# Counsel Advice to Serena Holt ## Files in Serena’s Apartment — Category-by-Category Handling Plan **Assumption:** You are represented by current counsel. The advice below is based on the governing rules you provided. The central principle is: **do not treat the nine-gigabyte drive as a single protected “whistleblower” bundle.** Some material is likely protected; some is not. You should preserve and produce only what is reasonably necessary for the wage report, sequester privileged material, and return or delete unrelated confidential and proprietary material under a documented forensic protocol. --- ## 1. Bottom line 1. **Do not send the entire drive to the labor agency, journalist, or prospective employer.** 2. **Preserve and may supply:** - **Category A**: the payroll spreadsheets showing original/edited overtime entries and the three vice-president emails, to the extent they are lawfully accessed and reasonably necessary. - **Category E**: your personal dated notes and screenshots of payroll screens you personally used, if they do not reproduce unrelated protected material beyond what is necessary. 3. **Sequester immediately:** - **Category C**: the outside-counsel memorandum marked “Privileged and Confidential.” 4. **Return or delete under a forensic protocol:** - **Category B**: the full customer export. - **Category D**: pricing models, source code, and sales strategy. - **Category C**: the privileged memorandum, under a privilege protocol. 5. **Do not disclose to a journalist or prospective employer.** Public disclosure and use for competitive advantage are not protected. 6. **Do not unilaterally delete anything.** Avenor’s demand for immediate return/deletion of “every file” is overbroad. Because a dispute is anticipated, deletion should occur only through a documented protocol that preserves forensic integrity and avoids spoliation. 7. **Avenor’s assertion that possession of any company file defeats your retaliation claim is overbroad.** One improper category does not strip protection from lawfully retained, reasonably necessary items. But the improper categories do not become protected by the existence of protected items. --- # 2. Category-by-category advice ## Category A — Payroll spreadsheets and vice-president emails ### What it contains - Twenty-three payroll spreadsheets showing original and edited overtime entries. - Three emails from the vice president directing managers to “move excess hours into the next period.” - You regularly accessed these files in your job. ### May these be preserved for the wage report? **Yes, likely.** This is the strongest protected category. It goes directly to the reported wage falsification: edited overtime entries and contemporaneous managerial direction. If you lawfully accessed these files in the ordinary course of your job and they are reasonably necessary to substantiate the labor-agency report, limited retention is protected. ### Limits You should not preserve the entire nine-gigabyte drive as if every file were protected. You should retain only: - the specific payroll spreadsheets that show original and edited overtime entries; - the three emails directing the manipulation of hours; - metadata necessary to prove edits or timing, if relevant; - no unrelated attachments, folders, customer data, trade-secret material, or privileged legal analyses. If some of the twenty-three spreadsheets or emails contain unrelated personal data, customer data, or business information beyond the overtime issue, counsel should review and redact or exclude the unnecessary portions. ### May these be supplied to counsel or the labor agency? **Yes, with protections.** You may provide Category A to: 1. **Current counsel** under attorney-client privilege and work-product protection, if handled through counsel in anticipation of or in connection with legal advice or claims. 2. **The labor agency** as an authorized regulator, but only through a limited, confidential production. ### Protections to request When sending Category A to the labor agency, include a cover letter requesting: - confidential treatment; - use limited to the wage investigation or legal proceedings; - no public release; - no disclosure to competitors or unrelated parties; - no use for competitive advantage; - return or destruction after the proceeding, if appropriate; - handling of employee personal information in accordance with applicable law and agency rules. You do not need to disclose the full customer export or unrelated trade secrets to get the payroll claim investigated. --- ## Category B — Full customer export ### What it contains - A full customer export for 14,000 customers. - Names, home addresses, bank-account data, and identification numbers. - Unrelated to payroll. - You had technical access because payroll and billing shared a reporting tool. - You never used the customer export in your work. ### May this be preserved for the wage report? **No.** This is not protected. It is unrelated to the wage report. It is mass-collected confidential customer personal information. Even if you had technical access, that does not make it reasonably necessary to substantiate the wage falsification report. Retaining a full customer export with bank and identification data is a serious privacy and confidentiality exposure. ### May it be supplied to counsel or the labor agency? **Do not volunteer it to the labor agency.