facts must be disclosed.344 b. Pending Claims and Litigation Exemption.—Also exempted from disclosure under the CPRA are records pertaining to pending litigation to which the public agency is a party, or to claims brought against public entities and employees, until the pending litigation or claim has been finally adjudicated or otherwise set- tled.345 Note that this exemption only runs until the conclusion of the claim or litigation, after which the records become once again subject to disclosure. Only documents specifically prepared for use in litigation are protected from disclosure by this exemption.346 How- ever, this exemption is more broad than the attorney work product exception (discussed below), in that public agencies may use Section 6254(b) to protect “work product” that nonattorneys generate in anticipation of litigation.347 With regard to both the pending claims and attorney client-privilege exemptions (see below), California courts have cautioned that “[n]either the attorney’s presence nor the happenstance of some kind of lawsuit may serve as the pretext for secret consultations whose revelation will not injure the public interest.”348 Simply involving an attorney in SMS investigation and deci- sion-making, without otherwise fulfilling the require- ments for attorney-client privilege, will not protect SMS records from disclosure. c. Official Information Privilege.—The CPRA also exempts records whose disclosure is exempted or pro- hibited by federal or state law, explicitly identifying as exempt the privileges outlined in California’s Evidence 342 Citizens for a Better Env’t v. Dep’t of Food & Agric., 171 Cal. App. 3d 704, 712, 217 Cal. Rptr. 504, 509 (1985). 343 Id. at 714. 344 Id. at 716–17; cf. Times Mirror Co. v. Super. Ct., 53 Cal. 3d 1325, 1343–44, 813 P.2d 240, 251 (1991) (holding that if facts reflect the deliberative process or are its “functional equivalent,” they are exempt). 345 CAL. GOV’T CODE § 6254(b); see CAL. GOV’T CODE §§ 810- 998.3 (West 2012) (Claims and Actions Against Public Entities and Public Employees). 346 County of Los Angeles, 82 Cal. App. 4th at 830. 347 Id. at 831. 348 Register Div. of Freedom Newspapers, Inc. v. Cnty. of Orange, 158 Cal. App. 3d 893, 907, 205 Cal. Rptr. 92, 101 (1984). Code.349 Agencies can also seek exemptions to disclosure for official information, if disclosure is forbidden by law or if disclosure is against the public interest.350 Official information is defined as “information acquired in con- fidence by a public employee in the course of his or her duty and not open, or officially disclosed, to the public prior to the time the claim of privilege is made.”351 An agency could assert this privilege to protect records that, if disclosed, could jeopardize safety, welfare, and security.352 In light of the congressional exemption of voluntarily provided safety data from the Federal FOIA, California airports may be able to argue that the official information privilege of the CPRA exempts at least certain safety data from disclosure. d. Miscellaneous Exemptions.—Finally, two miscel- laneous exemptions in the CPRA might offer protection from disclosure for SMS records. First, “information security records” may not be disclosed if, on a case-by- case determination, “disclosure of the record would re- veal vulnerabilities to, or otherwise increase the poten- tial for an attack on, an information technology system of a public agency.”353 Second, withholding from disclo- sure of “a risk assessment or railroad infrastructure protection program filed with the Public Utilities Com- mission, the Director of Homeland Security, and the California Emergency Management Agency…” is per- mitted.354 Though this provision does not expressly pro- tect SMS records, the exemption illustrates California’s interest in protecting risk analyses and transportation infrastructures for homeland security and emergency management purposes. 4. Florida Public Records Act Florida has the most strict public records law of the three states surveyed—with civil fines and criminal penalties for violation of its provisions and very few permitted exemptions.355 Access to public records in Florida is a constitutional right.356 Under the Florida Public Records Act, records of public agencies must be made available for inspection or copying at any reasonable time and under reasonable conditions.357 The agency must acknowledge requests to inspect or copy records promptly and respond to them 349 CAL. GOV’T CODE § 6254(k). 350 See CAL. EVID. CODE § 1040 (West 2012). 351 Id. § 040(a). 352 See County of Los Angeles, 82 Cal. App. 4th at 835 (citing the overriding public interest in ensuring these qualities for inmates and the deputies working with them). 353 CAL. GOV’T CODE § 6254.19. 354 CAL. GOV’T CODE § 6254.23. 355 See FLA. STAT. §§ 119.01–119.15 (2012) (“Florida Public Records Act”). Florida also has an open meetings requirement for public agencies, referred to as the Sunshine Law, and also mandated by its Constitution. See FLA. CONST. art. I, § 24(b); FLA. STAT. §§ 286.001–286.29 (2012). 356 See FLA. CONST. art. I, § 24(a). 357 FLA. STAT. § 119.07(1)(a).

