What must a Missouri lawyer do after a laptop and phone that may contain client information are stolen?

Plain-English summary

A lawyer's office laptop, cell phone, bar card, and credit cards were stolen from a locked vehicle. If a stolen device contains or potentially provides access to information about current or former clients, Rules 4-1.6(c) and 4-1.1 require all reasonably necessary steps to prevent unauthorized access.

The opinion identifies possible steps including deactivating the phone, securing the firm network and offsite data, changing stored passwords, and consulting a qualified information-technology professional when appropriate.

Rule 4-1.4 requires communication with affected clients to the extent reasonably necessary for informed decisions about their representations. The lawyer must also comply with any applicable law requiring notice to people whose personal information was disclosed.

The lawyer must take all necessary steps to prevent unauthorized transfers from the client trust account and should monitor it closely. The opinion also identifies contacting Attorney Enrollment about the bar card and considering e-filing security and the malpractice carrier.

In practice

Under this opinion, the response reaches each system the stolen items could expose: devices, firm networks, offsite data, credentials, client communications, legally required notices, trust funds, bar credentials, and court-filing access. The exact access-control steps remain tied to what is reasonably necessary in the circumstances.

Common questions

Q: Which client information does the duty cover?

A: Information relating to current and former-client representations that a device contains or may permit access to.

Q: What technical steps does the opinion identify?

A: It identifies device deactivation, network and offsite-data security, password changes, and consultation with an information-technology professional when appropriate.

Q: Must affected clients be told?

A: The lawyer must communicate to the extent reasonably necessary for each affected client to make informed decisions about the representation.

Q: Does the opinion address legal breach-notice duties?

A: Yes. The lawyer must comply with applicable law requiring notice about disclosed personal information.

Q: What trust-account response is required?

A: The lawyer must take all necessary steps against unauthorized transfers and should monitor the account closely.

Background and rules framework

Rules 4-1.1 and 4-1.6(c) govern competent protection against unauthorized access. Rules 4-1.4 and 4-1.9(c) address communication and former-client information. Rule 4-1.15(a)(3) and Comment [2] govern trust-account transfer security and monitoring.

Citations and references

Rules of Professional Conduct:

• Missouri Rules 4-1.1, 4-1.4, 4-1.6(c), 4-1.9(c), and 4-1.15(a)(3)
• Missouri Rule 4-1.15 Comment [2]; Preamble [5]

Other opinions cited:

• Missouri Informal Opinion 2017-02

See also

• ABA Formal Op. 483: Data-Breach Obligations
• Colorado Ethics Op. 141: Data-Breach Duties
• California Ethics Op. 2020-203: Data Breaches

Source

• Landing page: Missouri Informal Opinion 2020-26

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

QUESTION: Attorney’s office laptop, cell phone, bar card, and credit cards were stolen out of Attorney’s locked vehicle. What do the Rules of Professional Conduct require Attorney to do?

ANSWER: If a stolen electronic device contains, or provides potential access to, information related to the representation of clients or former clients, Attorney must take all steps reasonably necessary to prevent unauthorized access to the information. See Rules 4–1.6(c) and 4–1.1. These steps may include, but may not be limited to, deactivating the cell phone; taking appropriate steps to secure Attorney’s law firm network and/or data in offsite storage; changing all passwords that may be stored on the electronic device; and consulting with a qualified information technology professional if appropriate. Attorney must communicate with affected clients to the extent reasonably necessary to allow each client to make informed decisions about the representation. Rule 4–1.4; see Rule 4–1.9(c) and Informal Opinion 2017–02. Attorney must comply with any applicable law requiring notice to affected persons regarding disclosure of their personal information. See Preamble to Rule 4 at [5]. Attorney must take all necessary steps to protect the funds in the client trust account from unauthorized transfers and should monitor the trust account closely. See Rule 4–1.15(a)(3) and Comment [2]. To address the stolen bar card, Attorney may contact the Office of Attorney Enrollment of the Supreme Court of Missouri. Attorney may also consider taking steps to protect the security of Attorney’s e-filing account with applicable courts and consulting Attorney’s malpractice insurance carrier for additional advice.