** You may have counsel review it minimally to confirm categorization and ensure nothing in Category A accidentally includes customer data, but it should not be produced to the regulator as part of the wage report. It is not reasonably necessary. If the labor agency later requests it through a subpoena or formal process, that is a separate legal question. But voluntary production is not advisable. ### What must happen with Category B? 1. **Stop all further access, copying, indexing, or review.** 2. **Segregate it from the protected payroll files.** 3. **Return it or delete it under a documented forensic protocol.** 4. **Notify Avenor, through counsel, that it has been isolated and will be returned or deleted under protocol.** 5. **Do not send it to a journalist, prospective employer, or anyone else.** This category presents the highest data-privacy and trade-secret risk. It is the category most likely to support Avenor’s threatened suit if retained or disclosed. --- ## Category C — Outside-counsel memorandum marked “Privileged and Confidential” ### What it contains - An outside-counsel memorandum labeled “Privileged and Confidential.” - It analyzes wage exposure. - You opened the first page, recognized the label, stopped reading, and copied the folder with the rest of the drive. ### May this be preserved or used? **No. Do not review, rely on, quote, summarize, or disclose its substance.** Even though you copied it without authority, the material remains privileged. Under the stated rules, receiving counsel has special duties. ### Receiving counsel’s duties Your current counsel must: 1. **Stop review immediately** if any review has begun. 2. **Do not open, index, search, or use the substance** of the memorandum. 3. **Sequester the file** physically and logically. 4. **Exclude it from e-discovery search, OCR, metadata indexing, or review queues** as much as possible. 5. **Notify Avenor’s counsel** that a privileged document has been identified, sequestered, and will not be used. 6. **Seek an agreed or court-supervised protocol** for return, deletion, or in camera handling if the issue becomes disputed. 7. **Not use the substance** to frame the wage report, respond to Avenor, or advise on litigation strategy. ### May it be supplied to the labor agency? **No.** The memorandum is company-side privileged material. It is not your personal property. It is not something you should provide to the regulator, journalist, or prospective employer. If the labor agency requests it, counsel should assert privilege and, if necessary, propose a protective or in camera protocol. But you should not volunteer it. ### What must happen with Category C? - Sequester it now. - Keep it separate from Category A and E. - Return or delete it under a privilege protocol. - Do not describe its contents beyond the bare fact that it is a privileged legal memorandum that has not been used. --- ## Category D — Pricing models, source code, and sales strategy ### What it contains - Pricing models. - Product source code. - Sales strategy for a service against which your prospective new employer competes. - None of it concerns payroll or your report. ### May this be preserved for the wage report? **No.** This is unrelated proprietary material. It is not reasonably necessary to substantiate the wage report. It is precisely the kind of material that confidentiality agreements and trade-secret law protect. ### May it be supplied to counsel or the labor agency? **Do not supply it to the labor agency.** It is not relevant to the wage falsification report. It is not protected by whistleblower rules. Retaining it creates serious trade-secret and confidentiality exposure. ### May it be shown to the prospective employer? **Absolutely not.** This is the most dangerous category as to your new employer. Providing it could constitute: - breach of confidentiality; - trade-secret misappropriation; - unauthorized competitive use; - inducement or facilitation of misappropriation by the new employer. Even if you do not send it, telling the prospective employer that you possess “inside proof” that Avenor “cuts corners” could be used to suggest competitive misuse. ### What must happen with Category D? 1. **Segregate immediately.** 2. **Do not copy, forward, screenshot, summarize, or use it.** 3. **Return or delete under the forensic protocol.** 4. **Do not discuss it with the prospective employer.** --- ## Category E — Personal notes and screenshots ### What it contains - Serena’s dated personal notes of meetings. - Quotations from managers. - Screenshots of two payroll screens she personally used. ### May these be preserved for the wage report? **Yes, likely.** Personal notes created by the employee are the employee’s property unless they reproduce protected company material beyond what is reasonably necessary for a legal claim. Your notes appear to be personal contemporaneous records of meetings and quotations. They are likely relevant and may be protected if they do not reproduce unrelated protected material. The screenshots of payroll screens you personally used are also likely preservable if they are limited to what you lawfully saw and are reasonably necessary. ### Limits Counsel should review Category E to ensure that it does not include: - customer names or personal data; - pricing models or source code; - privileged legal advice; - sales strategy; - unrelated confidential business information; - lengthy reproductions of company documents beyond what is necessary. If a note contains unnecessary customer data or unrelated trade-secret material, redact or exclude that portion. ### May these be supplied to counsel or the labor agency? **Yes, with confidentiality protections.