Pennsylvania Rules on Lawyers Using Cloud Computing

Pennsylvania Rules on Lawyers Using Cloud Computing

• 1.
  THE DAILY RECORD Monday, September 26, 2011 WESTERN NEW YORK’S SOURCE FOR LAW, REAL ESTATE, FINANCE AND GENERAL INTELLIGENCE SINCE 1908 LegalCURRENTS Pa. rules on lawyers using cloud computing Is it ethical for lawyers to store and access confidential client removed through the phone? data in the “cloud” using computers or mobile devices? As more The conclusion reached was quite similar to the New York and lawyers become familiar with, and use, these technologies, this Florida committees’ conclusions: Yes, lawyers may use these question is slowly, but surely, being asked of ethics committees technologies, provided that they take appropriate measures to across the country. ensure that the confidentiality client data is not As I’ve discussed in prior columns, both Florida and breached. New York ethics committees have addressed this issue The author of the opinion explained that taking steps and each concluded that lawyers can use cloud com- to maintain confidentiality was of paramount impor- puting services to store confidential client data as long tance: “Because cloud computing refers to ‘offsite’ stor- as reasonable steps are taken to ensure that client con- age of client data, lawyers must be aware of and take fidentiality is maintained. (See, Professional Ethics appropriate precautions to prevent compromising Committee of the Florida Bar Op. 10-2 [2011] and New client confidentiality, i.e., attorneys must take great York State Bar Association’s Committee on Profes- care to assure that any data stored offsite remains con- sional Ethics Op. 842 [2010]). fidential and not accessible to anyone other than those The American Bar Association’s Committee on Ethics persons authorized by their firms.” 20/20 is also in the process of tackling this issue and has The opinion also provided lawyers with a useful list proposed that Model Rule 1.6, which addresses lawyers’ By NICOLE of issues to consider and steps to take when choosing duty to maintain confidential information, be revised to BLACK and utilizing cloud computing platforms. Importantly, add the following section to the rule, which mirrors the Daily Record it was noted that these security measures are equally language used by the Florida and New York ethics com- Columnist applicable to the traditional law office setting: “[A]n mittees: “(c) A lawyer shall make reasonable efforts to attorney using cloud computing is under the same prevent the inadvertent disclosure of, or unauthorized access to, obligation to maintain client confidentiality as is the attorney information relating to the representation of a client.” who uses non-online documents management ...” and “the [secu- Meanwhile, the North Carolina Bar has not yet issued a formal rity] measures ... will vary based upon the technology and infra- opinion and continues to struggle with this issue, having issued structure of each office.” two proposed opinions on the ethical obligations of lawyers who The suggested issues to factor into a decision to move to the choose to use cloud computing platforms in their practice, the cloud include: most recent of which is the North Carolina Bar Proposed 2011 • Backing up data to allow the firm to restore data that has Formal Ethics Opinion 6 (2011). been lost, corrupted, or accidentally deleted; And, in January 2011, the Pennsylvania Bar Association • Installing a firewall to limit access to the firm’s network; chimed in on the subject, issuing Ethics Opinion No. 2010-060, • Limiting information that is provided to others to what is which addressed two inquiries: required/needed/requested; (1) Can an attorney ethically allow client confidential material • Avoiding inadvertent disclosure of information such as to be stored in “the cloud” by the software manufacturer? Social Security numbers; (2) Are there ethical considerations regarding the use of • Verifying the identity of individuals to whom the attorney Smartphones, in general and particularly in regard to those that provides confidential information; are synchronized through “the cloud” and data can be remotely Continued ... Reprinted with permission of The Daily Record ©2011
• 2.
  THE DAILY RECORD Monday, September 26, 2011 WESTERN NEW YORK’S SOURCE FOR LAW, REAL ESTATE, FINANCE AND GENERAL INTELLIGENCE SINCE 1908 Continued ... premise that although the tools may be changing, lawyers’ ethi- • Refusing to disclose confidential information to unautho- cal obligations remain the same. rized individuals (including family members and friends) with- New technologies don’t warrant new, more stringent rules or out client permission; requirements, but rather require the careful, thoughtful applica- • Protecting electronic records containing confidential data, tion of existing rules while leaving lawyers a wide berth to take including backups, by encrypting the confidential data; advantage of emerging tools and technologies. • Implementing electronic audit trail procedures to monitor Nicole Black is of counsel to Fiandach & Fiandach in who is accessing the data; and Rochester. She co-authors the ABA book Social Media for • Creating plans to address security breaches, including the Lawyers: the Next Frontier, coauthors Criminal Law in New York, identification of persons to be notified about any known or sus- a West-Thomson treatise, and is currently writing a book about pected security breach involving confidential data. cloud computing for lawyers that will be published by the ABA. All in all, the Pennsylvania opinion is an example of a for- She is the founder of lawtechTalk.com and speaks regularly at ward-thinking application of existing rules and allows lawyers conferences regarding the intersection of law and technology. She the flexibility to determine which tools are most appropriate for publishes four legal blogs and can be reached at nblack@nicole- their particular practice. This decision is wisely based on the blackesq.com. Reprinted with permission of The Daily Record ©2011