May a Connecticut lawyer use public cloud services to store, transmit, or process client information?

Plain-English summary

The opinion defines public cloud computing as storing, transmitting, or processing client information through shared facilities owned or leased by a third-party provider and accessed over the internet. It treats cloud services as a modern form of outsourcing and remote storage rather than as categorically different from off-site storage of paper records.

Cloud computing is ethically permissible, but the lawyer retains ultimate responsibility for the privacy and security of client data. Rules 1.1 and 1.6 require the lawyer to understand relevant technology, investigate the risks of the selected system and provider, and use safeguards proportionate to the sensitivity of the information and likelihood of unauthorized access or disclosure.

The lawyer must be satisfied that the provider's terms do not diminish the lawyer's ownership of or unfettered access to the data. The provider also must use security measures that segregate the lawyer's information and reasonably prevent unauthorized access, including access by the provider itself.

Rules 1.15, 5.1, and 5.3 add preservation and supervision duties. The provider must be competent and reliable, keep the data backed up and reasonably available, restrict authorized access, and maintain reasonable protection against intrusion. The opinion states that due diligence must continue as technology and applicable standards develop.

In practice

Under this opinion, selecting a cloud vendor is part of the lawyer's confidentiality, competence, property-safeguarding, and supervision duties. The required effort varies with the information's sensitivity, the available safeguards, their cost and difficulty, and their effect on the representation.

Common questions

Q: Is public cloud computing prohibited for Connecticut lawyers?

A: No. The opinion permits it when the lawyer uses a reasonably reliable provider and makes reasonable efforts to prevent unauthorized access or disclosure.

Q: Does hiring the provider transfer responsibility for security?

A: No. The lawyer retains ultimate responsibility even when the provider operates most physical, technical, and administrative safeguards.

Q: What provider characteristics matter under the opinion?

A: The lawyer must assess data ownership and access, segregation and security, backup and availability, authorized-access controls, and the provider's competence and reliability.

Q: Must every type of client information receive identical protection?

A: No. The opinion ties reasonable efforts to factors including sensitivity, likelihood of disclosure, added-safeguard cost and difficulty, and effects on the lawyer's ability to represent clients.

Q: Does a reasonable safeguard failure automatically violate Rule 1.6?

A: No. The quoted Rule 1.6 commentary states that unauthorized access or disclosure is not a violation when the lawyer made reasonable efforts to prevent it.

Background and rules framework

Rules 1.1 and 1.6 govern technological competence and confidentiality. Rule 1.15 treats electronic client files and information as property requiring appropriate safeguards. Rules 5.1 and 5.3 require reasonable supervision of outsourced cloud functions and vendor conduct.

Citations and references

Connecticut Rules of Professional Conduct:

• Rules 1.1, 1.6, 1.15, 1.15(k), 5.1, and 5.3

Other authorities:

• Connecticut Practice Book § 2-27(c)
• National Institute of Standards and Technology Special Publications 800-144, 800-145, and 800-146

Other opinions cited:

• Connecticut Informal Opinion 99-52, unencrypted internet email
• Alabama Ethics Opinion 2010-2
• Arizona Ethics Opinion 09-04 (2009)
• California Ethics Opinion 2010-179
• Florida Ethics Opinion 06-1 (2006)
• Iowa Ethics Opinion 11-01 (2011)
• Illinois Ethics Opinion 10-01 (2009)
• Massachusetts Ethics Opinion 12-03 (2012)
• Maine Ethics Opinion 194 (2008)
• New Hampshire Ethics Opinion 2012-13/4 (2012)
• North Carolina Ethics Opinion 6 (2011)
• North Dakota Ethics Opinion 99-03
• New Jersey Ethics Opinion 107 (2006)
• Nevada Ethics Opinion 33 (2006)
• New York State Ethics Opinion 842 (2010)
• Oregon Ethics Opinion 2011-188 (2011)
• Pennsylvania Ethics Opinion 2011-200 (2011)
• Virginia Ethics Opinion 1818 (2005)
• Vermont Ethics Opinion 2003-03 (2003)

See also

• CT Informal Op. 13-08: Recorded intake calls
• NY State Bar Op. 842: Cloud data storage
• VSB Op. 1818: Electronic-only client files

Source

• Landing page: Connecticut Bar Association Informal Ethics Opinions
• Original PDF: Informal Opinion 13-07