** You may provide Category E to: 1. **Current counsel** as part of your legal file. 2. **The labor agency** as part of the report, to the extent it supports the wage-falsification claim. ### Protections Ask the labor agency to treat the notes and screenshots as confidential, non-public, and limited to the investigation. If the notes contain employee personal data, request that the agency handle it appropriately. If they contain unrelated confidential material, redact before production. --- # 3. The customer export and unrelated proprietary material ## Customer export: Category B This is the most urgent non-payroll problem. It contains: - customer names; - home addresses; - bank-account data; - identification numbers. That is highly sensitive personal information. It is unrelated to the wage report. It is not protected by the limited-retention rule. You should: - isolate it; - stop further access; - return or delete it under a forensic protocol; - notify Avenor’s counsel that it is being returned or deleted; - not send it to the labor agency, journalist, or new employer. If Avenor later claims a data-privacy incident, you want a documented record that you identified, segregated, and returned/deleted the export under protocol. ## Unrelated proprietary material: Category D This includes pricing models, source code, and sales strategy. It is unrelated to your report. It is likely confidential and potentially a trade secret. You should: - isolate it; - not use it; - not show it to the prospective employer; - return or delete it under protocol. This category is central to Avenor’s threatened trade-secret suit. Returning or deleting it under a proper protocol is the best way to reduce that exposure. --- # 4. The privileged memorandum and receiving counsel’s duties The memorandum remains privileged. The fact that you copied it without authority does not automatically waive privilege under the stated rules. Your counsel must not use it. The proper response is procedural, not substantive: 1. **Stop review.** 2. **Do not open the document.** 3. **Sequester it.** 4. **Exclude it from search and review systems.** 5. **Notify Avenor’s counsel.** 6. **Propose a protocol for return or court-supervised handling.** 7. **Do not disclose it to the labor agency, journalist, or prospective employer.** You should not argue from its contents. You should not summarize it. You should not rely on its analysis. The safe position is: “A privileged document was identified, sequestered, not reviewed, and will be handled under a privilege protocol.” If Avenor later wants to prove that you possessed or copied it, the content remains privileged. The fact of possession or copying may be addressed separately, but the substance of the legal advice is protected. --- # 5. Personal notes and screenshots Your personal notes are likely your property. They can be important evidence. You may preserve and produce: - dated notes of meetings; - quotations from managers; - screenshots of payroll screens you personally used. But you should not preserve or produce: - customer data; - source code; - pricing models; - sales strategy; - privileged legal advice; - unrelated proprietary material. If a screenshot contains more than the payroll screen, crop or redact the unrelated portion if necessary. If a note quotes a manager but also includes unrelated trade-secret detail, redact the unrelated portion. The key is that Category E remains personal and work-related only to the extent necessary for the wage claim. --- # 6. Journalist and prospective-employer requests ## Journalist You should not send the drive, any portion of it, or any document to a journalist. Protected activity does not authorize public disclosure. Sending the entire drive to a journalist would expose: - customer personal information; - trade secrets; - privileged material; - unrelated proprietary information; - potentially unnecessary employee data. It would also undermine the protected-channel requirement that disclosure be confined to counsel or an authorized regulator. If you want to prevent Avenor from “burying” the issue, the appropriate route is: - the labor agency; - counsel; - legal process; - protected regulatory reporting. ### Permissible public statement You may limit any public statement to something narrow and truthful, such as: > “I reported my concerns to the appropriate labor agency. I am working with counsel. I will not discuss confidential materials or former employer information publicly.” You should not provide documents, screenshots, quotes, or internal details to the press. ## Prospective employer You should not provide “inside proof” to the prospective employer. The prospective employer is not an authorized channel. It is also a competitor. Providing documents or details could create: - trade-secret misappropriation; - breach of confidentiality; - competitive misuse; - evidence that you intended to use Avenor’s confidential information for personal or competitive advantage. ### Permissible response You can say: > “I have made a report to the relevant regulator. I am represented by counsel and cannot discuss or provide former employer confidential information.” If the prospective employer conditions the offer on receiving Avenor documents or information, you should decline and document the request. --- # 7. Avenor’s return demand and the need for a forensic protocol Avenor’s demand for immediate return and deletion of every file is overbroad. It sweeps in: - protected payroll records; - relevant emails; - personal notes; - screenshots; - material reasonably necessary for your report. But Avenor also has a legitimate interest in: - customer personal data; - trade secrets; - source code; - pricing models; - sales