34 in good faith.358 When an action is filed to enforce the provisions of the Florida Public Records Act, the court must set an immediate hearing, giving the case priority over other pending cases.359 If a Florida governmental agency asserts that all or part of a record is exempt from inspection and copying, it must state the basis of the exemption, including the statutory citation.360 Upon request, this assertion must be made in writing, stating with particularity the rea- sons why the record is exempt or confidential.361 If an exemption applies to only a portion of a record, the ex- empt portion must be redacted and the remainder of the record must be disclosed.362 Any public officer who violates any provision of the Florida Public Records Act commits a noncriminal in- fraction, punishable by a fine not exceeding $500.363 Any public officer who willfully and knowingly violates any provision of the Public Records Act commits a mis- demeanor in the first degree.364 If a public officer know- ingly violates the disclosure provisions in Section 119.07(1), he or she is subject to suspension and re- moval or impeachment and, in addition, commits a mis- demeanor in the first degree.365 a. Security System Plans Exemption.—Security sys- tem plans (or portions thereof) for property owned by or leased to the state or any of its political subdivisions, or any privately owned or leased property that are held by an agency, are confidential and exempt from disclosure under the Florida Public Records Act.366 A “security system plan” includes all: a. Records, information, photographs, audio and visual presentations, schematic diagrams, surveys, recommen- dations, or consultations or portions thereof relating di- rectly to the physical security of the facility or revealing security systems; b. Threat assessments conducted by any agency or any private entity; c. Threat response plans; d. Emergency evacuation plans; e. Sheltering arrangements; or f. Manuals for security personnel, emergency equipment, or security training.367 Information made confidential or exempt may be disclosed to property owners or leaseholders and to an- other state or federal agency “to prevent, detect, guard against, respond to, investigate, or manage the conse- 358 FLA. STAT. § 119.07(1)(c). 359 FLA. STAT. § 119.11(a). 360 FLA. STAT. § 119.07(1)(d). 361 FLA. STAT. § 119.07(1)(f). 362 FLA. STAT. § 119.07(1)(e). 363 FLA. STAT. § 119.10(1)(a). 364 FLA. STAT. § 119.10(2)(a). 365 FLA. STAT. § 119.10(1)(b). 366 FLA. STAT. § 119.071(3)(a)(2). 367 FLA. STAT. § 119.071(3)(a)(1). quences of any attempted or actual act of terrorism, or to prosecute those persons who are responsible for such attempts or acts.”368 b. Building Plans Exemption.—Also exempt from disclosure under the Florida Public Records Act are building plans, blueprints, schematic drawings, and diagrams, including draft, preliminary, and final for- mats, which depict the internal layout and structural elements of a building, arena, stadium, water treatment facility, or other structure owned or operated by an agency.369 These records may be disclosed to another governmental entity if necessary for that entity to per- form its duties and responsibilities.370 Any entity or person receiving information exempted as a building plan must maintain its exempt status.371 c. The Florida Courts Will Not Create Exemptions to the Florida Public Records Act.—As a final note, Florida courts will not imply an exemption that is not outlined in the Florida Public Records Act.372 Exemptions to the Act can only be added by “a two-thirds vote of each house [of the Legislature]…provided that such law shall state with specificity the public necessity justifying the exemption and shall be no broader than necessary to accomplish the stated purpose of the law.”373 B. Qualified Privileges Courts have recognized certain privileges that pre- vent disclosure of otherwise disclosable documents in certain instances. These privileges often also prevent the disclosure of such materials in litigation through the discovery process. Described below are three quali- fied privileges that may be applicable, directly or indi- rectly, to certain safety data gathered by an airport operator pursuant to its SMS. The first is a qualified immunity for ASAP data that was recognized by a U.S. District Court in Florida. However, it is important to note that more recent cases in other federal district courts have failed to recognize this privilege. The sec- ond is the public interest privilege that was recognized by the New York Court of Appeals in the WTC cases. Last, the attorney-client privilege, both under federal law and as interpreted in the states of Massachusetts, California, and Florida, is examined. 1. Qualified Privileges for ASAP Data The courts are divided on whether ASAP creates a qualified immunity from discovery of ASAP data. In a federal case in Florida, heard before the adoption of Section 40123 or Part 193, the court found that ASAP 368 FLA. STAT. § 119.071(3)(a)(3)(a), (b). 369 FLA. STAT. § 119.071(3)(b)(1). 370 FLA. STAT. § 119.071(3)(b)(3)(a). 371 FLA. STAT. § 119.071(3)(b)(4). 372 See Memorial Hospital-West Volusia, Inc. v. News- Journal Corp., 729 So. 2d 373, 380 (1999) (“[W]e believe that an exemption from public records access is available only after the legislature has followed the express procedure provided in…the Florida Constitution.”). 373 FLA. CONST. art. I, § 24(c).

