CABAR 2023

What are a California lawyer's ethical duties when working remotely or in a hybrid law-firm setting?

Short answer: Remote practice does not change a California lawyer's ethical duties. Managerial lawyers must implement reasonable measures, policies, and practices to ensure compliance with the rules in a remote environment, with particular focus on confidentiality, technology competence, communication, and supervision.

Disclaimer: Advisory only. Not binding precedent.

About this page: The plain-English summary, reader guidance, and Q&A below were written by Ezel based on the official ethics opinion. The original opinion (linked at the bottom of this page, or PDF in the sidebar) is the authoritative source for any reliance.

View original ethics opinion (PDF)

State Bar of California COPRAC Formal Opinion 2023-208: Ethical Duties of Lawyers Working Remotely

Short answer: The opinion concludes that remote practice does not alter a California lawyer's ethical duties under the California Rules of Professional Conduct and the State Bar Act, and that managerial lawyers must implement reasonable measures, policies, and practices to ensure compliance with those duties in a remote working environment.

Disclaimer: This is an advisory ethics opinion. Advisory opinions are not binding; they interpret the State Bar of California's rules of professional conduct and are persuasive authority. This summary is for research purposes only and is not legal advice. Verify current rules before acting on any specific guidance.

About this page: The plain-English summary and Q&A below were written by Ezel based on the official opinion. The opinion text is reproduced at the bottom; the official source (linked) controls.

View original opinion

Plain-English summary

The opinion addresses a hypothetical hybrid law firm that intends to move its lawyers and staff into a smaller, shared office while permitting remote and home work. Per the opinion, the same rules that apply to a traditional office apply to remote practice, but the application raises specific issues under five rules: 1.6 (confidentiality), 1.1 (competence), 1.4 (communication), 5.1 through 5.3 (supervision), and 5.5 with Business and Professions Code sections 6125 et seq. (unauthorized practice).

On confidentiality, the opinion holds that a firm using third-party cloud providers or other technology vendors must, through its managerial and supervisory lawyers, engage in reasonable efforts to ensure the vendors' conduct is compatible with the lawyers' ethical obligations. The committee identifies investigating the provider's reputation, history, security, and backup measures; limiting access to confidential information; reviewing terms of service for data security and breach handling; and periodically reviewing those policies as examples of reasonable measures. Lawyers working from home must implement reasonable measures to safeguard confidential information where other household members share devices, with examples including separate accounts, two-factor authentication, strong passwords, automatic logoff, and disabling smart-speaker listening features. The opinion does not set mandatory specifics; reasonableness depends on client instructions, sensitivity of the information, the remote working environment, and the presence of third parties.

On competence, the opinion applies California Rule 1.1's recently-amended technology-competence comment and adopts a "reasonableness standard" consistent with ABA Formal Opinion 477R. The opinion also addresses the Rule 1.1(b)(ii) requirement of mental, emotional, and physical ability necessary to perform legal services, noting that pandemic-related disruptions do not excuse the duty of competence and that lawyers must take reasonable measures to ensure continued competent service, including advance planning for disasters.

On supervision, the opinion holds that managerial lawyers at the firm must provide appropriate tools, equipment, technology support, training, and monitoring; must implement reasonable remote policies including confidentiality and cybersecurity policies and training; should consider Bring Your Own Device (BYOD) policies when personal devices are used; and must maintain regular communications with subordinate lawyers and nonlawyer staff. Subordinate lawyers retain an independent duty under Rule 5.1(a) to comply with the rules.

On unauthorized practice, the committee declined to opine on UPL issues, citing its lack of authority to do so. Per the opinion, California licensed lawyers practicing California law remotely in another state should consult that state's MJP and UPL rules; lawyers not licensed in California who are working remotely from California should consult Rule 5.5(b), California Rules of Court 9.40 through 9.48, and Business and Professions Code sections 6125 et seq.

In practice

Under this opinion, conduct that establishes a hybrid or remote California law firm is consistent with the Rules of Professional Conduct provided the firm's managerial lawyers implement reasonable safeguards under Rules 1.6, 1.1, 1.4, and 5.1 through 5.3. The opinion identifies the reasonableness standard as fact-specific: the relevant factors are client instructions, information sensitivity, the remote environment, and third-party presence. Per the opinion, managerial lawyers must take reasonable efforts to ensure vendor conduct is compatible with the firm's ethical obligations and must adopt and enforce policies that keep pace with advances in technology.