strategy; - privileged legal materials. The correct response is not to ignore Avenor. The correct response is to separate protected from non-protected material and to return or delete the non-protected material under a forensic protocol. ## Why you should not delete immediately A dispute is anticipated. Both sides must preserve relevant evidence. Unilateral deletion could create spoliation risk, make verification impossible, and give Avenor a stronger forensic argument. Also, because the drive is encrypted and contains mixed categories, a blanket wipe would destroy potentially relevant evidence and make it impossible to prove that you returned or deleted only the improper categories. ## Recommended forensic protocol You should propose the following in writing: 1. **Litigation hold and cessation of copying** - Serena will not copy, move, review, or alter additional files except as directed by counsel. - The encrypted drive will be kept in secure storage. 2. **Secure sequestration** - The drive will be stored in a locked, access-controlled location. - Access will be logged. - Only counsel and, if necessary, a neutral forensic vendor will handle it. 3. **Inventory and hash** - Counsel or a neutral forensic expert will create an inventory of the drive. - Cryptographic hashes will be generated for integrity. - Category C will be identified by file name and privilege label only; its substance will not be reviewed. 4. **Category separation** - Category A and E will be segregated as protected/retained for the wage report. - Category B, D, and C will be segregated for return or deletion. 5. **Return or deletion of non-protected categories** - Category B and D should be returned to Avenor or deleted under a documented protocol. - Category C should be returned or deleted under a privilege protocol. - If deletion is used, it should be forensically verified and certified. - If return is used, the transfer should include a file list, hashes, and chain-of-custody documentation. 6. **Preservation of protected categories** - Category A and E may be retained solely for the purpose of the labor-agency report, legal advice, and related legal proceedings. - They may be produced to the labor agency under confidentiality protections. 7. **No waiver or admission** - The protocol should state that Serena does not admit wrongdoing. - It should state that the handling of non-protected material is without prejudice to her protected activity. - It should preserve privilege over Category C. 8. **If Avenor refuses a protocol** - Serena should not unilaterally delete. - Counsel should seek court or labor-agency supervision, a protective order, or a custody protocol. - The refusal should be documented as part of the retaliation and overbroad-demand record. --- # 8. Confidentiality, trade-secret, access, and retaliation exposure ## Retaliation exposure Your core retaliation position is strongest as to: - the labor-agency report; - Category A payroll records and emails; - Category E personal notes and screenshots. Avenor’s assertion that possession of any company file defeats the retaliation claim is overbroad. The existence of improper categories does not automatically defeat protection for lawfully retained, reasonably necessary items. However, you should not overstate protection for the whole nine-gigabyte drive. The strongest retaliation position comes from returning or deleting the unrelated material and limiting your retention to what is necessary. Avenor’s demand, threat, and timing may itself be relevant to retaliation. Preserve all communications. ## Confidentiality exposure Confidentiality remains enforceable as to: - customer personal information; - unrelated proprietary material; - trade secrets; - privileged legal material. The confidentiality agreement may not prohibit truthful reporting to a regulator or counsel, but it does protect unrelated material. Your exposure is: - low to moderate for Category A if minimized and produced only to authorized channels; - low to moderate for Category E if redacted and limited; - high for Category B; - high for Category D; - high for Category C if reviewed, used, or disclosed. ## Trade-secret exposure Category D is the primary trade-secret risk. Category B may also contain trade-secret or highly confidential customer information. Category A is less likely to be a trade secret, but it may still be confidential business information. Returning or deleting Category D under a protocol is essential. ## Access and computer-use exposure The initial copying of approximately nine gigabytes was overbroad. That creates independent access or retention issues, even if some files are protected. But under the stated rules, one improper category does not strip protection from every lawfully retained item. The remedy is to separate, return, delete, and limit disclosure. ## Privacy exposure Category B is a major privacy risk. It includes bank-account data and identification numbers. This is the most likely category to trigger data-privacy concerns, regulatory scrutiny, or customer-notification obligations if mishandled. --- # 9. Concrete next communication and handling sequence ## Step 1 — Immediate internal handling Today or immediately: 1. **Stop all copying and further access.** 2. **Place the encrypted drive in secure, access-controlled storage.** 3. **Instruct current counsel and any staff:** - do not open Category C; - do not use Category B or D; - review only Category A and E for the wage report; - log all access. 4. **Create a category inventory** with counsel or a neutral forensic expert. 5. **Generate hashes or other integrity records** if feasible. 