What are a Colorado lawyer's duties for metadata, both when sending electronic documents and when receiving them from the other side?

Plain-English summary

Opinion 119 (adopted May 17, 2008) addresses the ethical handling of metadata, the hidden data embedded in electronic documents (creation and edit dates, authors, tracked changes, comments, spreadsheet formulas). The Committee notes much metadata is insignificant and some is meant to be shared, but some, like hidden comments or redlines, can be "Confidential Information," a term the opinion uses for information subject to a legally recognized protection even if not technically privileged. It treats the question as an application of existing rules and two prior CBA opinions (Op. 90 on technology and confidentiality, Op. 108 on inadvertent disclosure), addressing the sending lawyer and the receiving lawyer separately.

For the sending lawyer, the opinion concludes there is a duty to take reasonable steps to reduce the likelihood that metadata containing confidential information are transmitted, arising from the confidentiality duty of Rule 1.6(a), the competence duty of Rule 1.1, and the supervision duties of Rules 5.1 and 5.3. What reasonable care requires is fact-dependent: a lawyer might avoid redlines or hidden comments, use software to "scrub" files, or print a document where it is vital no metadata be sent, and may retain in-house or outside technology experts. The opinion is firm that the duty cannot be avoided by staying ignorant of the technology; competence requires the lawyer to be reasonably informed about the metadata that documents may contain and how to remove it, and a supervising lawyer must ensure the firm has systems so subordinate lawyers and nonlawyer assistants can control metadata transmission.

For the receiving lawyer, the opinion sides with the ABA, Maryland, and D.C. approach over the New York "mining" prohibition, concluding that nothing in the Colorado Rules generally bars a lawyer from searching for and reviewing metadata, because doing so is not inherently deceitful and metadata often contain no confidential information (and are sometimes meant to be reviewed, as with discovery or negotiated drafts). But once a receiving lawyer knows or reasonably should know that metadata contain confidential information, Rule 4.4(b) applies: the lawyer should assume it was sent inadvertently (absent a known waiver) and must promptly notify the sender. The opinion concludes Rule 4.4(b) and (c) are the specific rules that govern and trump the general misconduct rule 8.4(c), so after notifying, the receiving lawyer (without prior notice from the sender) is not prohibited from continuing to review the document; but under Rule 4.4(c), a lawyer notified of inadvertent transmission before reviewing must not examine the metadata and must follow the sender's instructions. Waiver itself is left to substantive law and the courts.

In practice

The opinion holds that a Colorado sending lawyer must competently guard against transmitting confidential metadata (Rules 1.1, 1.6(a), 5.1, 5.3), with the specific measures depending on the circumstances, and that ignorance of the technology is no defense. For the receiving lawyer, it concludes review of metadata is generally permissible, but the discovery of apparently confidential, inadvertently sent metadata triggers a duty to assume inadvertence and promptly notify the sender under Rule 4.4(b); if the lawyer received advance notice of inadvertent transmission, Rule 4.4(c) bars examining the document. The opinion treats Rule 4.4 as controlling over the general Rule 8.4(c), and leaves questions of privilege waiver to the courts. Because rules and technology in this area have evolved since 2008, a lawyer should confirm Colorado's current Rule 4.4 and related guidance before relying on the specifics.

Common questions

Q: Do I have to remove metadata before sending a document to opposing counsel?

A: You must use reasonable care to avoid disclosing confidential metadata. The opinion grounds this in Rules 1.1, 1.6(a), 5.1, and 5.3, and says what is reasonable depends on the facts, citing options like avoiding redlines, scrubbing files, or printing the document where it is vital no metadata be transmitted.

Q: Can I look at the metadata in a document the other side sent me?

A: Generally yes. The opinion concludes a receiving lawyer may search for and review metadata, rejecting the view that doing so is unethical "mining," because reviewing metadata is not inherently deceitful and metadata often are not confidential and are sometimes meant to be reviewed.

Q: What if I find confidential information in the metadata?

A: Notify the sender. The opinion concludes that if a receiving lawyer knows or reasonably should know the metadata contain confidential information, the lawyer should assume it was sent inadvertently and must promptly notify the sender under Rule 4.4(b).

Q: Does notice from the sender change my obligations?

A: Yes. Under Rule 4.4(c), if the receiving lawyer is told before reviewing a document that confidential information was inadvertently included, the lawyer must not examine the metadata and must abide by the sender's instructions about its disposition.

Q: Can the lawyer use ignorance of the software as an excuse?

A: No. The opinion concludes the duty of competence prevents a sending lawyer from limiting the duty of reasonable care "by remaining ignorant of technology relating to metadata or failing to obtain competent computer support."

Background and rules framework

The opinion interprets the sending lawyer's duties under Colo. RPC 1.6(a) (confidentiality), 1.1 (competence), and 5.1 and 5.3 (supervision), and the receiving lawyer's duties under Colo. RPC 4.4(b) and (c) (inadvertently sent documents), treating Rule 4.4 as more specific than the general misconduct rule 8.4(c). It builds on prior CBA Formal Opinions 90 and 108 and surveys the national split, following ABA Formal Op. 06-442 and the D.C. and Maryland opinions over the contrary New York line.

Citations and references

Rules of Professional Conduct:

• Colo. RPC 1.6(a) / Model Rule 1.6 (confidentiality)
• Colo. RPC 1.1 / Model Rule 1.1 (competence, including technology)
• Colo. RPC 5.1 and 5.3 / Model Rules 5.1, 5.3 (supervision of lawyers and nonlawyer assistants)
• Colo. RPC 4.4(b), 4.4(c) / Model Rule 4.4 (inadvertently sent documents); Colo. RPC 8.4(c) (misconduct)

Cases:

• Rico v. Mitsubishi Motors Corp., 42 Cal. 4th 807 (Cal. 2007), receiving lawyer must stop reviewing inadvertently produced materials (the opinion disagrees)

Other opinions cited:

• ABA Formal Op. 06-442 (2006): review and use of metadata
• CBA Formal Op. 108 (2000): inadvertent disclosure of privileged or confidential documents; CBA Formal Op. 90 (1992): confidentiality and modern technology
• D.C. Ethics Op. 341 (2007); Maryland Op. 2007-09; New York Op. 749 (2001), the split on reviewing metadata

See also

• ABA Formal Op. 06-442: Review and Use of Metadata
• ABA Formal Op. 05-437: Inadvertent Disclosure of Confidential Materials
• CBA Formal Op. 149: Virtual Practice

Source

• Landing page: https://www.cobar.org/ethicsopinions
• Original PDF: https://www.cobar.org/Portals/COBAR/repository/ethicsOpinions/FormalEthicsOpinion_119_2011.pdf