35 data was protected from disclosure pursuant to a quali- fied common-law privilege.374 In a later case heard in federal court in Kentucky, however, the court inter- preted Part 193 as not creating a common-law privilege and permitted discovery of the requested ASAP infor- mation.375 This has led some commentators to call on Congress to enact legislation that expressly creates a qualified privilege against discovery for ASAP data.376 In the Cali case, litigation arose from the crash of an American Airlines flight on December 20, 1995, near Cali, Columbia.377 The plaintiffs sought production from American of a series of documents, including a total of 23 documents prepared in connection with the ASAP program.378 American claimed that such documents were not subject to disclosure, either through the “self- critical analysis privilege” or through a new, common- law privilege protecting such documents.379 The Cali court was not persuaded that the self-critical analysis privilege applied in this context,380 but it found that, although it was not aware of a state or federal court that had previously recognized a privilege for data de- veloped as part of ASAP, the ASAP documents should be protected from discovery.381 The Cali court stated that the ASAP materials in dispute (unlike the vast majority of documents prepared by American in the wake of the crash) were prepared voluntarily, in confidence and for use in a discrete, limited context in cooperation with the FAA and the pilots’ union. There is a genuine risk of a meaningful and irreparable chill from the compelled dis- closure of ASAP materials in connection with the pending litigation.382 However, the Cali court stated that this privilege is qualified, rather than absolute.383 The court found that in this case, the plaintiffs must make a “highly particu- larized showing of the need for the documents, and es- tablish that the information sought is not known or available to the Plaintiffs,” which they had not yet done.384 In the more recent Blue Grass case, however, the court rejected the defendant’s motion to protect ASAP reports from discovery.385 Like the Cali case, Blue Grass 374 See In re Air Crash Near Cali, Columbia on December 20, 1995, 959 F. Supp. 1529, 1530 (S.D. Fla. 1997) (Cali). 375 See In re Air Crash at Lexington, KY, Aug. 27, 2006, 545 F. Supp. 2d 618, 619 (E.D. Ky. 2008) (Blue Grass). 376 See Christa Meyer Hinckley, Hays Hettingert & Jeremy E. Juenger, The Argument for Federal Legislation Protecting the Confidentiality of Aviation Safety Action Program Informa- tion, 75 J. AIR L. & COM. 161 (2010). 377 Cali, 959 F. Supp. at 1530. 378 Id. 379 Id. at 1531. 380 Id. at 1532. 381 Id. at 1535. 382 Id. 383 Id. 384 Id. at 1536–1537. 385 Blue Grass, 545 F. Supp. 2d at 624. arose from the crash of an aircraft, in this case operated by Comair while taking off from the Blue Grass Airport in Lexington, Kentucky. The court noted that the de- fendants had admitted that “Congress did not create a statutory privilege specifically for ASAP or other volun- tary safety reports”386 and concluded that Comair’s pol- icy arguments were being made in the wrong forum.387 The Blue Grass court relied upon the language of Sec- tion 40123 and Part 193 that permits disclosure of ASAP information pursuant to a court order to find that there is no common-law privilege protecting ASAP data from discovery.388 The Blue Grass court concluded that Comair should implore the FAA or Congress to change the regulations or statute to preclude disclosure to liti- gants, rather than authorizing disclosure pursuant to a court order, as the regulations do now.389 Since adoption of Section 40123 and Part 193, the court noted that two other courts have come to the same conclusion regard- ing the nonexistence of a privilege under Section 40123 as the Blue Grass court.390 2. WTC Public Interest Privilege In In re World Trade Center Bombing Litigation (WTC I), the New York Court of Appeals held as a mat- ter of law that PANYNJ was not required to disclose security-related materials in litigation related to the 1993 WTC bombing.391 Instead, the court remanded for further judicial in camera review to “weigh whether the particular, requested data are shielded by a public in- terest privilege against disclosure of confidential gov- ernmental communications.”392 The documents at issue were reports and related data in the possession of PANYNJ and a third-party security consultant, includ- ing “security audit[s]” that identified “possible vulner- abilities of security systems” at the WTC.393 Separate inquiries were undertaken by the court when determin- ing whether the public interest privilege attached and whether PANYNJ should be immunized from liabil- ity.394 Under New York law, the party asserting the public interest privilege must show that “the public interest might be harmed if the sought-after materials were to lose their confidentiality shield, such that, on balance, 386 Id. at 620. 