Ezel / Ethics Opinions / COBAR

What security measures did revised Colorado Ethics Opinion 90 require when lawyers used email, smartphones, wireless networks, and other communications technology?

Short answer The revised opinion required reasonable, risk-based efforts to prevent unauthorized access or disclosure. Routine unencrypted email and smartphone calls were not per se improper, but sensitive matters or insecure environments could require stronger safeguards and client consultation.
Bar
COBAR
Issued
November 14, 1992
Source
View Original PDF

Apply this to your situation

This page answers the general question as of 1992. Ask about yours and see what the current Colorado Rules of Professional Conduct say for your facts, with citations.

Disclaimer: Advisory only. Not binding precedent.
About this page: The plain-English summary, reader guidance, and Q&A below were written by Ezel based on the official ethics opinion. The original opinion (linked on this page as a PDF) is the authoritative source for any reliance.
View original ethics opinion (PDF)

Plain-English summary

Revised Opinion 90 interpreted Rule 1.6(c) as requiring reasonable efforts to prevent inadvertent or unauthorized disclosure of, or access to, client information. Reasonableness depended on the information's sensitivity, likelihood of disclosure, cost and difficulty of safeguards, and the effect of security measures on the representation. The Committee agreed with ABA Formal Opinion 477R's process-based approach of assessing risks, implementing responsive measures, verifying them, and updating them as technology changed.

The opinion concluded that routine use of unencrypted email and smartphones did not by itself violate Rule 1.6 when the method afforded a reasonable expectation of confidentiality and basic security measures were in place. Special circumstances could require encryption or other stronger protection. It identified risks from public wireless networks, public conversations or screens, weak passwords, lost or stolen devices, outdated software, and mistaken recipients.

Reasonable efforts could include written security practices, inspection for attacks or theft, current antivirus tools and firewalls, patches, strong changing passwords, avoiding insecure public file-sharing services, device-disablement capabilities, and training for lawyers and staff. A confidentiality footer did not substitute for care. Rules 1.1 and 1.4 also required technological competence and, when relevant, consultation about security choices or a client's request for special measures.

Currency note

This opinion was originally issued in 1992 and revised in July 2018 after Colorado's 2008 revisions to the Rules of Professional Conduct. Technology, security threats, data-protection law, and professional rules continue to change. Treat this page as historical context and verify current rules, later opinions, and current technical safeguards before relying on a specific security measure.

Common questions

Q: Did the opinion require encryption for every client email?

A: No. It concluded that routine unencrypted email was not per se improper when basic security measures were used, while particularly sensitive information or special circumstances could require encryption.

Q: Were smartphone calls permitted?

A: Yes, ordinarily. The opinion concluded that smartphone use generally afforded a reasonable expectation of confidentiality but still required reasonable care in the environment and device settings.

Q: What did the opinion say about public wireless networks?

A: It stated that insecure or vulnerable public connections could require precautions such as encryption, strong passwords, and device-disablement measures, or avoidance of the connection.

Q: Was an email confidentiality notice enough?

A: No. The opinion stated that a footer did not replace reasonable care in choosing the correct recipient, securing the device, and protecting the communication.

Background and rules framework

The revised opinion applied Colorado RPC 1.6(c) and comments [18] and [19] to technological safeguards, Rule 1.1 comment [8] to keeping abreast of communications technology, Rules 5.1 and 5.3 to firm and staff practices, and Rule 1.4 to client consultation about security measures.

Citations and references

Rules of Professional Conduct:

  • Colo. RPC 1.6(c) and comments [18] and [19] (reasonable safeguards)
  • Colo. RPC 1.1 comment [8] (communications and technology competence)
  • Colo. RPC 1.4 (consultation and informed decisions)
  • Colo. RPC 5.1 and 5.3 (lawyer and staff security practices)

Statutes:

  • C.R.S. § 6-1-716 (Colorado Data Breach Law, identified but not analyzed)

Other opinions cited:

  • ABA Formal Opinion 99-413: confidentiality of unencrypted email
  • ABA Formal Opinion 477R: securing protected client communications
  • California Formal Opinion 2010-179: confidentiality and technology
  • Pennsylvania Formal Opinion 2011-200: cloud computing and client property

See also

Source

What do the rules say today, for your facts?

This opinion is from 1992. Ezel checks the current Colorado Rules of Professional Conduct against your situation and cites the rules it relies on.

Opens in Ezel Pro.

  • Checks the law as it stands today, not only this page
  • Cites every source it relies on, so you can verify it
  • Chat, drafting and research in one workspace