What must a Florida lawyer do to protect client confidentiality on copiers, printers, scanners, and other devices that store data?

Plain-English summary

At the Board of Governors' request, the committee addressed the ethical obligations of lawyers for information stored on the hard drives of devices such as computers, copiers, printers, scanners, phones, flash drives, and fax machines. The opinion observes that copying a document on a hard-drive-equipped copier stores a file that usually remains until overwritten or deleted, so disposing of the device without removing the data can disclose confidential information.

The opinion applies three rules. Under Rule 4-1.6(a), a lawyer must protect all information relating to the representation, whatever its source, and must take reasonable steps to protect confidential information under the lawyer's control. Under Rule 4-1.1, the duty of competence requires the lawyer to keep abreast of changes in technology enough to identify potential threats to confidentiality, learn whether a device can store and expose confidential information and who can access it, and know when protection is needed and which devices must be sanitized; that duty runs from when the lawyer obtains control of the device through its life cycle and disposition. Under Rule 4-5.3(b), the lawyer must take reasonable steps so that nonlawyers, including outside vendors who service or maintain the devices, adhere to the duty of confidentiality, and must obtain adequate assurances from any nonlawyer who will have access to confidential information.

On sanitization, the opinion concludes that a lawyer has a duty to obtain adequate assurances that a device has been stripped of confidential information before disposition, and that a mere agreement that a vendor will sanitize the device on sale or lease turn-back is not sufficient. The lawyer has an affirmative obligation to ascertain that sanitization occurred, by meaningful confirmation, by having it done at the lawyer's office, or by similar means. The opinion also addresses use of devices in public places such as copy centers and hotel business centers, where the lawyer should inquire whether use would preserve confidentiality.

In practice

Under the Florida rules as they stood at the time of this 2010 opinion, a lawyer who uses devices with storage media must take reasonable steps to keep client information confidential and to confirm the device is sanitized before disposition. The opinion sets out four steps: identifying the threat and adopting policies to address it, inventorying devices that contain hard drives or other storage media, supervising nonlawyers to obtain adequate assurance of confidentiality, and confirming or certifying sanitization at disposition. The opinion makes the duty of competence the basis for keeping current with the relevant technology, and frames the vendor-assurance obligation as affirmative: an agreement to sanitize is not enough without confirmation that sanitization occurred. It notes that legal questions, such as statutes governing disclosure of medical records or social security numbers, are beyond the scope of an ethics opinion.

Common questions

Q: Does a Florida lawyer have to worry about the hard drive in an office copier or printer?

A: Yes. The opinion treats copiers, printers, scanners, fax machines, and similar devices with storage media as capable of storing confidential client information, which triggers the duties of confidentiality and competence.

Q: Is it enough to have the leasing company agree to wipe the copier when the lease ends?

A: No. The opinion concludes that a mere agreement that the vendor will sanitize the device is not sufficient; the lawyer must ascertain that sanitization actually occurred, by meaningful confirmation, by having it done at the office, or by similar means.

Q: What does the duty of competence require regarding device technology?

A: Per the opinion, the lawyer must keep abreast of changes in technology enough to identify potential threats to confidentiality, including whether a device stores confidential information, who can access it, and which devices must be sanitized before disposal.

Q: Does the duty extend to outside vendors who service the devices?

A: Yes. Under Rule 4-5.3(b), the opinion extends the supervisory duty to nonlawyers outside the firm with whom the lawyer contracts for device care and maintenance, requiring adequate assurances of confidentiality from any nonlawyer with access to confidential information.

Background and rules framework

The opinion interprets three Rules Regulating The Florida Bar: Rule 4-1.1 (competence, Model Rule 1.1), Rule 4-1.6(a) (confidentiality of information, Model Rule 1.6), and Rule 4-5.3(b) (responsibilities regarding nonlawyer assistants, Model Rule 5.3). It reads the competence duty to include keeping abreast of relevant technology and the confidentiality duty to cover all information relating to the representation, whatever its source.