387 Id. at 621. 388 Id. 389 Id. 390 Id., citing Vinton v. Adam Aircraft Indus., Inc., 232 F.R.D. 650, 665 (D. Colo. 2005) and In re: Air Crash at Belle Harbor, New York, 02 MDL 1448, Order dated Aug. 14, 2007, at 13 (S.D.N.Y. 2007). 391 In re World Trade Center Bombing Litig. (WTC I), 93 N.Y.2d 1, 4, 709 N.E.2d 452, 453 (1999). 392 Id. at 453–54, 456–57. 393 Id. at 455. 394 Id. at 458 (“Notably, nothing requires a defendant to es- tablish immunity from liability as a prerequisite to qualifying for an otherwise available privilege at the pretrial discovery stage.”).

36 disclosure might produce results more harmful to the public good than beneficial to the private litigating par- ties.”395 Though it left the final disclosure determination to the lower court, the Court of Appeals stated that PANYNJ’s arguments were “vital and, arguably, unas- sailable in view of the stark specter of worldwide terror- ism and domestic efforts to deal with these growing threats to highly visible public targets of terrorist op- portunism.”396 On remand, however, the Appellate Division ordered disclosure of the documents for which PANYNJ sought the protection of the public interest privilege.397 The court articulated its specific mission as balancing “the [PANYNJ]’s interest in maintaining public safety at the World Trade Center and the plaintiffs’ interest in ad- vancing their claims that [PANYNJ] either negligently or recklessly ignored a stated potential risk….”398 The WTC II court denied PANYNJ’s first rationale for the privilege—that the materials contained sensitive secu- rity information that would be useful to “persons bent on destruction”—because the disclosure would only re- veal security vulnerabilities that had already been ex- ploited by terrorists and publicized in the media and at public proceedings.399 PANYNJ’s second rationale for asserting the privilege was that the potential future disclosure of security information could “subconsciously motivate those who prepare such reports to avoid mak- ing them ‘detailed, unrestrained, and full.’”400 The WTC II court also rejected this argument, stating that the “candor” of government officials would be improved, not impaired, by the knowledge of potential future disclo- sure.401 The PANYNJ further argued that even if only portions of a document contained sensitive information, the entire document should be protected because: [a]n author of a security analysis in an environment in which the dissection of the document could be anticipated would always have doubts as to whether an ex post facto examination of the document to determine which pas- 395 Id. at 457. The PANYNJ set forth three reasons why the public interest might be harmed: • The documents, in full or in part, contained confidential information concerning safety or security systems, methods, devices, and practices of vulnerabilities, whose disclosure would endanger lives and property and adversely affect secu- rity; • Their disclosure would inhibit candor among persons en- gaged in efforts undertaken by government agencies to pro- mote public safety; and • Disclosure would reveal confidential information regard- ing criminal activity obtained from law enforcement under a pledge of confidentiality. 396 Id. 397 In re World Trade Center Bombing Litig. (WTC II), 263 A.D. 2d 417, 693 N.Y.S.2d 586 (1999). 398 Id. at 420. 399 Id. at 421. 400 Id. at 422–23. 401 Id. at 425. sages will be protected from disclosure would result in an analysis consistent with that of the author.402 The court found this logic unpersuasive, instead credit- ing the plaintiffs’ assertion that disclosure benefited the public interest, balancing that interest against the pub- lic interest advanced by PANYNJ, and finding proper the disclosure of documents in their entirety.403 The public interest, as described by plaintiffs and given credence by the court, was that disclosure would enable holding PANYNJ to task for its breach of its duty of care in ignoring repeated warnings of the sub- stantial risk of the exact type of terrorist act that oc- curred.404 Thus, in addition to accepting the plaintiffs’ argument that disclosure would motivate improved “performance in [officials’] preparation,” the