Can a Massachusetts lawyer store confidential client files in a cloud service like Google Docs?

Plain-English summary

A lawyer wanted to store and synchronize his electronic work files, some containing privileged or confidential client information, across multiple devices using an Internet-based service such as Google Docs or other cloud platforms, so he could access them remotely. The opinion concludes the lawyer generally may do so, subject to conditions tied to the confidentiality duty in Rule 1.6(a).

The opinion holds that the lawyer must undertake reasonable efforts to ensure that the provider's terms of use and data-privacy policies, practices, and procedures are compatible with the lawyer's professional obligations, including the obligation to protect confidential client information. The committee frames this as a reasonable-efforts standard rather than a guarantee of absolute security.

The opinion adds two limits. The lawyer remains bound to follow an express client instruction that the client's confidential information not be stored or transmitted over the Internet. And the committee states that all lawyers should refrain from storing or transmitting particularly sensitive client information over the Internet without first obtaining the client's express consent. These conditions qualify the general permission the opinion grants.

In practice

Under this opinion, using a cloud service to store confidential client files is permitted where the lawyer makes reasonable efforts to confirm that the provider's terms and privacy practices are compatible with the lawyer's Rule 1.6(a) confidentiality obligations. The opinion identifies the provider's terms of use and data-privacy practices as the things the lawyer must evaluate.

The opinion holds that the lawyer must honor an express client instruction against Internet storage or transmission, and states that for particularly sensitive information the lawyer should obtain the client's express consent before cloud storage or transmission.

Common questions

Q: Is cloud storage of confidential client files allowed at all?

A: Yes. The opinion concludes a lawyer generally may use Internet-based storage for confidential files if the lawyer makes reasonable efforts to ensure the provider's terms and privacy practices are compatible with Rule 1.6(a).

Q: What must the lawyer actually check before using a cloud provider?

A: Per the opinion, the lawyer must make reasonable efforts to confirm the provider's terms of use and data-privacy policies, practices, and procedures protect confidential client information.

Q: What if the client does not want files on the Internet?

A: The opinion holds the lawyer must follow an express client instruction not to store or transmit the client's confidential information over the Internet, and should get express consent before cloud-storing especially sensitive information.

Background and rules framework

The opinion interprets Massachusetts Rule of Professional Conduct 1.6(a) (confidentiality of information) as the source of the duty to protect client information in cloud storage, applying a reasonable-efforts standard consistent with the lawyer's competence obligations under Rule 1.1. These correspond to the like-numbered ABA Model Rules.

Citations and references

Rules of Professional Conduct:

• MR 1.6 / Mass. R. Prof. C. 1.6(a) (confidentiality of information)
• MR 1.1 / Mass. R. Prof. C. 1.1 (competence)

See also

• ABA Ethics Op. 477R: securing communication of protected client information
• ABA Ethics Op. 498: virtual practice

Source

• Landing page: https://www.massbar.org/publications/ethics-opinions/ethics-opinion-article/ethics-opinions-2012-opinion-12-03/opinion-12-03