The committee declined to opine on whether any specific remote-practice activity by a non-California-licensed lawyer in California constitutes the unauthorized practice of law, directing lawyers to the relevant statutory and Rules of Court provisions instead.

Common questions

Q: Does California require a lawyer to obtain client consent before working from home or storing files in the cloud?

A: The opinion does not impose a consent requirement. It holds that the lawyer must take "reasonable measures" to safeguard confidentiality and identifies factors including client instructions and information sensitivity that may affect what is reasonable. Where client instructions or matter sensitivity warrant, those instructions become part of the reasonableness analysis.

Q: What does the opinion say about smart speakers, virtual assistants, and similar listening devices?

A: The opinion identifies disabling the listening capability of smart speakers, virtual assistants, or other listening-enabled devices "unless needed to assist with legal services" as an example of a reasonable security measure for home practice. The committee cites ABA Formal Opinion 498 (2021) on this point.

Q: Can a California lawyer working remotely from another state still practice California law?

A: The committee declined to opine on UPL questions because California does not authorize it to do so. The opinion directs California-licensed lawyers practicing California law remotely outside California to consult the MJP and UPL rules of the state where they are physically present.

Q: Can a lawyer not licensed in California work remotely from California while practicing the law of another jurisdiction?

A: The committee likewise declined to opine. The opinion directs the lawyer to Rule 5.5(b), California Rules of Court 9.40 through 9.48, and Business and Professions Code sections 6125 et seq., and cites other states' opinions (ABA 495 (2020); D.C. Court of Appeals Opinion 24-20; Florida Supreme Court SC20-1220; New Jersey UPL 59 and ACPE 742; Utah 19-03; San Francisco Bar Ass'n 2021-1) as illustrative comparative authority.

Q: What supervisory steps does the opinion require of managerial lawyers in a remote firm?

A: The opinion identifies appropriate tools, equipment, technology support, training, and monitoring; written remote policies on confidentiality, cybersecurity, and BYOD where applicable; vendor vetting and oversight; regular communication with lawyers and nonlawyer staff to confirm compliance; and updates to policies as technology changes.

Q: Does the opinion address mental and emotional fitness?

A: Yes. The opinion reads Rule 1.1(b)(ii) to require the "mental, emotional, and physical ability reasonably necessary for the performance" of legal services. It holds that personal, health, or financial impacts of pandemics and other disasters do not excuse the competence duty and that lawyers must take reasonable measures to maintain competent service, with advance planning identified as one such measure.

Background and rules framework

The opinion applies California Rules of Professional Conduct 1.1 (competence, including the technology-competence comment effective March 22, 2021), 1.3 (diligence), 1.4 (communication), 1.6 (confidentiality), 5.1 (responsibilities of managerial and supervisory lawyers), 5.2 (responsibilities of subordinate lawyers), 5.3 (responsibilities regarding nonlawyer assistants), and 5.5 (unauthorized practice of law and multijurisdictional practice). The opinion also references Business and Professions Code section 6068, subdivision (e) (confidentiality) and Business and Professions Code sections 6125 et seq. (unauthorized practice). These provisions correspond to ABA Model Rules 1.1, 1.3, 1.4, 1.6, 5.1, 5.2, 5.3, and 5.5.

Citations and references

Rules of Professional Conduct:

California Rule 1.1 and Comment [1] (competence and technology)
California Rule 1.3(b) (diligence)
California Rule 1.4 (communication)
California Rule 1.6 (confidentiality)
California Rules 5.1 through 5.3 (supervision)
California Rule 5.5 (unauthorized practice and MJP)

Statutes:

Business and Professions Code section 6068, subdivision (e)
Business and Professions Code sections 6125 through 6133
California Rules of Court 9.40 through 9.48

Cases:

Smith v. State Bar (1985) 38 Cal.3d 525, 540 [213 Cal.Rptr. 236], on the competence duty under former rules
Birbrower, Montalbano, Condon & Frank, P.C. v. Sup. Ct. (1998) 17 Cal.4th 119, 128 to 129, on practicing California law without physical presence
In re Estate of Condon (1998) 65 Cal.App.4th 1138, 1145 to 1146, on cross-border practice
Florida Bar re Advisory Opinion - Out-of-State Attorney Working Remotely from Florida Home, No. SC20-1220 (Fla. 2021) 318 So.3d 538

Other opinions cited:

California State Bar Formal Opinions 1997-150, 2010-179, 2012-184, 2015-193, 2020-203
ABA Formal Ethics Opinions 477R (2017), 482 (2018), 483 (2018), 495 (2020), 498 (2021)
Colorado Bar Ethics Opinion 89 (revised March 12, 2018)
D.C. Court of Appeals Opinion 24-20 (2020)
Delaware State Bar Committee Opinion 2021-1
Illinois State Bar Professional Conduct Advisory Opinion 16-06
New Jersey UPL Committee Opinion 59 and ACPE Opinion 742 (2021)
New York State Bar Opinions 842 (2010), 939 (2012)
Oregon State Bar Ethics Opinion 2011-188 (revised 2015); Oregon Coronavirus Legal Ethics FAQ (2020)
Pennsylvania Bar Committee on Legal Ethics Opinion 2011-200
Utah Ethics Advisory Committee Opinion 19-03 (2019)
Bar Association of San Francisco Ethics Opinion 2021-1

Source

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

THE STATE BAR OF CALIFORNIA
STANDING COMMITTEE ON
PROFESSIONAL RESPONSIBILITY AND CONDUCT
FORMAL OPINION NO. 2023-208

ISSUE: What are a California lawyer's ethical duties when working remotely?

DIGEST: Remote practice does not alter a lawyer's ethical duties under the California Rules of Professional Conduct and the State Bar Act. Managerial lawyers must implement reasonable measures, policies, and practices to ensure continued compliance with these rules in a remote working environment, with a particular focus on the duties of confidentiality, technology competence, communication, and supervision.

AUTHORITIES INTERPRETED: Rules 1.1, 1.3, 1.4, 1.6, 5.1–5.3, and 5.5 of the Rules of Professional Conduct of the State Bar of California. Business and Professions Code section 6068, subdivision (e). Business and Professions Code sections 6125 et seq.

STATEMENT OF FACTS

A law firm ("Law Firm") decides that it would like to provide its lawyers and staff with the flexibility to work remotely and plans to move to a smaller, shared office space. Law Firm plans to implement a hybrid work environment to provide its lawyers and staff with the flexibility to work remotely and in the physical office when necessary. It plans to rent shared workspace for its new physical office. Law Firm wants to know what ethical obligations arise for Law Firm and its lawyers as a result of this anticipated transition to its working environment.

INTRODUCTION

In response to advances in technology, the California wildfires, the COVID-19 pandemic, and other circumstances, more and more lawyers are working remotely. The same Rules of Professional Conduct that apply to attorneys practicing in traditional law firm offices apply to attorneys practicing remotely. The application of the rules, however, raises unique issues for lawyers working remotely. This opinion will focus on the primary rules that may be implicated by a lawyer's remote legal practice. While this opinion presents hypothetical facts to provide one common example, the ethical obligations discussed herein would apply to lawyers who work remotely regardless of the underlying reasons or whether a traditional, physical office space remains available.

DISCUSSION

Duty of Confidentiality, Rule 1.6; Business and Professions Code Section 6068, Subdivision (e)

Because more lawyers and staff will be working remotely, Law Firm needs to ensure that the technology it uses to facilitate remote practice is consistent with applicable ethical obligations, including the duty of confidentiality. Many of this committee's ethics opinions emphasize that lawyers must take reasonable measures to safeguard confidential client information when using technology to transmit and store confidential client information. Law Firm may use third-party cloud providers to store or backup confidential client files or other technology solution vendors to facilitate remote practice. In doing so, Law Firm's managerial and supervisory lawyers must engage in reasonable efforts to ensure that these vendors' conduct is compatible with the lawyers' ethical obligations. Reasonable measures include investigating the provider's reputation, history, security, and backup measures; limiting access to confidential information; carefully reviewing the terms of service to ensure that they contain adequate provisions concerning data security and the handling of breaches of confidentiality; and periodically reviewing and monitoring providers' policies, practices, and procedures to ensure that they remain compatible with the lawyers' ethical obligations. If a lawyer is unable to evaluate the security of the technology used, the lawyer must seek additional information, or consult with someone who possesses the requisite knowledge to ensure compliance with the lawyer's duties of competence and confidentiality.

When working from home, lawyers must implement reasonable measures to safeguard confidential client information, particularly if other household members share or have access to a home computer, laptop, or printer.

