In Alabama, must a lawyer scrub metadata before sending an electronic document, and is it ethical to mine metadata from a document received from another party?

Plain-English summary

The Disciplinary Commission addressed two questions raised by electronic discovery, e-filing, and email: whether a lawyer must protect confidential metadata before transmitting an electronic document, and whether a lawyer may mine metadata from a document received from another party. Metadata is defined loosely as hidden data generated when a document is created (author, prior authors, template information, hidden text, tracked revisions, and reviewer comments).

On the sending side, the opinion concludes that under Rule 1.6 a lawyer has a duty to exercise reasonable care to avoid disclosing client confidences and secrets embedded in metadata. The opinion gives examples: internal critiques inserted while reviewing a motion, or a recycled template revealing a prior client's name, could be mined by an adversary if the document is not scrubbed. Whether a lawyer exercised reasonable care varies with the circumstances, including the steps taken to prevent disclosure, the nature and scope of the metadata, the document's subject matter, and the intended recipient; the opinion notes a lawyer must take greater care sending a document to an opposing party than e-filing with a neutral court.

On the receiving side, the opinion concludes that, absent express authorization from a court, it is ethically impermissible to mine metadata from a document received inadvertently or improperly from another party. Following New York State Bar Opinion 749, the Commission treats such mining as an impermissible intrusion on the attorney-client relationship and a violation of Rule 8.4, since it is a knowing, deliberate attempt to acquire confidential and privileged information to gain an unfair advantage. The opinion recognizes one area of qualification: electronic discovery, where courts may require production of metadata and parties may be sanctioned for failing to produce it. The production of metadata in discovery is a legal matter within the court's discretion, and the opinion advises both parties to seek direction from the court.

In practice

The opinion holds that, under the Alabama rules as they stood at the time of the opinion, a sending lawyer must apply reasonable care under Rule 1.6 (for example, scrubbing metadata) before transmitting electronic documents, with the required care scaling to the risk that the recipient will mine it. It applies Rule 8.4 to treat a receiving lawyer's mining of metadata from an inadvertently or improperly received document as misconduct, except where a court authorizes it. The opinion carves out electronic discovery, where production of metadata is a question for the court, and advises both sides to seek the court's direction.

Common questions

Q: Do I have to remove metadata before emailing a document to opposing counsel?

A: The opinion concludes you must use reasonable care under Rule 1.6 to avoid disclosing client confidences in metadata. It notes greater care is required when sending to an opposing party than when e-filing with a court, because an adversary is more likely to mine the document.

Q: I received a Word document from the other side. Can I look at its metadata?

A: Not without a court's authorization. The opinion concludes that mining metadata from a document received inadvertently or improperly from another party is ethically impermissible and a violation of Rule 8.4.

Q: What about metadata in discovery?

A: The opinion treats that as a legal matter for the court. Courts may require metadata in electronic discovery and may sanction a party for failing to produce it, so the opinion advises both parties to seek direction from the court.

Q: What metadata is at risk?

A: The opinion lists author and prior-author names, template information, hidden text, tracked revisions, and reviewer comments, any of which could reveal client confidences, litigation strategy, or a prior client's identity.

Background and rules framework

The opinion interprets Rule 1.6 (confidentiality, Model Rule 1.6), which it reads to require reasonable care to prevent inadvertent disclosure of client confidences and secrets contained in metadata, and Rule 8.4 (misconduct, Model Rule 8.4), which it applies to a receiving lawyer who mines metadata to obtain confidential or privileged information. The opinion draws on and credits New York State Bar Opinions 749 and 782.

