Can a lawyer send confidential client information by unencrypted email over the Internet, or do the ethics rules require encryption or client consent?

Plain-English summary

The committee addressed the obligations of lawyers under the Model Rules when using unencrypted email to communicate with clients or others about client matters. It concluded that a lawyer who sends confidential client information by unencrypted email does not violate Model Rule 1.6(a) in choosing that mode, "principally because there is a reasonable expectation of privacy in its use."

The committee reasoned that the expectation of privacy needed to satisfy Rule 1.6 "need not be absolute; it must merely be reasonable." It compared email's interception risks to those of ordinary mail, land-line telephone, cordless and cellular phones, and fax, media long accepted as consistent with the duty of confidentiality, and concluded that email poses no greater risk than those. It also noted that federal law, in particular the Electronic Communications Privacy Act, criminalizes unauthorized interception and disclosure, which reinforces the reasonableness of the expectation of privacy. Examining four common forms of email (direct, private-system, on-line service provider, and Internet email), the committee found a reasonable expectation of privacy in each.

The committee cautioned that this conclusion did not diminish a lawyer's obligation to consider the sensitivity of the communication, the cost of its disclosure, and the relative security of the medium. The opinion stated that "[p]articularly strong protective measures are warranted to guard against the disclosure of highly sensitive matters," which might include avoiding email just as they would warrant avoiding the telephone, fax, or mail. When the lawyer reasonably believes the information is so highly sensitive that extraordinary measures are warranted, the opinion said the lawyer should consult the client about whether another mode of transmission is appropriate and then must follow the client's instructions, citing Rule 1.2(a).

Currency note

This opinion was issued in 1999, before the American Bar Association's adoption of the 2002 (Ethics 2000) revisions to the Model Rules of Professional Conduct, which rewrote Rule 1.6 and later added Comment language on safeguarding information and the use of technology. Subsequent rule amendments and later opinions, including Formal Opinion 477R on securing electronic client communications, may have changed the analysis. Treat this page as historical context, not current guidance. Verify against current rules before relying on any specific rule, deadline, or requirement mentioned here.

Common questions

Q: Does sending client information by unencrypted Internet email violate the duty of confidentiality?

A: The opinion concluded that it does not. The committee held that a lawyer has a reasonable expectation of privacy in email, so its use is consistent with the Rule 1.6 duty to use reasonable means to protect confidential client information.

Q: Did the opinion require client consent before a lawyer could email about a matter?

A: No. The committee concluded that express client consent was not required for ordinary unencrypted email, departing from earlier state opinions that had required consent because of interception concerns.

Q: What did the opinion say about highly sensitive information?

A: The committee said that when the lawyer reasonably believes the information is so highly sensitive that extraordinary protective measures are warranted, the lawyer should consult the client about an alternative mode of transmission and must follow the client's instructions on how to send it.

Q: How did the committee justify treating email like other media?

A: It compared the interception risks of email to those of mail, land-line telephone, and fax, all accepted as consistent with confidentiality, and noted that federal law makes unauthorized interception of email a crime.

Background and rules framework

The opinion interpreted Model Rule 1.6(a) (confidentiality of information), reading it to require a lawyer to take reasonable steps to protect client information, including choosing a means of communication in which the lawyer has a reasonable expectation of privacy. It drew on Rule 1.1 (competence) and Rule 1.4(b) (keeping the client informed) in discussing protective measures for sensitive matters, and on Rule 1.2(a) (the client's authority over the means of representation) for the duty to follow client instructions on the mode of transmission. Because the ABA interprets the Model Rules directly, there is no state-rule analogue.

Citations and references

Rules of Professional Conduct:

• MR 1.6 (confidentiality of information)
• MR 1.1 (competence)
• MR 1.4 (communication)
• MR 1.2 (scope of representation; client's authority over means)

Statutes:

• Electronic Communications Privacy Act of 1986, 18 U.S.C. § 2510 et seq. (criminal and civil penalties for unauthorized interception or disclosure of electronic communications)

Cases:

• Katz v. United States, 389 U.S. 347 (1967), Fourth Amendment protection of a private telephone conversation

Other opinions cited:

• ABA Formal Op. 92-368 (1992): a lawyer who receives misdirected confidential materials must not examine them beyond what is needed to learn they were misdirected and must notify the sender
• ABA Formal Op. 94-382 (1994): that obligation extends to information received by fax or email

See also

• ABA Formal Op. 477R: Securing communication of protected client information
• ABA Formal Op. 511R: Confidentiality when posting to listservs
• ABA Formal Op. 95-398: Nonlawyer access to a lawyer's computer database

Source

• Landing page: ABA Formal Ethics Opinions index
• Original PDF: 99-413.pdf