Most firms ask whether a case study breaches privilege. The question that actually decides it is confidentiality — a wider duty that covers information whatever its source, and that only the client can lift.
Key takeaways
Not without the client’s authorisation, in most cases. The reason is that the controlling duty is confidentiality rather than privilege. Rule 3.3-1 requires a lawyer to hold in strict confidence all information concerning the business and affairs of the client acquired in the course of the professional relationship, and to divulge it only where expressly or impliedly authorised by the client, required by law or by a tribunal, required by the Law Society, or permitted by the narrow exceptions in rules 3.3-2 to 3.3-6.
The commentary then does the work most marketing plans miss. It distinguishes the ethical rule from the evidentiary rule of lawyer and client privilege and says the ethical rule is wider, applying without regard to the nature or source of the information or the fact that others may share the knowledge. It also records that the duty is owed to every client, continuing or casual, survives the professional relationship and continues indefinitely. So “it was in the public record” and “we changed the names” are not the test. Authorisation is.
For firms outside the legal profession the duty is usually contractual rather than ethical, but it bites the same way. Treadstone Law explains how a non-disclosure agreement is built and what happens on a breach of a confidentiality clause. If your engagement letter contains a confidentiality clause, the case study is a disclosure under it.
Once published, a case study is marketing. Rule 4.2-1 requires it to be demonstrably true, accurate and verifiable, and neither misleading nor likely to mislead. The commentary lists examples that may contravene the rule, including stating an amount of money recovered for a client or referring to a degree of success in past cases unless accompanied by a statement that past results are not necessarily indicative of future results and that outcomes vary with the facts, and testimonials or endorsements containing emotional appeals.
Separately, section 74.02 of the Competition Act makes it reviewable conduct to publish a testimonial unless it was previously made or published by the person who gave it, or was approved and permission given in writing before publication, and it accords with what was given. Clause 7 of the Canadian Code of Advertising Standards requires a testimonial to reflect the genuine, reasonably current opinion of the person making it. And subsection 74.03(5) means the general impression counts: a study that is accurate line by line but reads as a promise of outcome is still a problem.
The judgment call — is this safe to publish — is not delegable. A model cannot know that the opposing party in an old matter is now a prospect, or that the client sold the business last month.
A five-lawyer firm in Ontario wants six case studies for a new website. The marketing contractor proposes writing them from closed files and anonymising as they go.
The firm inverts the order. It shortlists twelve closed matters, and for each one asks the client for permission before a word is drafted; seven say yes. Drafts are produced from the file skeleton, then run through a re-identification check, and two are cut because the sector and the year together give the client away. Every figure is removed except where the client expressly approved it, and the two studies that mention outcomes carry the past-results statement. Client quotes are used exactly as the client wrote them, with written permission on file.
Five studies go live instead of six. The firm keeps a one-page register recording the client, the approved text, the approval date and the review date. When a client asks for their study to come down eighteen months later, it takes four minutes.
This is a marketing question with a professional-obligation core, so it belongs with the people who own the client relationship rather than the website. If the underlying question is about intake and the front desk, that is the professional practice owners page. If it is about your own internal records rather than what you publish, that is accounting automation. And name your province: the rule quoted here is Ontario’s, and every law society writes its own.
Is a fictional composite safe?
Safer, if it is genuinely not traceable to any one client. But it must not be presented as a real engagement, because the general impression test looks at what a reader takes away, not at your intention. Label it.
The matter is a reported decision. Can we write about it?
Public record changes the privilege analysis, not the ethical one: the commentary to rule 3.3-1 says the duty applies without regard to the fact that others may share the knowledge. Take advice before treating publication as consent.
Can we polish the client’s quote?
Editing it takes you outside section 74.02, which requires the published testimonial to accord with the one that was given or approved in writing. Fix a typo; do not improve the sentiment.
A 30-minute call is enough to tell you whether AI pays for itself here.