Citations and references

Rules of Professional Conduct:

• Model Rule 1.1 / Fla. Rule 4-1.1 (competence)
• Model Rule 1.6 / Fla. Rule 4-1.6(a) (confidentiality of information)
• Model Rule 5.3 / Fla. Rule 4-5.3(b) (supervision of nonlawyer assistants)

See also

• Florida Bar Op. 12-3: Cloud Computing
• Florida Bar Op. 24-1: Generative AI in Law Practice

Source

• Landing page: https://www.floridabar.org/etopinions/etopinion-10-2/
• Original PDF: https://www-media.floridabar.org/uploads/2017/04/FL-Bar-Ethics-Op-10-2.pdf

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

FLORIDA BAR ETHICS OPINION
OPINION 10-2
September 24, 2010
Advisory ethics opinions are not binding.
A lawyer who chooses to use Devices that contain Storage Media such as printers, copiers, scanners, and facsimile machines must take reasonable steps to ensure that client confidentiality is maintained and that the Device is sanitized before disposition, including: (1) identification of the potential threat to confidentiality along with the development and implementation of policies to address the potential threat to confidentiality; (2) inventory of the Devices that contain Hard Drives or other Storage Media; (3) supervision of nonlawyers to obtain adequate assurances that confidentiality will be maintained; and (4) responsibility for sanitization of the Device by requiring meaningful assurances from the vendor at the intake of the Device and confirmation or certification of the sanitization at the disposition of the Device. RPC: 4-1.1, 4-1.6(a), 4-5.3(b) The Professional Ethics Committee has been asked by the Florida Bar Board of Governors to write an opinion addressing the ethical obligations of lawyers regarding information stored on hard drives. An increasing number of devices such as computers, printers, copiers, scanners, cellular phones, personal digital assistants (“PDA’s”), flash drives, memory sticks, facsimile machines and other electronic or digital devices (collectively, “Devices”) now contain hard drives or other data storage media1 (collectively “Hard Drives” or “Storage Media”) that can store information.2 Because many lawyers use these Devices to assist in the practice of law and in doing so intentionally and unintentionally store their clients’ information on these Devices, it is important for lawyers to recognize that the ability of the Devices to store information may present potential ethical problems for lawyers. For example, when a lawyer copies a document using a photocopier that contains a hard drive, the document is converted into a file that is stored on the copier’s hard 1 As used in this opinion, Storage Media is any media that stores digital representations of documents. 2 See Brian Smithson, The IEEE 2600 Series: An Introduction to New Security Standards for Hardcopy Devices, ISSA JOURNAL, Nov. 2009, at 28; Holly Herman, Experts Warn Copiers Can Be Fertile Ground for ID Thieves, READING EAGLE (Jun. 2, 2010, 12:28:54 P.M.), http://readingeagle.com/article.aspx?id=222523; Mark Huffman, Digital Copiers Could Be an Identity Theft Threat, ConsumerAffairs.com (May 19, 2010), http://www.consumeraffairs.com/news04/2010/05/digital_copiers.html; Armen Keteyian, Digital Photocopiers Loaded with Secrets, CBSNews.com (April 15, 2010), http://www.cbsnews.com/stories/2010/04/19/eveningnews/main6412439.shtml; Gregg Kelzer, Photocopiers: The Newest ID Theft Threat, COMPUTERWORLD (March 14, 2007), http://www.computerworld.com/s/article/9013104/Photocopiers_The_newest_ID_theft_threat.

Page 2

drive. This document usually remains on the hard drive until it is overwritten or deleted. The lawyer may choose to later sell the photocopier or return it to a leasing company. Disposal of the device without first removing the information can result in the inadvertent disclosure of confidential information. Duty of Confidentiality Lawyers have an ethical obligation to protect information relating to the representation of a client. Rule 4-1.6(a) of the Rules Regulating the Florida Bar addresses the duty of confidentiality and states: (a) Consent Required to Reveal Information. A lawyer shall not reveal information relating to representation of a client except as stated in subdivisions (b), (c), and (d), unless the client gives informed consent. The comment to the rule further states: The confidentiality rule applies not merely to matters communicated in confidence by the client but also to all information relating to the representation, whatever its source. A lawyer may not disclose such information except as authorized or required by the Rules of Professional Conduct or by law. A lawyer must ensure confidentiality by taking reasonable steps to protect all confidential information under the lawyer’s control. Those reasonable steps include identifying areas where confidential information could be potentially exposed. Rule 4-1.1 addresses a lawyer’s duty of competence: Competence A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness, and preparation reasonably necessary for the representation. The comment to the rule further elaborates: To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, engage in continuing study and education, and comply with all continuing legal education requirements to which the lawyer is subject. (emphasis added). If a lawyer chooses to use these Devices that contain Storage Media, the lawyer has a duty to keep abreast of changes in technology to the extent that the lawyer can identify potential threats to maintaining confidentiality. The lawyer must learn such details as whether the Device has the ability to store confidential information, whether the information can be accessed by unauthorized parties, and who can potentially have access to the information. The lawyer must also be aware of different environments in which confidential information is exposed such as public copy centers, hotel business centers,

