Hello welcome to this JACPA Ethics Alert blog which will discuss Ethics Opinions of the New York State Bar and District of Columbia Bar which address the lawyer ethics issues surrounding the storage of confidential client files electronically in the “cloud”. The opinions are New York State Bar Ethics Opinion 842 and District of Columbia Bar Legal Ethics Committee Opinion No. 357.
As you know, many lawyers have now turned (and are currently turning) to offsite digital electronic storage (often called “cloud” computing) to store confidential client documents and these options are becoming increasingly affordable. As I have said in the past, this type of storage poses some novel ethical risks from those for traditional storage of physical files and also raises important issues regarding file security, protection of client confidences and privileges, and the return of the client files upon request and after termination of the representation.
Broadly, the “cloud” consists of all electronic web based storage options using multiple servers on the internet instead of individual servers (or computers) owned and controlled by the owner of the information to be stored (the lawyer in this case). This includes domains and servers accessible through a network of internet service providers, and includes any service provided online and operated by a third party, such as data storage, e-mail, and software as a service.
The New York State Bar Association (NYSBA) Opinion addresses ethical questions faced by lawyers who hire third-party providers to store electronic client files. The District of Columbia Bar (D.C. Bar) Opinion addresses the obligations of lawyers related to client files and documents maintained in electronic form when the client relationship is terminated.
Not surprisingly, the NYSBA opinion concludes that web based client file storage systems are permissible as long as the attorney exercises “reasonable care” to ensure that confidential client information will be secure. The opinion compares electronic storage with the common practice of hiring a third party to store the physical client files. Under N.Y. Bar Rule 1.6(a) (the equivalent to Florida Bar Rule 4-1.6(a)) “a lawyer shall not knowingly reveal confidential information” and under N.Y. Bar Rule 1.6(c) (the equivalent to Florida Bar Rule 4-1.6(c)), a lawyer must exercise “reasonable care” to ensure that third parties who provide services for the attorney do not divulge or use confidential information.
The NYSBA opinion also suggests four policies that lawyers should consider in exercising “reasonable care” related to electronic storage of client files: (1) insure (and periodically reconfirm) that the provider has “an enforceable obligation to preserve confidentiality and security” and “will notify the lawyer if served with process requiring the production of client information” (2) investigate the provider’s “security measures, policies, recoverability methods, and other procedures to determine if they are adequate under the circumstances” (3) utilize “available technology to guard against reasonably foreseeable attempts to infiltrate the data that is stored” and notify affected clients in the event of a breach, and (4) review the provider’s ability to transfer, delete, and scrub the data if the lawyer decides to use another provider.
The D.C. Bar opinion discusses the continuing duty of lawyers to protect the client’s interests after the attorney-client relationship has ended and all or part of client files are maintained electronically. The opinion states that, in D.C., the file belongs to the client (in Florida, the client file generally is owned by the lawyer) and that, in terminating representation under D.C. Bar Rule 1.16 (the equivalent to Florida Bar Rule 4-1.16), a lawyer must take appropriate steps to protect the client’s interests by surrendering papers and property to which they are entitled, regardless of the media in which they are stored.
That opinion declined to state a “bright-line” test regarding when electronic files must be converted to paper and who should bear the costs and that generally the lawyer must comply with a reasonable request from a client to convert electronic files to paper. The client should in most cases bear the costs related to the conversion; however, the lawyer should bear the costs if neither the client (or the successor lawyer) can access the records “without undue cost or burden” and the former client’s need for the file in paper form outweighs the burden on the lawyer to furnish the file in that manner.
Other jurisdictions, including the Pennsylvania Bar, whose recent opinion was reviewed in my 12/6/11 Ethics Alert, have also found the practice to be permissible and addressed “reasonable care” in the context of third party electronic storage. These jurisdictions have further stated that, notwithstanding these new technologies, the ethical obligations of lawyers have not fundamentally changed and lawyers must, maintain appropriate competence, and keep current with technological developments in order to take reasonable precautions to protect client confidential information.
Bottom line: As a reminder, Bar Ethics Opinions (particularly out of state opinions) are not binding; however, they can be very useful for guidance and mitigation, if necessary. The Pennsylvania Bar Ethics Opinion sets forth detailed recommendations and guidance for lawyers who will be (or are) storing client data in the “cloud”. There is no Florida Bar Ethics Opinion which specifically addresses the issue of storing client data in the “clouds”; however, Florida Bar Ethics Opinion 10-2 addresses the storage of confidential information on digital devices, such as smart phones and digital printers.
…be careful out there!
As always, if you have any questions about this Ethics Alert or need assistance, analysis, and guidance regarding these or any other ethics, risk management, or other issues, please do not hesitate to contact me.
THE LAW OFFICE OF JOSEPH A. CORSMEIER, P.A.
PROVIDES ETHICS ADVICE AND EXPERT OPINIONS TO LAWYERS AND LAW FIRMS
DEFENDS LAWYERS IN BAR ADMISSION AND DISCIPLINE CASES
(AND MUCH MORE!)
My law firm focuses on review, analysis, and interpretation of the Rules Regulating The Florida Bar, advice and representation of lawyers in Bar disciplinary matters, defense of applicants for admission to The Florida Bar before the Board of Bar Examiners, defense of all Florida licensed professionals in discipline and admission matters before all state agencies and boards, expert ethics opinions, and practice management for lawyers and law firms. If there is a lawyer or other Florida professional license involved, I can defend the complaint or help you get your license.
If you have any questions or comments, please call me at (727) 799-1688 or e-mail me at [email protected]. You can find my law firm on the web at www.jac-law.com. In addition to handling individual cases, matters, problems and issues for my clients, I also am on retainer to provide ethics advice to numerous lawyers and law firms throughout the state of Florida. I also provide legal assistance and advice to numerous individuals and non-legal entities to help insure compliance with the law and rules related to UPL and other issues.
Disclaimer: this e-mail does not contain any legal advice and the comments herein should not be relied upon by anyone who reads it.
Joseph A. Corsmeier, Esquire
Law Office of Joseph A. Corsmeier, P.A.
2454 McMullen Booth Road, Suite 431
Clearwater, Florida 33759
Office (727) 799-1688
Fax (727) 799-1670
NOTICE OF CONFIDENTIALITY: This electronic communication and the information contained herein is legally privileged and confidential proprietary information intended only for the individual and/or entity to whom it is addressed pursuant to the American Bar Association Formal Opinion No. 99-413, dated March 10, 1999 and all other applicable laws and rules. If you receive this transmission in error, you are advised that any disclosure, copying, distribution, or the taking of any action in reliance upon the communication is strictly prohibited. Any unauthorized use, distribution, or disclosure of this communication is strictly prohibited. If you have received this in error, please notify us immediately by return e-mail at the above telephone number and then delete message entirely from your system. Thank you for your cooperation.
