Can a Florida lawyer store client files in the cloud using services like Dropbox or Google Drive?

Plain-English summary

At the Board of Governors' direction, the opinion addresses lawyers' use of cloud computing, which it defines as internet-based services where files are stored on a third party's remote servers and accessed over the web. It identifies the concerns as confidentiality, competence, and supervision of nonlawyers, because the arrangement places client data with an outside provider used by others.

The opinion applies Rule 4-1.6 and reasons that a lawyer must keep confidential all information relating to a client's representation, must ensure nonlawyers (including third-party providers) maintain that confidentiality, and must stay current with the technology being used, consistent with Florida Opinions 07-2 and 10-2. Surveying opinions from Alabama, Arizona, Iowa, Nevada, New York State, and Pennsylvania, the committee agrees that cloud computing is permissible if the lawyer takes reasonable steps to address its risks.

The opinion concludes that lawyers must perform due diligence on the provider. Drawing on New York State Opinion 842 and Iowa Opinion 11-01, it lists steps such as confirming an enforceable confidentiality obligation and breach or process notification, investigating the provider's security and recovery measures, ensuring the lawyer has unrestricted access to the lawyer's own data while restricting others' access, checking encryption and password protection, reviewing the user agreement (including liability limits, choice of law, and what happens to data on termination), and considering whether sensitive matters need additional security or a separate copy of the data.

In practice

Under the Florida rule as it stood at the time of this 2013 opinion (affirmed with slight modification by the Board of Governors on July 26, 2013), using cloud computing is permitted when the lawyer takes reasonable precautions and performs due diligence on the provider. The opinion makes the controlling factors whether the provider maintains adequate security, whether the lawyer retains adequate access to the stored data, and whether the lawyer has researched the provider. The opinion frames these as reasonable-care steps rather than a fixed checklist, and notes some matters may warrant additional security.

Common questions

Q: Is it ethical for a Florida lawyer to keep client files on Dropbox or a similar service?

A: Yes, under this opinion, if reasonable precautions are taken. The opinion concludes cloud computing is permissible as long as the lawyer ensures confidentiality, confirms the provider's security, retains adequate access, and researches the provider first.

Q: What due diligence does the opinion expect before using a cloud provider?

A: Drawing on New York and Iowa opinions, it expects the lawyer to confirm an enforceable confidentiality and notification obligation, investigate the provider's security and recovery measures, ensure the lawyer keeps full access while others are restricted, and review encryption, the user agreement, and what happens to data on termination.

Q: Does using a cloud provider relieve the lawyer of responsibility for the data?

A: No. The opinion treats the provider as a nonlawyer the lawyer must supervise, so the lawyer remains obligated to ensure the provider maintains confidentiality under Rule 4-1.6 and Florida Opinions 07-2 and 10-2.

Background and rules framework

The opinion interprets Rule 4-1.6 (confidentiality of information, Model Rule 1.6) of the Rules Regulating The Florida Bar, together with the lawyer's duties of competence and supervision of nonlawyers reflected in Florida Opinions 07-2 (overseas paralegals) and 10-2 (electronic device disposal and staying current with technology).

Citations and references

Rules of Professional Conduct:

• Model Rule 1.6 / Fla. Rule 4-1.6 (confidentiality of information)

Other opinions cited:

• Fla. Ethics Ops. 07-2, 10-2
• Alabama Op. 2010-02; Arizona Op. 09-04; Iowa Op. 11-01; Nevada Formal Op. 33; New York State Op. 842; Pennsylvania Op. 2011-200

See also

• Florida Bar Op. 24-1: Generative AI in Law Practice
• Florida Bar Op. 21-2: Web Payment Services and Trust Funds
• CA COPRAC Op. 2016-195: Client Secrets and Publicly Available Information

Source

• Landing page: https://www.floridabar.org/etopinions/etopinion-12-3/
• Original PDF: https://www-media.floridabar.org/uploads/2017/04/FL-Bar-Ethics-Op-12-3.pdf

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

FLORIDA BAR ETHICS OPINION
OPINION 12-3
January 25, 2013
Advisory ethics opinions are not binding.
Lawyers may use cloud computing if they take reasonable precautions to ensure that confidentiality of client information is maintained, that the service provider maintains adequate security, and that the lawyer has adequate access to the information stored remotely. The lawyer should research the service provider to be used. Note: This opinion was affirmed by the Board of Governors with slight modification on July 26, 2013. RPC: 4-1.6 Opinions: 10-2, 07-2, Alabama 2010-02, Arizona 09-04, Iowa 11-01, Nevada 33, New York State 842, Pennsylvania 2011-200 The Professional Ethics Committee has been directed by The Florida Bar Board of Governors to issue an opinion regarding lawyers’ use of cloud computing. “Cloud computing” is defined as “Internet-based computing in which large groups of remote servers are networked so as to allow sharing of data-processing tasks, centralized data storage, and online access to computer services or resources.”1 It is also defined as “A model of computer use in which services stored on the internet are provided to users on a temporary basis.”2 Because cloud computing involves the use of a third party as a provider of services and involves the storage and use of data at a remote location that is also used by others outside an individual law firm, the use of cloud computing raises ethics concerns of confidentiality, competence, and proper supervision of nonlawyers. In other words, cloud computing involves use of an outside service provider which provides computing software and data storage from a remote location that the lawyer accesses over the Internet via a web browser, such as Internet Explorer, or via an “app” on smart phones and tablets. The lawyer’s files are stored at the service provider’s remote server(s). The lawyer can thus access the lawyer’s files from any computer or smart device and can share files with others. Software is purchased, maintained, and updated by the service provider. Many lawyers and others are computing “in the cloud” because of convenience and potential cost savings. The main concern regarding cloud computing relates to confidentiality. Lawyers have an obligation to maintain as confidential all information that relates to a client’s representation, regardless of the source. Rule 4-1.6, Rules Regulating The Florida Bar. A lawyer may not voluntarily disclose any information relating to a client’s representation without either 1 Collins English Dictionary - Complete & Unabridged 10th Edition. HarperCollins Publishers. 10 Sep. 2012.
. 2 Id.