court agreed that the documents were “crucial to the prosecu- tion of [plaintiffs’] claim, which is directly related to the Port Authority’s alleged prior awareness of deficiencies in its security system and its alleged failure to address them.”405 The court concluded that if it were to protect the documents and promote candor, potentially limiting PANYNJ’s liability in this matter, it would also limit “the incentive provided by the specter of such liability to maintain appropriate security.”406 In distinguishing this case from one where the public interest privilege was held to shield documents concern- ing the death of a child, the Court pointed out that “[t]he security analyses at issue here were performed before any potential liability had arisen. Their goal was not to analyze prior mistakes but to recommend future action.”407 C. Attorney-Client Privilege Although the majority of data gathered in the devel- opment and implementation of an SMS will not have been prepared by an attorney, it is likely that in the initial development of the program, at least some mate- rials will be prepared by an attorney for an airport op- erator. Set forth below is a brief examination of the fed- eral law relating to the attorney-client privilege, as well as the relevant law of Massachusetts, California, and Florida. 1. Federal Law The federal standard for attorney-client privilege is articulated in Upjohn Co. v. United States, in which the Supreme Court allowed the corporation to invoke the privilege after its counsel developed and circulated a questionnaire to employees in an internal investiga- tion.408 The Internal Revenue Service later sought ac- 402 Id. at 423. 403 Id. at 424. 404 Id. at 420. 405 Id. at 425. 406 Id. 407 Id. at 424. 408 Upjohn Co. v. United States, 449 U.S. 383, 101 S. Ct. 677, 66 L. Ed. 2d 584 (1981).

37 cess to the questionnaire. The Court ruled that the questionnaire feedback was privileged because it was “made by Upjohn employees to counsel for Upjohn act- ing as such, at the direction of corporate superiors in order to secure legal advice from counsel.”409 One classic formulation of the elements necessary to establish the attorney-client privilege is: (1) Where legal advice of any kind is sought (2) from a professional legal adviser in his capacity as such, (3) the communications relating to that purpose, (4) made in con- fidence (5) by the client, (6) are at his instance perma- nently protected (7) from disclosure by himself or by the legal adviser, (8) except the protection be waived.410 Federal attorney-client privilege law will apply to federal question cases handled in the federal courts. However, in federal civil cases based on state law claims, the federal courts apply the law of the forum state. Federal Rule of Evidence 501 (FRE 501) states: [The] privilege of a witness, person, government, State, or political subdivision thereof shall be governed by the principles of the common law as they may be interpreted by the courts in the light of reason and experience. How- ever, in civil actions and proceedings, with respect to an element of a claim or defense as to which State law sup- plied the rule of decision, the privilege of a witness, per- son, government, State, or political subdivision thereof shall be determined in accordance with State law. The presence of third parties will generally disrupt the application of attorney-client privilege. However, under certain circumstances, attorneys need the assis- tance of third parties in order to render advice or assis- tance to their clients. In these limited circumstances, the presence of individuals such as technical experts, accountants, and investigators will not necessarily de- stroy the attorney-client privilege.411 Federal law recognizes the work product doctrine, which protects from discovery “documents prepared by a party’s representative ‘in anticipation of litigation.’”412 Some federal courts have adopted a much narrower definition of the phrase “in anticipation of litigation,” holding: [i]t is not enough to trigger work product protection that the subject matter of a document relates to a subject that might conceivably be litigated. Rather, as the Supreme Court explained, “the literal language of [Rule 26(b)(3)] protects materials prepared for any litigation or trial” …It is only work done in anticipation of or for trial that is pro- tected…“[M]aterials assembled in the ordinary course of business, or pursuant to public requirements unrelated to litigation, or for other nonlitigation purposes are not un- der the qualified immunity….”413 409 Id. at 394. 