Citations and references

Rules of Professional Conduct:

• Model Rule 1.6 / Ala. R. Prof. C. 1.6 (confidentiality of information)
• Model Rule 8.4 / Ala. R. Prof. C. 8.4 (misconduct)

Cases:

• Williams v. Sprint/United Mgmt. Co., 2005 WL 2401626 (D. Kan. 2005), sanctions for failing to produce metadata in discovery
• In re Telxon Corp. Sec. Litig., 2004 WL 3192729 (N.D. Ohio 2004), metadata in electronic discovery

Other opinions cited:

• New York State Bar Opinions 749 and 782: mining metadata is an impermissible intrusion on the attorney-client relationship

See also

• ABA Ethics Op. 06-442: Review and Use of Metadata
• NY State Bar Op. 749: Tracking Metadata in Email and Electronic Documents
• TX Ethics Op. 665: Metadata Duties, Scrubbing and Receiving

Source

• Landing page: https://www.alabar.org/office-of-general-counsel/formal-opinions/2007-02/
• Original PDF: https://www.alabar.org/assets/2019/02/2007-02-1.pdf

Original opinion text

ETHICS OPINION RO-2007-02

OFFICE OF GENERAL COUNSEL

DISCLOSURE AND MINING OF METADATA

QUESTION #1:

Does an attorney have an affirmative duty to take reasonable precautions to ensure that confidential metadata is properly protected from inadvertent or inappropriate production via an electronic document before it is transmitted?

ANSWER:

Lawyers have a duty under Rule 1.6 to use reasonable care when transmitting electronic documents to prevent the disclosure of metadata containing client confidences or secrets.

QUESTION #2:

Is it unethical for an attorney to mine metadata from an electronic document he or she receives from another party?

ANSWER:

Absent express authorization from a court, it is ethically impermissible for an attorney to mine metadata from an electronic document he or she inadvertently or improperly receives from another party.

DISCUSSION:

The recent proliferation of electronic discovery, e-filing, and use of e-mail has created an ethical dilemma surrounding the disclosure and mining of metadata. For the purposes of this Opinion, metadata may be loosely defined as data hidden in documents that is generated during the creation of those documents. Metadata is most often generated by software programs, such as Microsoft Word and Corel WordPerfect. These programs are frequently used by attorneys in the creation and drafting of legal documents.

The act of deliberately seeking out and viewing metadata embedded in a document is most often referred to as "mining" the document. Mining metadata allows a person to learn a variety of information about the history and evolution of an electronic document, including: the author, the name of previous document authors, template information, and hidden text. By mining an electronic document, a recipient attorney could also view revisions made to the document, comments added by other users that reviewed the document, and whether the document was drafted from a template. The disclosure of metadata contained in an electronic submission to an opposing party could lead to the disclosure of client confidences and secrets, litigation strategy, editorial comments, legal issues raised by the client, and other confidential information.

For example, say your firm is filing a motion to summarily dismiss a lawsuit and the motion is electronically distributed among the firm's attorneys for review and comments. In reviewing the motion, the other attorneys insert comments critiquing the firm's position and discussing the strengths and weaknesses of various legal positions. The motion is then electronically transmitted to opposing counsel. If you failed to "scrub" or remove the hidden metadata prior to transmission, the opposing party could mine the document's metadata and discover which attorneys reviewed the motion, the critiques about the viability or strength of certain arguments, and the subsequent revisions made to the document.

Another example demonstrating the inherent danger of electronically transmitting documents involves the use of templates. Many attorneys routinely recycle templates for common filings, in which the current client's name is substituted in place of a prior client's name. If the document is later electronically transmitted to the opposing party, the opposing party could mine the document and discover the original client's name and information. Such disclosure of client identity and information could constitute a violation of Rule 1.6, Alabama Rules of Professional Conduct. The protection of the confidences and secrets of a client are among the most significant obligations imposed on a lawyer. Rule 1.6, Ala. R. Prof. C., provides that:

"(a) A lawyer shall not reveal information relating to representation of a client unless the client consents after consultation, except for disclosures that are impliedly authorized in order to carry out the representation, and except as stated in paragraph (b)."

The Comment to Rule 1.6, Ala. R. Prof. C., states, in pertinent part:

"The observance of the ethical obligation of a lawyer to hold inviolate confidential information of the client not only facilitates the full development of facts essential to proper representation of the client but also encourages people to seek early legal assistance.

