Are Your Prompts Private? How Your GenAI History Could End Up in Front of the Court

Any employment law or HR professional will know that almost all employee processes now include an invisible third person on the email chain or in the virtual room: the spectral presence of generative AI (or GenAI). But navigating the use of GenAI and its impact on employment disputes is something that both employers and employees are now having to grapple with – particularly in relation to the concept of legal professional privilege.

GenAI – What is Being Used and How?

Many employers have deployed enterprise-level GenAI tools for use by their staff. These tools often have organisation-level controls to limit the ways in which the GenAI provider can use their business’ information (for example, by preventing the provider from using client information to train their GenAI tool). By contrast, employees are routinely using publicly available GenAI tools to ask for advice, draft grievances, prepare legal claims and write detailed correspondence during workplace disputes. These publicly available tools are often free and without organisation-specific guardrails. For example, they may retain and use prompts (i.e. instructions) and outputs under their own terms, including to train and improve their own tool.

From an employee’s perspective, the conversational, casual way in which you interact with GenAI can give the impression of a private conversation with a helpful friend. Since that friend also seems to have an encyclopaedic knowledge of employment law and a willingness to instantly prepare drafts of every document needed for your tricky dispute with your employer, it’s only natural that you would rely on them to help you in your employment dispute. You might even tell this helpful friend things that you’d never say in writing (let alone to your employer), to make sure they could help you make your best case.

But what if that friend was then required to tell your employer and the court everything that you’d told them? And they had perfect transcripts to prove it? Although we don’t yet have definitive answers to these questions, a recent case in the UK and an illustrative case in the US provide a starting point for us to explore these issues and their practical implications for employers in England and Wales.

A Quick Privilege Primer

Legal professional privilege (‘LPP‘) is vital because it allows clients to communicate openly and honestly with their lawyers, on the basis that those communications will usually remain confidential and therefore protected from disclosure to third parties (such as in court or tribunal proceedings).

As a brief reminder, there are two key types of LPP in England and Wales¹:

1. Legal advice privilege (‘LAP’): LAP protects confidential communications between a client and a qualified lawyer created for the dominant purpose of giving or obtaining legal advice. It essentially allows advice to be given and received on a protected, confidential basis as the continuum of communications between the lawyer and their client are typically privileged if they meet the relevant test
2. Litigation privilege: Litigation privilege protects confidential communications between a client and their lawyer, or between either of them and third parties, which are created for the dominant purpose of litigation that is pending or reasonably in contemplation

In either case, LPP can only be claimed where the document is confidential and the relevant dominant purpose test is satisfied. Confidentiality is therefore a prerequisite to privilege, and any loss of confidentiality will be fatal to a privilege claim. Once privilege is lost, it cannot be regained.

Recent Case Discussions

How GenAI interacts with LPP is something with which the court and tribunal systems are now starting to grapple. For example, might privilege be waived if otherwise confidential, legally privileged documentation is fed into a public GenAI tool?

We have some early indication of how courts may start to approach these issues from the UK Upper Tribunal (Immigration and Asylum Chamber) in UK and R (on the application of Munir) v Secretary of State for the Home Department.

In Munir, the Upper Tribunal explored the issue of uploading documents into a public GenAI tool and noted that putting confidential documents (in this instance, client letters and decision letters from the Home Office) into an “open source” GenAI tool “is to place this information on the internet in the public domain, and thus to breach client confidentiality and waive legal privilege.” By contrast, it concluded that “closed source” GenAI tools “which do not place information in the public domain […] are available for tasks such as summarising without these risks.” So, the key threat to LPP when inputting information into an “open source” GenAI tool is, according to Munir, the potential loss of confidentiality. Although it’s worth noting that, beyond giving some examples of tools that might be “open source” or “closed source”, the Tribunal did not explore what it meant by either concept, nor did it examine in detail how information was used by any such GenAI tool or provide guidance on where lines may or may not be drawn between them.

A recent US case, US v Heppner, also illustrates how courts across the pond are also trying to grapple with LPP and the use of GenAI tools. The US District Court for the Southern District of New York held that a set of prompt-and-response documents created by the defendant using a GenAI tool was disclosable in this particular case, being neither attorney-client privileged nor a protected work product. According to the US District Court’s decision, the exchanges with the GenAI tool did not meet the criteria for privilege to apply because they (a) did not constitute communications with a lawyer, (b) were not created for the purposes of seeking legal advice, and (c) were not confidential, given that the applicable privacy terms contemplated the use and retention of both inputs and outputs (including potential disclosure to third parties such as regulatory authorities).