application of an exception to the confidentiality rule or the client’s informed consent. Id. A lawyer has the obligation to ensure that confidentiality of information is maintained by nonlawyers under the lawyer’s supervision, including nonlawyers that are third parties used by the lawyer in the provision of legal services. See, Florida Ethics Opinion 07-2 and 10-2. Additionally, this Committee has previously opined that lawyers have an obligation to remain current not only in developments in the law, but also developments in technology that affect the practice of law. Florida Ethics Opinion 10-2. Lawyers who use cloud computing therefore have an ethical obligation to understand the technology they are using and how it potentially impacts confidentiality of information relating to client matters, so that the lawyers may take appropriate steps to comply with their ethical obligations. Other states that have addressed the issue of cloud computing have generally determined that there are ethics concerns regarding confidentiality of information, but that a lawyer may compute via the cloud if the lawyer takes reasonable steps. See, e.g., Alabama Ethics Opinion 2010-02 (Lawyer may outsource storage of client files through cloud computing if they take reasonable steps to make sure data is protected); Arizona Ethics Opinion 09-04 (2009) (Lawyer may use online file storage and retrieval system that enables clients to access their files over the Internet, as long as the firm takes reasonable precautions to protect confidentiality of the information); Iowa Ethics Opinion 11-01 (2011) (Appropriate due diligence a lawyer should perform before storing files electronically with a third party using SaaS (cloud computing), includes determining that the lawyer will have adequate access to the stored information, the lawyer will be able to restrict access of others to the stored information, whether data is encrypted and password protected, and what will happen to the information in the event the lawyer defaults on an agreement with the third party provider or terminates the relationship with the third party provider); Nevada Formal Ethics Opinion 33 (2006) (Attorney may store client files electronically on a remote server controlled by a third party as long as the firm takes precautions to safeguard confidential information such as obtaining the third party’s agreement to maintain confidentiality); New York State Bar Ethics Opinion 842 (2010) (Lawyer may use an online computer data storage system to store client files provided the attorney takes reasonable care to maintain confidentiality, and the lawyer must stay informed of both technological advances that could affect confidentiality and changes in the law that could affect privilege); and Pennsylvania Ethics Opinion 2011-200 (“An attorney may ethically allow client confidential material to be stored in ‘the cloud’ provided the attorney takes reasonable care to assure that (1) all such materials remain confidential, and (2) reasonable safeguards are employed to ensure that the data is protected from breaches, data loss and other risks”). This Committee agrees with the opinions issued by the states that have addressed the issue. Cloud computing is permissible as long as the lawyer adequately addresses the potential risks associated with it. As indicated by other states that have addressed the issue, lawyers must perform due diligence in researching the outside service provider(s) to ensure that adequate safeguards exist to protect information stored by the service provider(s). New York State Bar Ethics Opinion 842 suggests the following steps involve the appropriate due diligence:
• Ensuring that the online data storage provider has an enforceable obligation to preserve confidentiality and security, and that the provider will notify the lawyer if served with process requiring the production of client information;

• Investigating the online data storage provider’s security measures, policies, recoverability methods, and other procedures to determine if they are adequate under the circumstances;
• Employing available technology to guard against reasonably foreseeable attempts to infiltrate the data that is stored. Of particular practical assistance is Iowa Ethics Opinion 11-01. As suggested by the Iowa opinion, lawyers must be able to access the lawyer’s own information without limit, others should not be able to access the information, but lawyers must be able to provide limited access to third parties to specific information, yet must be able to restrict their access to only that information. Iowa Ethics Opinion 11-01 also recommends considering the reputation of the service provider to be used, its location, its user agreement and whether it chooses the law or forum in which any dispute will be decided, whether it limits the service provider’s liability, whether the service provider retains the information in the event the lawyer terminates the relationship with the service provider, what access the lawyer has to the data on termination of the relationship with the service provider, and whether the agreement creates “any proprietary or user rights” over the data the lawyer stores with the service provider. It also suggests that the lawyer determine whether the information is password protected, whether the information is encrypted, and whether the lawyer will have the ability to further encrypt the information if additional security measures are required because of the special nature of a particular matter or piece of information. It further suggests that the lawyer consider whether the information stored via cloud computing is also stored elsewhere by the lawyer in the event the lawyer cannot access the information via “the cloud.” This Committee agrees with the advice given by both Iowa and New York State. Additionally, this Committee believes that the lawyer should consider whether the lawyer should use the outside service provider or use additional security in specific matters in which the lawyer has proprietary client information or has other particularly sensitive information. In summary, lawyers may use cloud computing if they take reasonable precautions to ensure that confidentiality of client information is maintained, that the service provider maintains adequate security, and that the lawyer has adequate access to the information stored remotely. The lawyer should research the service provider to be used.