6. **Separate Category C** so it is not indexed or reviewed. ## Step 2 — Written response to Avenor’s counsel Send a measured letter. Do not admit broad wrongdoing, but do not ignore the demand. A suitable letter could say: > Dear [Avenor Counsel]: > > We represent Serena Holt. We write in response to your demand for return and deletion of all files. > > Ms. Holt has not disclosed any materials to the press, a prospective employer, or anyone other than counsel. She has taken immediate steps to segregate and properly handle the materials. > > Ms. Holt is prepared to return or delete, through a documented forensic protocol, materials that are not reasonably necessary to substantiate her report to the labor agency. This includes unrelated customer personal information, unrelated proprietary materials, and privileged materials that have been sequestered and not used. > > She is retaining a limited subset of payroll records, related emails, and personal notes or screenshots that she lawfully accessed and that are reasonably necessary for her labor-agency report. Those materials will be used only for that protected purpose and related legal proceedings. > > We propose the following protocol: > > 1. A litigation hold and cessation of further copying. > 2. Secure sequestration of the media. > 3. Counsel or neutral-forensic inventory and integrity verification. > 4. Segregation of protected and non-protected categories. > 5. Return or deletion of non-protected categories under documented chain of custody, with hash or forensic certification where deletion is used. > 6. Privileged materials handled under a privilege protocol without use of their substance. > 7. Preservation of relevant evidence and no waiver of rights. > > Ms. Holt will not unilaterally delete materials while a dispute is anticipated. If you decline to agree to a preservation protocol, we will seek appropriate court or agency supervision rather than risk improper destruction of evidence. > > We do not waive privilege. A privileged document has been identified and sequestered. It has not been used and will be handled under a privilege protocol. > > Please respond by [date]. This letter does three things: - acknowledges Avenor’s interest; - protects your retaliation position; - forces Avenor to choose between a protocol or litigation. ## Step 3 — Limited production to the labor agency Do not send the entire drive. Prepare a limited production containing only: - Category A payroll spreadsheets; - the three vice-president emails; - Category E notes and screenshots, after redaction of any unrelated protected material. Attach a cover letter such as: > Enclosed are materials reasonably necessary to substantiate Ms. Holt’s report concerning alleged alteration of overtime records. > > The enclosed materials are provided for use in your investigation only. We request confidential treatment, non-public handling, and no use for competitive advantage. The materials include employee personal information and should be handled in accordance with applicable law and agency confidentiality rules. > > We are not providing unrelated customer personal information, trade-secret material, or privileged legal materials. If the labor agency requests the entire drive, do not simply send it. Ask for a secure custody protocol or offer a forensic copy limited to relevant categories, with privileged and unrelated categories excluded or sequestered. ## Step 4 — Execute the return/deletion protocol Once Avenor agrees, or if a court or agency supervises the process: 1. Transfer Category B and D to Avenor, or delete them under certification. 2. Handle Category C through a sealed or court-supervised privilege protocol. 3. Preserve Category A and E for the report. 4. Keep records of: - what was returned; - what was deleted; - who did it; - when; - hashes or certificates; - chain of custody. If Avenor refuses a protocol, do not delete. Seek supervision. ## Step 5 — Ongoing conduct rules From now on: - Do not send any file to a journalist. - Do not send any file to the prospective employer. - Do not discuss Avenor’s confidential systems, customer data, pricing, source code, or strategy. - Do not use Avenor information to gain employment advantage. - Do not make new copies except through counsel or a neutral forensic protocol. - Preserve Avenor’s demand letter and threats. - Preserve your labor-agency report confirmation. - Keep a log of all handling of the drive. --- # 10. Final recommendation Serena should take the position that she has a protected wage-falsification report supported by a limited set of lawfully accessed payroll documents and personal notes. She should not be treated as if the entire nine-gigabyte drive is either all protected or all improper. The practical plan is: 1. **Preserve and produce:** - Category A payroll spreadsheets and emails; - Category E notes and payroll screenshots, after redaction. 2. **Sequester and do not use:** - Category C privileged memorandum. 3. **Return or delete under protocol:** - Category B customer export; - Category D proprietary trade-secret material; - Category C privileged memorandum under privilege protocol. 4. **Do not disclose publicly or to the new employer.** 5. **Do not unilaterally delete anything.** Respond to Avenor with a forensic protocol and, if necessary, seek court or agency supervision. That approach maximizes protection for the wage report, minimizes confidentiality and trade-secret exposure, preserves privilege, avoids spoliation risk, and gives Avenor no easy argument that your entire retention was an unlawful take.