Almost without exception, clients come to lawyers in order to determine what their rights are and what is, in the maze of laws and regulations, deemed to be legal and correct. The common law recognizes that the client's confidences must be protected from disclosure. Based upon experience, lawyers know that almost all clients follow the advice given, and the law is upheld.

A fundamental principle in the client-lawyer relationship is that the lawyer maintains confidentiality of information relating to the representation. The client is thereby encouraged to communicate fully and frankly with the lawyer even as to embarrassing or legally damaging subject matter."

As such, the Commission believes that an attorney has an ethical duty to exercise reasonable care when transmitting electronic documents to ensure that he or she does not disclose his or her client's secrets and confidences.

The determination of whether an attorney exercised reasonable care will, of course, vary according to the circumstances of each individual case. Factors in determining whether reasonable care was exercised may include steps taken by the attorney to prevent the disclosure of metadata, the nature and scope of the metadata revealed, the subject matter of the document, and the intended recipient. For example, an attorney would need to exercise greater care in submitting an electronic document to an opposing party than he or she would if e-filing a pleading with the court. There is simply a much higher likelihood that an adverse party would attempt to mine metadata, than a neutral and detached court.

Just as a sending lawyer has an ethical obligation to reasonably protect the confidences of a client, the receiving lawyer also has an ethical obligation to refrain from mining an electronic document. In N.Y. State Bar Opinion 749, the New York State Bar concluded that the use of computer technology to access client confidences and secrets revealed in metadata constitutes "an impermissible intrusion on the attorney-client relationship in violation of the Code." (2001). The Commission agrees that the use of computer technology in the manner described above constitutes an impermissible intrusion on the attorney-client relationship in violation of the Alabama Rules of Professional Conduct. As discussed earlier, the protection of the confidences and secrets of a client is a fundamental tenet of the legal profession.

The unauthorized mining of metadata by an attorney to uncover confidential information would be a violation of the Alabama Rules of Professional Conduct. Rule 8.4, Ala. R. Prof. C., provides that it is misconduct for an attorney to, among other things:

"(a) violate or attempt to violate the Rules of Professional Conduct, knowingly assist or induce another to do so, or do so through the acts of another; (b) commit a criminal act that reflects adversely on the lawyer's honesty, trustworthiness or fitness as a lawyer in other respects; (c) engage in conduct involving dishonesty, fraud, deceit or misrepresentation; (d) engage in conduct that is prejudicial to the administration of justice;"

In Formal Opinion 749, the New York State Bar adroitly observed that "in light of the strong public policy in favor of preserving confidentiality as the foundation of the lawyer-client relationship, use of technology to surreptitiously obtain information that may be protected by the attorney-client privilege, the work product doctrine or that may otherwise constitute a 'secret' of another lawyer's client would violate the letter and spirit of these Disciplinary Rules." (2001) The Disciplinary Commission agrees. The mining of metadata constitutes a knowing and deliberate attempt by the recipient attorney to acquire confidential and privileged information in order to obtain an unfair advantage against an opposing party.

One possible exception to the prohibition against the mining of metadata involves electronic discovery. Recent court decisions indicate that parties may be sanctioned for failing to provide metadata along with electronic discovery submissions. In certain cases, metadata evidence may be relevant and material to the issues at hand. For example, the mining of an email may be vital in determining the original author, who all received a copy of the email, and when the email was viewed by the recipient. In Enron type litigation, the mining of metadata may be a valuable tool in tracking the history of accounting decisions and financial transactions.

The production of metadata during discovery will ordinarily be a legal matter within the sole discretion of the courts. The Commission advises attorneys, however, to be cognizant of the issue of disclosing metadata during discovery. Both parties should seek direction from the court in determining whether a document's metadata is to be produced during discovery.

This opinion is consistent with Formal Opinions 749 and 782 of the New York State Bar and some of the language herein is derived from that opinion.

JWM/s 3/14/07