Can a Florida lawyer store client files in the cloud using services like Dropbox or Google Drive?

Plain-English summary

At the Board of Governors' direction, the opinion addresses lawyers' use of cloud computing, which it defines as internet-based services where files are stored on a third party's remote servers and accessed over the web. It identifies the concerns as confidentiality, competence, and supervision of nonlawyers, because the arrangement places client data with an outside provider used by others.

The opinion applies Rule 4-1.6 and reasons that a lawyer must keep confidential all information relating to a client's representation, must ensure nonlawyers (including third-party providers) maintain that confidentiality, and must stay current with the technology being used, consistent with Florida Opinions 07-2 and 10-2. Surveying opinions from Alabama, Arizona, Iowa, Nevada, New York State, and Pennsylvania, the committee agrees that cloud computing is permissible if the lawyer takes reasonable steps to address its risks.

The opinion concludes that lawyers must perform due diligence on the provider. Drawing on New York State Opinion 842 and Iowa Opinion 11-01, it lists steps such as confirming an enforceable confidentiality obligation and breach or process notification, investigating the provider's security and recovery measures, ensuring the lawyer has unrestricted access to the lawyer's own data while restricting others' access, checking encryption and password protection, reviewing the user agreement (including liability limits, choice of law, and what happens to data on termination), and considering whether sensitive matters need additional security or a separate copy of the data.

In practice

Under the Florida rule as it stood at the time of this 2013 opinion (affirmed with slight modification by the Board of Governors on July 26, 2013), using cloud computing is permitted when the lawyer takes reasonable precautions and performs due diligence on the provider. The opinion makes the controlling factors whether the provider maintains adequate security, whether the lawyer retains adequate access to the stored data, and whether the lawyer has researched the provider. The opinion frames these as reasonable-care steps rather than a fixed checklist, and notes some matters may warrant additional security.

Common questions

Q: Is it ethical for a Florida lawyer to keep client files on Dropbox or a similar service?

A: Yes, under this opinion, if reasonable precautions are taken. The opinion concludes cloud computing is permissible as long as the lawyer ensures confidentiality, confirms the provider's security, retains adequate access, and researches the provider first.

Q: What due diligence does the opinion expect before using a cloud provider?

A: Drawing on New York and Iowa opinions, it expects the lawyer to confirm an enforceable confidentiality and notification obligation, investigate the provider's security and recovery measures, ensure the lawyer keeps full access while others are restricted, and review encryption, the user agreement, and what happens to data on termination.

Q: Does using a cloud provider relieve the lawyer of responsibility for the data?

A: No. The opinion treats the provider as a nonlawyer the lawyer must supervise, so the lawyer remains obligated to ensure the provider maintains confidentiality under Rule 4-1.6 and Florida Opinions 07-2 and 10-2.

Background and rules framework

The opinion interprets Rule 4-1.6 (confidentiality of information, Model Rule 1.6) of the Rules Regulating The Florida Bar, together with the lawyer's duties of competence and supervision of nonlawyers reflected in Florida Opinions 07-2 (overseas paralegals) and 10-2 (electronic device disposal and staying current with technology).

Citations and references

Rules of Professional Conduct:

• Model Rule 1.6 / Fla. Rule 4-1.6 (confidentiality of information)

Other opinions cited:

• Fla. Ethics Ops. 07-2, 10-2
• Alabama Op. 2010-02; Arizona Op. 09-04; Iowa Op. 11-01; Nevada Formal Op. 33; New York State Op. 842; Pennsylvania Op. 2011-200

See also

• Florida Bar Op. 24-1: Generative AI in Law Practice
• Florida Bar Op. 21-2: Web Payment Services and Trust Funds
• CA COPRAC Op. 2016-195: Client Secrets and Publicly Available Information

Source

• Landing page: https://www.floridabar.org/etopinions/etopinion-12-3/
• Original PDF: https://www-media.floridabar.org/uploads/2017/04/FL-Bar-Ethics-Op-12-3.pdf

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

FLORIDA BAR ETHICS OPINION
OPINION 12-3
January 25, 2013
Advisory ethics opinions are not binding.
Lawyers may use cloud computing if they take reasonable precautions to ensure that
confidentiality of client information is maintained, that the service provider maintains adequate
security, and that the lawyer has adequate access to the information stored remotely. The lawyer
should research the service provider to be used.
Note: This opinion was affirmed by the Board of Governors with slight modification on
July 26, 2013.
RPC: 4-1.6
Opinions: 10-2, 07-2, Alabama 2010-02, Arizona 09-04, Iowa 11-01, Nevada 33, New York
State 842, Pennsylvania 2011-200
The Professional Ethics Committee has been directed by The Florida Bar Board of
Governors to issue an opinion regarding lawyers’ use of cloud computing. “Cloud computing” is
defined as “Internet-based computing in which large groups of remote servers are networked so
as to allow sharing of data-processing tasks, centralized data storage, and online access to
computer services or resources.”1 It is also defined as “A model of computer use in which
services stored on the internet are provided to users on a temporary basis.”2 Because cloud
computing involves the use of a third party as a provider of services and involves the storage and
use of data at a remote location that is also used by others outside an individual law firm, the use
of cloud computing raises ethics concerns of confidentiality, competence, and proper supervision
of nonlawyers.
In other words, cloud computing involves use of an outside service provider which
provides computing software and data storage from a remote location that the lawyer accesses
over the Internet via a web browser, such as Internet Explorer, or via an “app” on smart phones
and tablets. The lawyer’s files are stored at the service provider’s remote server(s). The lawyer
can thus access the lawyer’s files from any computer or smart device and can share files with
others. Software is purchased, maintained, and updated by the service provider. Many lawyers
and others are computing “in the cloud” because of convenience and potential cost savings.
The main concern regarding cloud computing relates to confidentiality. Lawyers have an
obligation to maintain as confidential all information that relates to a client’s representation,
regardless of the source. Rule 4-1.6, Rules Regulating The Florida Bar. A lawyer may not
voluntarily disclose any information relating to a client’s representation without either
1 Collins English Dictionary - Complete & Unabridged 10th Edition. HarperCollins Publishers. 10 Sep. 2012.
.
2 Id.