410 Cavallaro v. United States, 284 F.3d 236, 245 (1st Cir. 2002), quoting 8 J.H. Wigmore, Evidence 554, § 2292 (McNaughton rev. 1961). 411 United States v. Kovel, 296 F.2d 918, 922 (1961). 412 See Upjohn, 449 U.S. at 402. 413 United States v. Textron Inc., 577 F.3d 21, 30 (1st Cir. 2009). 2. The American Bar Association Model Rules The American Bar Association’s (ABA) Model Rule 1.6 deals with privilege, work product, and confidential- ity, and imposes no more obligation on attorneys than that imposed by each state’s rules of professional con- duct.414 The Model Rules state that “[a] lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the dis- closure is impliedly authorized in order to carry out the representation or the disclosure is permitted” because the lawyer reasonably believes disclosure is necessary to “comply with other law or a court order” (among other reasons).415 Though an attorney’s obligation to maintain confidentiality encompasses more information than attorney-client privilege and work product, the Model Rules allow disclosure of all three categories of information “as authorized or required” by the Rules or by other laws that supersede Rule 1.6.416 Whether a law supersedes Rule 1.6 is a question of law.417 In general, it is unlikely that the Model Rules of Professional Con- duct (or those of individual states) could be used to pro- tect SMS data if a particular state does not exempt that data from disclosure by statute. 3. Massachusetts Attorney-Client Privilege Analysis In Massachusetts the attorney-client privilege ap- plies to confidential communications between public officers, employees, and governmental entities and their legal counsel undertaken for the purpose of obtaining legal advice or assistance.418 The Public Records Law does not abrogate the privilege.419 Though Proposed Massachusetts Rule of Evidence 502(d)(6) allows the attorney-client privilege for public clients only when a court determines that disclosure would “seriously im- pair the ability of the public officer or agency to process the claim or conduct a pending investigation, litigation, or proceeding in the public interest,” that Rule has not yet been adopted.420 Many states that have adopted ver- sions of Uniform Rule of Evidence 502(d)(6)—to which the proposed Massachusetts rule is identical—have rejected this proposed limitation.421 However, the Public Records Law has no express or implied exemption for information protected by the at- 414 See ABA Model Rules of Prof'l Conduct, R. 1.6 (2012). 415 Model Rules of Prof'l Conduct, R. 1.6(a), 1.6(b)(6) (2012). 416 See id. at cmts. [3], [12]. 417 See id. at cmt. [12]. 418 Suffolk Constr. Co. v. Div. of Capital Asset Mgmt., 449 Mass. 444, 449, 870 N.E.2d 33, 38–39 (2007). 419 Id. at 36, 46 (“Nothing in the language or history of the public records law, or in our prior decisions, leads us to con- clude that the Legislature intended the public records law to abrogate the privilege for those subject to the statute.”). 420 Id. at 40 n.12. 421 Id.

38 torney work-product doctrine.422 To the contrary, the Public Records Law reflects the Massachusetts Legisla- ture’s “intent to abrogate attorney work-product protec- tions for public records that do not otherwise fall under one of the specified statutory exemptions.”423 Only re- cords contained in the narrower Deliberative Process Privilege exemption of clause (26)(d) will be protected. Under Massachusetts law, the attorney-client privi- lege generally arises “when (1) a person seeks advice or assistance from an attorney, (2) the advice or assistance sought pertains to matters within the attorney’s profes- sional competence, and (3) the attorney expressly or impliedly agrees to give or actually gives the desired advice or assistance.”424 In Massachusetts state courts, the privilege “extends to all communications made to an attorney or counselor…with a view to obtain his advice and opinion in matters of law, in relation to his legal rights, duties and obligations.”425 The Supreme Judicial Court has ruled that attorney-client privilege applies to public officers, employees, and governmental entities. 