Although not of any binding weight in England and Wales, Heppner does perhaps give some insight into how courts and tribunals may start to look at the problem here too. For instance, prompts fed into GenAI tools and the responses they generate (as well as any related metadata or screenshots etc.) may be relevant documents or information to be included in disclosure for employers and employees alike, potentially becoming evidence of the internal thoughts of key witnesses in litigation. Courts may therefore be more likely to interrogate how and why the tools have been used in order to determine whether LPP applies or has been waived. For example, courts may need to start questioning whether, when using the particular GenAI tool, there was any communication between a lawyer and a client for the dominant purpose of giving or obtaining legal advice (e.g. for LAP) and/or whether the communications are confidential in light of the circumstances of the case and the GenAI tool’s particular terms of use.

What this Means for Employers

Although the English courts are of course not bound to follow the approach taken in the US, and the Munir decision is not binding on the High Court or the Employment Tribunal, these cases raise two important potential risks that employers should be alive to now: using GenAI tools may (a) lead to the waiver of LPP over otherwise protected documents (as in Munir), and/or (b) result in the creation of an entirely new category of disclosable documents such as prompts and GenAI-generated output (as in Heppner). In this new world of GenAI, existing debates around disclosure and the application of LPP may suddenly become much more complex, as parties find themselves navigating new issues such as how GenAI tools have been used, what prompts a party has entered and what terms govern how the tool processes information.

With that in mind, below are some key points regarding LPP and the use of GenAI for employers to consider:

• Assume your (and their) prompts might not stay private: It is possible that both GenAI prompts and GenAI-generated outputs could be treated as disclosable ‘documents’ where they are relevant to the issues in dispute. If we follow the logic in Heppner and Munir, litigating parties may be unable to withhold prompts/outputs from disclosure on the basis of LPP, especially where “open source” or publicly available GenAI tools have been used. If new categories of documents (such as prompt histories, chat logs, and draft GenAI outputs) may be at risk of being disclosable in proceedings, could they reveal a mismatch between the prompt given to the GenAI tool and the witness statement that is ultimately filed at court? How courts respond to the law of privilege and GenAI in England and Wales is still evolving. However, employers can seek to mitigate their own risks around this now by having clear GenAI governance and security procedures in place, along with clear standards around policies for use and training – in particular, on how the use of GenAI might impact privilege and the specific risks of using publicly available GenAI tools which may result in the loss of privilege.

• Check your terms: The Munir case draws a distinction between “open source” and “closed source” GenAI tools in relation to the risk of waiving LPP. However, the court did not fully clarify what this means in practice, and so this distinction is not clear-cut. The decision in the US case of Heppner indicates that courts and tribunals may themselves have to start interrogating how GenAI tools are used and what happens to the information fed into them when assessing the application or waiver of LPP. Employers should therefore be mindful of the LPP risks when undertaking due diligence on their GenAI tools, including checking the contractual terms regarding what happens to your data. For instance: are inputs or outputs used to train or improve the service, who can access these prompts/outputs, how long are they retained for and can they be automatically shared or rendered searchable? Furthermore, privileged material should not be fed to any GenAI tool that has not been vetted in this way (and this practice should generally be kept to a minimum, regardless of the tool).

• Check your legal privilege: While confidentiality is the gateway to privilege, other conditions must still be met for LPP to apply (as outlined above). For example, for LAP to apply, the confidential communication must be between a client and a qualified lawyer for the dominant purpose of giving or obtaining legal advice. So, issues may arise where GenAI is used to create a background document, which is only later sent to a legal team as part of information provided when seeking legal advice. As LAP cannot be applied retrospectively (it only applies when the communication is created), it may not apply where the GenAI exchange takes place before the intention to share the output with the legal team arises and where the output has not been created for the dominant purpose of obtaining legal advice. Issues around inputting confidential and/or privileged information into GenAI tools therefore only form one part of the story; employers should also be mindful that the documents they create using GenAI – even if they are later sent to lawyers – might not be protected by LAP in the first place (depending on the facts). Ensuring that operational and legal channels are kept separate within an organisation can help mitigate this issue, so that the boundary between documentation created for BAU purposes (which may not benefit from privilege) and legal work (which usually would) is as clear as possible.

• Preservation orders/litigation holds: To avoid confidential and potentially privileged information making its way into the public domain, employers may wish to update their preservation notices/litigation holds to encourage staff not to copy confidential documents and/or information wholesale into GenAI, and to be cautious around the purpose for which they are using GenAI at work.

Unlike a standard search on a search engine, GenAI is designed to encourage users to provide as much information to it as possible, enabling users to document their thoughts ‘out loud’ like a diary in ways not previously seen. This can create a temptation to provide GenAI with confidential information and/or documentation which, as Munir and Heppner suggest, could in turn impact LPP. While it’s important to remember that both Munir and Heppner are decisions of lower courts in the UK and US respectively (and so not binding), and this is a fast-moving area, they do provide some potential insights into how courts might approach this issue in future cases. Indeed, using GenAI also opens a window to a whole host of potentially new types of information that could be requested in disclosure. We therefore expect to see more examples of disputes about the disclosure of prompts and GenAI output in courts in the months and years to come.