application of an exception to the confidentiality rule or the client’s informed consent. Id. A
lawyer has the obligation to ensure that confidentiality of information is maintained by
nonlawyers under the lawyer’s supervision, including nonlawyers that are third parties used by
the lawyer in the provision of legal services. See, Florida Ethics Opinion 07-2 and 10-2.
Additionally, this Committee has previously opined that lawyers have an obligation to
remain current not only in developments in the law, but also developments in technology that
affect the practice of law. Florida Ethics Opinion 10-2. Lawyers who use cloud computing
therefore have an ethical obligation to understand the technology they are using and how it
potentially impacts confidentiality of information relating to client matters, so that the lawyers
may take appropriate steps to comply with their ethical obligations.
Other states that have addressed the issue of cloud computing have generally determined
that there are ethics concerns regarding confidentiality of information, but that a lawyer may
compute via the cloud if the lawyer takes reasonable steps. See, e.g., Alabama Ethics Opinion
2010-02 (Lawyer may outsource storage of client files through cloud computing if they take
reasonable steps to make sure data is protected); Arizona Ethics Opinion 09-04 (2009) (Lawyer
may use online file storage and retrieval system that enables clients to access their files over the
Internet, as long as the firm takes reasonable precautions to protect confidentiality of the
information); Iowa Ethics Opinion 11-01 (2011) (Appropriate due diligence a lawyer should
perform before storing files electronically with a third party using SaaS (cloud computing),
includes determining that the lawyer will have adequate access to the stored information, the
lawyer will be able to restrict access of others to the stored information, whether data is
encrypted and password protected, and what will happen to the information in the event the
lawyer defaults on an agreement with the third party provider or terminates the relationship with
the third party provider); Nevada Formal Ethics Opinion 33 (2006) (Attorney may store client
files electronically on a remote server controlled by a third party as long as the firm takes
precautions to safeguard confidential information such as obtaining the third party’s agreement
to maintain confidentiality); New York State Bar Ethics Opinion 842 (2010) (Lawyer may use an
online computer data storage system to store client files provided the attorney takes reasonable
care to maintain confidentiality, and the lawyer must stay informed of both technological
advances that could affect confidentiality and changes in the law that could affect privilege); and
Pennsylvania Ethics Opinion 2011-200 (“An attorney may ethically allow client confidential
material to be stored in ‘the cloud’ provided the attorney takes reasonable care to assure that (1)
all such materials remain confidential, and (2) reasonable safeguards are employed to ensure that
the data is protected from breaches, data loss and other risks”).
This Committee agrees with the opinions issued by the states that have addressed the
issue. Cloud computing is permissible as long as the lawyer adequately addresses the potential
risks associated with it. As indicated by other states that have addressed the issue, lawyers must
perform due diligence in researching the outside service provider(s) to ensure that adequate
safeguards exist to protect information stored by the service provider(s). New York State Bar
Ethics Opinion 842 suggests the following steps involve the appropriate due diligence:
• Ensuring that the online data storage provider has an enforceable obligation to
preserve confidentiality and security, and that the provider will notify the lawyer
if served with process requiring the production of client information;

• Investigating the online data storage provider’s security measures,
policies, recoverability methods, and other procedures to determine if they
are adequate under the circumstances;
• Employing available technology to guard against reasonably foreseeable
attempts to infiltrate the data that is stored.
Of particular practical assistance is Iowa Ethics Opinion 11-01. As suggested by the
Iowa opinion, lawyers must be able to access the lawyer’s own information without limit, others
should not be able to access the information, but lawyers must be able to provide limited access
to third parties to specific information, yet must be able to restrict their access to only that
information. Iowa Ethics Opinion 11-01 also recommends considering the reputation of the
service provider to be used, its location, its user agreement and whether it chooses the law or
forum in which any dispute will be decided, whether it limits the service provider’s liability,
whether the service provider retains the information in the event the lawyer terminates the
relationship with the service provider, what access the lawyer has to the data on termination of
the relationship with the service provider, and whether the agreement creates “any proprietary or
user rights” over the data the lawyer stores with the service provider. It also suggests that the
lawyer determine whether the information is password protected, whether the information is
encrypted, and whether the lawyer will have the ability to further encrypt the information if
additional security measures are required because of the special nature of a particular matter or
piece of information. It further suggests that the lawyer consider whether the information stored
via cloud computing is also stored elsewhere by the lawyer in the event the lawyer cannot access
the information via “the cloud.”
This Committee agrees with the advice given by both Iowa and New York State.
Additionally, this Committee believes that the lawyer should consider whether the lawyer should
use the outside service provider or use additional security in specific matters in which the lawyer
has proprietary client information or has other particularly sensitive information.
In summary, lawyers may use cloud computing if they take reasonable precautions to
ensure that confidentiality of client information is maintained, that the service provider maintains
adequate security, and that the lawyer has adequate access to the information stored remotely.
The lawyer should research the service provider to be used.