426 Massachusetts courts have distinguished between “legal” advice, which is privileged, and “business” ad- vice, which is not. The test applied in Massachusetts is whether the attorney is performing a lawyer-related function. This may include applying law to a set of facts, reviewing client documents in light of effective laws or regulations, or advising the client about the status of or trend in the law.427 Documents that typi- cally do not receive privileged treatment include “busi- ness correspondence; interoffice reports; file memo- randa; and minutes of business meetings.”428 Massachusetts does not recognize a general self-critical analysis privilege.429 In the event that a company con- ducts an internal investigation without the assistance of an attorney, the results thereof are not protected by attorney-client privilege.430 422 Suffolk, 870 N.E.2d at 35 (characterizing its decision in Gen’l Elec. Co. v. Dep’t of Envtl. Protec., 711 N.E.2d 589 (Mass. 1999)); see MASS. R. CIV. P. 26(b)(3) (2012). 423 Id. at 40 n.12. 424 Devaux v. Am. Home Assurance Co., 387 Mass. 814, 818, 444 N.E.2d 355, 357 (1983). 425 Hatton v. Robinson, 31 Mass. 416, 421 (1833), quoted by Hanover Ins. Co. v. Rapo & Jepsen Ins. Servs., 449 Mass. 609, 615, 870 N.E.2d 1105, 1111 (2007). 426 See Suffolk. Suffolk should be read in contrast to the SJC’s previous holding that “where a government agency is the client, the Legislature may prescribe different laws and regula- tions concerning client confidentiality,” including the fact that “public records law reflects Legislature’s intent to abrogate attorney work-product protections for public records that…do not otherwise fall under one of the specified statutory exemp- tions.” Gen. Elec. Co. v. Dep’t of Envtl. Protection, 429 Mass. 798, 802–803 (1999). 427 Nat’l Employment Serv. Corp. v. Liberty Mut. Ins. Co., 3 Mass. L. Rep. 221 (1994). 428 Id. 429 Harris-Lewis v. Mudge, 9 Mass. L. Rep. 572 (1999). 430 Rhodes v. AIG Domestic Claims, Inc., 20 Mass. L. Rep. 491 (Mass. Super. Ct. 2006) In general, the presence of third parties disrupts the application of attorney-client privilege. In Massachu- setts, however, “at times, attorneys need the assistance of third parties in order to render advice or assistance to their clients. In these limited circumstances, the presence of individuals such as technical experts, ac- countants and investigators does not necessarily de- stroy the attorney-client privilege.”431 4. California Attorney-Client Privilege Analysis The CPRA exempts records whose disclosure is ex- empted or prohibited by federal or state law, explicitly identifying as exempt the privileges outlined in Califor- nia’s Evidence Code, including the attorney-client privi- lege.432 Because attorney work product is also protected under California law, it is exempted from disclosure by Section 6254(k).433 Protection for work product applies both to writings prepared by a lawyer in anticipation of litigation and to writings prepared by a lawyer while acting in a nonlitigation capacity.434 However, a plaintiff who has filed suit against a public agency may request public records for use in his or her civil action—even if he or she does so to circumvent the discovery process— and if no independent exemption applies, those docu- ments must be produced.435 The California Evidence Code states that the client “has a privilege to refuse to disclose, and to prevent another from disclosing, a confidential communication between client and lawyer.”436 This rule applies to both information communicated to and from the attorney. A communication is confidential if it is sent in confidence by a means which, so far as the client is aware, discloses the information to no third persons other than those who are present…or those to whom disclosure is reasonably necessary for the transmission of the infor- mation or the accomplishment of the purpose for which the lawyer is consulted.437 In the event that confidential information is inter- mixed with unprivileged material, the attorney-client privilege “attaches to a confidential communication be- tween the attorney and the client and bars discovery of If the corporation wished to protect the documents generated by the internal investigation from disclosure in discovery, it would need to direct its attorney to conduct an internal investi- gation for the purpose of providing legal advice to the company regarding the accident, and have the internal investigation con- ducted under the direction of that attorney. 431 Marc C. Laredo, The Attorney-Client Privilege in the Business Context in Massachusetts, 87 MASS. L. REV. 143 (2003). 432 See CAL. EVID. CODE § 954 (West 2012) (protecting confi- dential communications between clients and lawyers); CAL. EVID. CODE § 952 (West 2012) (defining confidential communi- cations). 433 See CAL. CIV. PROC. CODE §§ 2018.020, 2018.030 (West 2012). 434 County of Los Angeles, 82 Cal. App. 4th at 833. 435 Id. at 826. 436 CAL. EVID. CODE § 954. 437 CAL. EVID. CODE § 952.