May a Missouri lawyer use cloud computing for client information?

Plain-English summary

Rules 4-1.1, 4-1.6(c), and 4-5.3 permit cloud use when the lawyer remains competent and makes reasonable safeguards appropriate to each matter.

The opinion identifies provider terms, transmission and storage security, breach and subpoena notice, data ownership and access, backups, termination handling, legal compliance, reliable availability, third-party access, and storage jurisdiction as relevant areas.

Because adequate practices change with technology, the opinion encourages qualified technical consultation, continuing education, or regular self-study.

In practice

Under this opinion, cloud use is permissible through ongoing vendor diligence and technology competence, not a one-time platform choice.

Common questions

Q: Is cloud computing permitted?

A: Yes, with competence and reasonable safeguards.

Q: Must provider terms be reviewed?

A: Yes, carefully.

Q: Can safeguards change over time?

A: Yes. The opinion recognizes evolving technology and encourages continuing competence.

Background and rules framework

Rule 4-1.1 governs technology competence, Rule 4-1.6(c) confidentiality safeguards, and Rule 4-5.3 vendor supervision.

Citations and references

• Missouri Rules 4-1.1, 4-1.6(c), and 4-5.3; Rule 4-1.6 Comments [15]-[16]; Rule 4-5.3 Comment [3]

See also

• Missouri Informal Op. 2021-12: Virtual Practice
• ABA Formal Op. 498: Virtual Practice

Source

• Landing page: Missouri Informal Opinion 2018-09

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

Question: May Attorney use “cloud computing” in a way that is consistent with Attorney’s ethical obligations?

Answer: Attorney may use cloud computing in the practice of law without violating the Rules of Professional Conduct if Attorney maintains competence in the use of relevant technology (Rule 4–1.1) and makes reasonable efforts to safeguard confidential information from inadvertent or unauthorized disclosure or access, as warranted by the particular facts and circumstances of each client’s matter (Rules 4–1.6(c) and Comments [15] and [16]; Rule 4–5.3 and Comment [3]). Attorney should read carefully the cloud computing provider’s terms and conditions of service. Attorney should ensure adequate provider policies and practices as to (1) ownership and security of client information, and (2) attorney and provider access to client information. Reasonable efforts to safeguard confidential information may include (but are not limited to) ensuring adequate provider policies and practices regarding:

• Security measures protecting confidentiality of client information during transmission and storage;

• Prompt notification of Attorney in the event of a security breach or provider’s receipt of a subpoena for client information;

• Ownership of data solely by Attorney or Attorney’s firm;

• No access rights by the provider to client information, except as required by law;

• Regular data backup by the provider;

• Handling of client information in the event Attorney’s relationship with the provider is terminated;

• Compliance with applicable law regarding data storage and transmission;

• Reliable access to data by Attorney;

• No access to data by third parties, including advertisers, except as required by law; and

• Domestic storage of data, or, alternatively, storage in a jurisdiction subject to United States data protection laws or equivalent.

Because what constitutes adequate provider policies and practices in these areas may change as relevant technology evolves, Attorney is encouraged to consult with a qualified information technology professional, take continuing legal education courses on use of technology in practice, and/or engage in regular self-study of materials from reputable sources to maintain competence in the use of cloud computing in the practice of law.