Page 3

and home offices. The lawyer should obtain enough information to know when to seek protection and what Devices must be sanitized, or cleared of all confidential information, before disposal or other disposition. Therefore, the duty of competence extends from the receipt, i.e., when the lawyer obtains control of the Device, through the Device’s life cycle, and until disposition of the Device, including after it leaves the control of the lawyer. Further, while legal matters are beyond the scope of an ethics opinion, a lawyer should be aware that depending on the nature of the information, misuse of these Devices could result in inadvertent violation of state and federal statutes governing the disclosure of sensitive personal information such as medical records, social security numbers, criminal arrest records, etc. Duty to Supervise The lawyer must regulate not only the lawyer’s own conduct but must take reasonable steps to ensure that all nonlawyers over whom the lawyer has supervisory responsibility adhere to the duty of confidentiality as well. Rule 4-5.3(b) states: (b) Supervisory Responsibility. With respect to a nonlawyer employed or retained by or associated with a lawyer or an authorized business entity as defined elsewhere in these Rules Regulating The Florida Bar: (1) a partner, and a lawyer who individually or together with other lawyers possesses comparable managerial authority in a law firm, shall make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that the person’s conduct is compatible with the professional obligations of the lawyer; (2) a lawyer having direct supervisory authority over the nonlawyer shall make reasonable efforts to ensure that the person’s conduct is compatible with the professional obligations of the lawyer; and (3) a lawyer shall be responsible for conduct of such a person that would be a violation of the Rules of Professional Conduct if engaged in by a lawyer if: (A) the lawyer orders or, with the knowledge of the specific conduct, ratifies the conduct involved; or (B) the lawyer is a partner or has comparable managerial authority in the law firm in which the person is employed, or has direct supervisory authority over the person, and knows of the conduct at a time when its consequences can be avoided or mitigated but fails to take reasonable remedial action. A lawyer’s supervisory responsibility extends not only to the lawyer’s own employees but over entities outside the lawyer’s firm with whom the lawyer contracts to assist in the care and maintenance of the Devices in the lawyer’s control. If a nonlawyer

Page 4

will have access to confidential information, the lawyer must obtain adequate assurances from the nonlawyer that confidentiality of the information will be maintained. Sanitization A lawyer has a duty to obtain adequate assurances that the Device has been stripped of all confidential information before disposition of the Device. If a vendor or other service provider is involved in the sanitization of the Device, such as at the termination of a lease agreement or upon sale of the Device, it is not sufficient to merely obtain an agreement that the vendor will sanitize the Device upon sale or turn back of the Device. The lawyer has an affirmative obligation to ascertain that the sanitization has been accomplished, whether by some type of meaningful confirmation, by having the sanitization occur at the lawyer’s office, or by other similar means. Further, a lawyer should use care when using Devices in public places such as at copy centers, hotel business centers, and outside offices where the lawyer and those under the lawyer’s supervision have little or no control. In such situations, the lawyer should inquire and determine whether use of such Devices would preserve confidentiality under these rules. In conclusion, when a lawyer chooses to use Devices that contain Storage Media, the lawyer must take reasonable steps to ensure that client confidentiality is maintained and that the Device is sanitized before disposition. These reasonable steps include: (1) identification of the potential threat to confidentiality along with the development and implementation of policies to address the potential threat to confidentiality; (2) inventory of the Devices that contain Hard Drives or other Storage Media; (3) supervision of nonlawyers to obtain adequate assurances that confidentiality will be maintained; and (4) responsibility for sanitization of the Device by requiring meaningful assurances from the vendor at the intake of the Device and confirmation or certification of the sanitization at the disposition of the Device.