Reasonable security measures might include creating separate accounts for household members, implementing two-factor authentication, strong passwords, and automatic logging off when the computer becomes inactive, and disabling the listening capability of smart speakers, virtual assistants, or other listening-enabled devices unless needed to assist with legal services. To the extent physical files are used, lawyers must ensure that they are stored and disposed of securely. This opinion does not intend to set forth specific mandatory measures as technology and associated risks are continually evolving and the reasonableness of security measures will depend upon multiple factors, including the client's instructions or needs, the sensitivity of the information, the remote working environment (e.g., kitchen/dining room office or backyard), and the presence of third parties, such as household members, neighbors, and repair workers. The failure to implement reasonable security measures may jeopardize the duty of confidentiality or the attorney-client privilege.

Because Law Firm will be moving to a smaller, shared office space, Law Firm will also need to implement reasonable measures to ensure that confidential client files (hard copy and electronic) are securely stored and not accessible by third parties sharing the office space. This committee and several bar associations have issued ethics opinions addressing lawyers' ethical obligations relating to shared office space, including protecting confidential client information, avoiding client confusion regarding the nature of the relationship among lawyers who share office space, and avoiding conflicts of interest.

Duty of Competence, Rule 1.1

California recently amended rule 1.1 to incorporate a version of Comment [8] to ABA Model Rule 1.1, which is commonly referred to as a lawyer's "duty of technology competence." Our prior ethics opinions also explain a lawyer's duty of technology competence. The duty of technology competence applies to multiple aspects of a lawyer's practice, such as those involving electronic discovery, social media, law practice management, virtual law offices, and remote practice. The ABA Standing Committee on Ethics and Professional Responsibility declined to endorse strict rules relating to a lawyer's duty of technology competence but adopted a "reasonable efforts standard" and "fact-specific approach" based on the ABA Cybersecurity Handbook. This committee agrees that this reasonableness standard applies to a lawyer's duty of technology competence.

Law Firm must ensure that its technology solutions are sufficient to permit lawyers to reasonably access client files while working remotely. Requiring files to be saved to a centralized, secure case management system may help ensure reasonable access, for instance, if local files are lost or corrupted. Law Firm must also regularly back up files to ensure reasonable access in the event of data loss.

Lawyers must also stay abreast of relevant court rules and procedures relating to COVID-19 and other disasters, including the closure or limited hours of courts, and be adequately prepared to render competent legal representation at remote court hearings and conferences.

In addition, a lawyer's duty of competence includes the "mental, emotional, and physical ability reasonably necessary for the performance" of legal services. The health, personal (e.g., school closures, childcare, or other family responsibilities), or financial impacts of pandemics and other disasters may interfere with a lawyer's physical, mental, or emotional ability to competently perform legal services. Similarly, the remote working environment itself may also affect a lawyer's mental or emotional health. The duty to render competent legal services is not excused under these circumstances. Lawyers must take reasonable measures to ensure that they are able to provide competent legal services to their clients even in the event of a disaster. One way of doing so is to plan in advance to ensure that competent representation may still be rendered to clients in the event that a disaster adversely affects a lawyer's ability to render competent and diligent legal services.

Duty of Communication, Rule 1.4

While working remotely, lawyers may increasingly communicate with prospective or current clients via a secure website portal, email, or other form of online communications, instead of through in-person meetings. In communicating with prospective clients, Law Firm should take reasonable steps to avoid forming unintended attorney-client relationships, such as by including disclaimers on its website or other online communications that posted information is not legal advice and that communication through the website does not create an attorney-client relationship. In addition, before entering into an engagement agreement, lawyers should obtain sufficient information from the client to screen for conflicts of interest and ensure that the party they are communicating with is the actual client or someone with authority to act on the client's behalf.

Lawyers also need to ensure that any alternative means of communications with clients are adequate to fulfill their duty of communication. Among other requirements, a lawyer must "reasonably consult with the client about the means by which to accomplish the client's objectives in the representation," and "keep the client reasonably informed about significant developments relating to the representation, including promptly complying with reasonable requests for information and copies of significant documents . . . ." A lawyer must also "explain a matter to the extent reasonably necessary to permit the client to make informed decisions regarding the representation." When using electronic forms of communication, the lawyer must ensure that the client is receiving and understanding the information exchanged. In certain circumstances, teleconferences or videoconferences may be needed. Even if litigation matters are delayed because of an emergency or another disaster, lawyers must continue to maintain communications with clients regarding the status of the case and any significant updates.

Exchanging alternative contact information with clients will help ensure lawyer's continued ability to communicate with clients during an emergency. Confirming schedules and availability with clients, which may be altered during an emergency, may help ensure that clients have sufficient time to review draft responses to discovery, pleadings, and other important documents relating to the representation.

If an emergency or illness adversely affects the lawyer's ability to represent clients, the lawyer must communicate with clients about the effect on the lawyer's representation to permit a client to make an informed decision regarding the representation.

Duty of Supervision, Rules 5.1–5.3

California's rules relating to the duty of supervision reflect three separate sets of duties. First, rule 5.1 requires managerial and supervisory lawyers to make reasonable efforts to ensure compliance by other lawyers with the Rules of Professional Conduct and the State Bar Act. Second, a subordinate lawyer has an independent duty to comply with the rules and cannot simply follow the instruction of the lawyer's supervisor. Third, lawyers responsible for managing non-lawyer staff are responsible for implementing reasonable steps to ensure that the conduct of non-lawyer staff, including independent contractors, is consistent with the lawyer's duties under the Rules of Professional Conduct. In addition, lawyers with managerial authority in a law firm "shall make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that the nonlawyer's conduct is compatible with the professional obligations of the lawyer."

Under the facts presented, Law Firm must ensure that it provides appropriate tools and equipment, technology support, training, and monitoring to its lawyers and staff. Managerial lawyers could consult with appropriate information technology staff or consultants in implementing technology measures to assist with Law Firm's remote practice.

In addition, managerial lawyers at Law Firm must implement reasonable remote policies and practices, such as confidentiality and cybersecurity policies and training, to ensure the security of remote access and that the conduct of its lawyers and non-lawyers complies with the Rules of Professional Conduct. As an example, it is a good practice to carefully review the terms of any client guidelines for outside counsel, which may require specific confidentiality practices and cybersecurity insurance. To the extent Law Firm permits lawyers to use their own devices while working remotely, it is advisable for Law Firm to implement "Bring Your Own Device" (BYOD) policies that require lawyers and staff to maintain the confidentiality of firm and client data on personal devices. Managerial lawyers are responsible for enforcing Law Firm's remote policies and procedures and regularly updating them to keep pace with advances in technology. In addition, all lawyers, including associates, who are working remotely must implement reasonable measures to comply with their professional duties while working remotely regardless of whether Law Firm has implemented any formal policies and procedures.

Managerial lawyers and lawyers overseeing nonlawyers or other lawyers must maintain regular communications to oversee their work. Because Law Firm is maintaining a physical office, in-person trainings or meetings may assist in confirming that everyone is receiving and understanding the directions and guidance being provided. For law firms that decide to transition to "virtual only" environments, it is a good practice to use videoconferencing for important trainings or meetings.

Finally, as described above in connection with the duty of confidentiality, lawyers must adequately vet outside vendors and contractors and oversee their work to ensure it is consistent with the lawyer's ethical obligations. Written nondisclosure or confidentiality agreements may be appropriate for certain vendors as well as procedures to maintain reasonable access and control of client data.

Unauthorized Practice of Law, Rule 5.5 and Business and Professions Code Sections 6125–6133

The committee recognizes that lawyers working remotely may temporarily or permanently relocate to another state where the lawyer is not licensed to practice law. This committee is not authorized to opine on issues of unauthorized practice of law, including whether a particular conduct or activity constitutes the unauthorized practice of law. California licensed lawyers practicing California law remotely in another state where they are not licensed should consult the multijurisdictional practice and unauthorized practice of law rules and authorities of the state where they are physically present. The ABA and some other state bar and local ethics committees have issued opinions regarding unauthorized practice of law considerations for attorneys remotely practicing the law of the jurisdictions in which they are licensed while physically present in a jurisdiction in which they are not admitted.

Lawyers not licensed in California who are working remotely in California should consult rule 5.5(b), California Rules of Court 9.40–9.48, Business and Professions Code sections 6125 et seq. and relevant authorities regarding multijurisdictional practice and the unauthorized practice of law.

CONCLUSION

Lawyers may ethically practice remotely under the Rules of Professional Conduct and the State Bar Act, provided they continue to comply with these rules, including the duties of confidentiality, competence, communication, and supervision. Lawyers must implement reasonable measures to ensure compliance that are tailored to the relevant circumstances and remote working environment.

This opinion is issued by the Standing Committee on Professional Responsibility and Conduct of the State Bar of California. It is advisory only. It is not binding upon the courts, the State Bar of California, its Board of Trustees, any persons, or tribunals charged with regulatory responsibilities, or any licensee of the State Bar.

[Publisher's Note: Internet resources cited in this opinion were last accessed by staff on April 13, 2023. Copy of these resources are on file with the State Bar's Office of Professional Competence.]