May a New Hampshire lawyer store client data in the cloud, and what steps does that require?

Plain-English summary

Cloud computing is the storage of data and use of applications on remote servers over the Internet rather than on an office computer, and it already underlies tools lawyers use such as smartphones, stored email, and services like Google Docs and Dropbox. The opinion adopts the consensus among the states that have addressed the question: a lawyer may use cloud computing consistent with ethical obligations, as long as the lawyer takes reasonable steps to keep sensitive client information confidential. The opinion addresses cloud storage, not email, which it treats as raising separate issues.

Several rules apply. Under Rule 1.1 (competence), a lawyer must keep abreast of the benefits and risks of relevant technology and understand the technology in use, though the duty is to take reasonable steps, not to become an IT expert. Under Rule 1.6 (confidentiality) and the Rule 1.0(e) informed-consent definition, storing data with a provider may be impliedly authorized if the lawyer makes reasonable efforts to ensure adequate safeguards; for highly sensitive data, client informed consent may be necessary. Under Rule 1.15 (safekeeping property) and Rule 1.16(d), the client's file belongs to the client, must be retrievable and returned, and a provider may not "own" the data. Under Rule 5.3, a cloud provider is in effect a nonlawyer the lawyer must make reasonable efforts to oversee, and Rule 2.1 requires the lawyer to keep independent judgment rather than hide behind an intermediary.

The opinion lists ten considerations for evaluating a provider, including the provider's reputation and security measures, retrievability and format of the data, commingling, data ownership in the terms of service, an enforceable confidentiality obligation, server location and applicable privacy law, retention and destruction on termination, notice of subpoenas, and a disaster-recovery plan. It stresses that the rules do not impose strict liability; the duty is reasonable care, and the duties of confidentiality and competence are ongoing and not delegable.

In practice

The opinion concludes that, under the New Hampshire Rules as they stood when it issued, cloud computing is permissible if the lawyer takes reasonable steps to protect client data, stays competent in the technology, and supervises the provider as a nonlawyer under Rule 5.3. It frames storage as potentially impliedly authorized disclosure when reasonable safeguards exist, and flags that highly sensitive data may require client informed consent. It treats client files in the cloud as client property under Rule 1.15 that must remain retrievable and be returned, and provides a ten-point checklist of provider considerations while disclaiming any strict-liability standard.

Common questions

Q: Can a New Hampshire lawyer store client files in the cloud?

A: Yes. The opinion adopts the multistate consensus that cloud computing is permissible if the lawyer takes reasonable steps to ensure sensitive client information stays confidential and secure.

Q: Does using the cloud require the client's consent?

A: Sometimes. The opinion says storage may be impliedly authorized when reasonable safeguards exist, but where information is highly sensitive, informing the client and obtaining informed consent under Rule 1.0(e) may be necessary.

Q: Does the lawyer have to become a technology expert?

A: No. The opinion states the duty is to take reasonable steps to protect client information, not to become an IT expert, and that the rules do not impose a strict-liability standard.

Q: What should a lawyer check before choosing a cloud provider?

A: The opinion lists ten considerations, including the provider's reputation and security measures, data retrievability and format, whether data is commingled or "owned" by the provider, an enforceable confidentiality obligation, server location and privacy law, retention and destruction terms, subpoena notice, and a disaster-recovery plan.

Q: Who is responsible for the provider's compliance?

A: The lawyer. The opinion treats the provider as a nonlawyer under Rule 5.3 whom the lawyer must make reasonable efforts to oversee, and Rule 2.1 bars the lawyer from hiding behind an intermediary.

Background and rules framework

The opinion interprets New Hampshire Rule 1.1 (competence, including the technology-competence comment), Rule 1.6 (confidentiality) with the Rule 1.0(e) informed-consent definition, Rule 1.15 and Rule 1.16(d) (safekeeping and return of client property and files), Rule 2.1 (independent judgment), and Rule 5.3 (supervision of nonlawyer service providers). It builds on the multistate consensus and on the NHBA's own metadata opinion (2008-2009/04) and outsourcing opinion (2011-12/05), and references New Hampshire's data-breach notification statute.

Citations and references

Rules of Professional Conduct:

• MR 1.1 / NH Rule 1.1 (competence)
• MR 1.6 / NH Rule 1.6 (confidentiality of information)
• MR 1.0 / NH Rule 1.0(e) (informed consent)
• MR 1.15 / NH Rule 1.15 and 1.16(d) (safekeeping and return of property)
• MR 5.3 / NH Rule 5.3 (responsibilities regarding nonlawyer assistants); also NH Rule 2.1

Statutes:

• RSA 359-C:20 (2009) (New Hampshire data-breach notification)

Cases:

• Averill v. Cox, 145 N.H. 328 (2000), the client's file belongs to the client and must be provided on request

Other opinions cited:

• Multistate cloud-computing consensus, including PA 2011-200, AZ 09-04, CA 2010-179, FL 06-1, ME 194, NY 842, NC 2011 FEO 6, and others
• NH Bar Ethics Op. 2008-2009/04 (metadata); NH Bar Ethics Op. 2005-06/3; NH Bar Ethics Op. 2011-12/05 (outsourcing)

See also

• Alaska Bar Op. 2014-3: Cloud Computing and the Practice of Law
• California Bar Op. 2010-179: Confidentiality and Competence Using Technology
• California Bar Op. 2012-184: Virtual Law Office in the Cloud

Source

• Landing page: https://www.nhbar.org/ethics/opinion-2012-13-04
• Original PDF: https://nhba.s3.amazonaws.com/wp-content/uploads/2019/12/14142319/2012-13-04-REFOMATTED-Cloud-Computing-in-the-Practice-of-Law.pdf

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative. NEW HAMPSHIRE BAR ASSOCIATION The Use of Cloud Computing in the Practice of Law Ethics Committee Advisory Opinion ##2012-13/04

ABSTRACT: A New Hampshire lawyer who uses cloud computing must be certain that such use complies with the Rules of Professional Conduct, including, Rule 1.8(c), 1.0(e), 1.1, 1.6, 1.15, 2.1, and 5.3.

ANNOTATIONS:
The internet has changed the practice of law in many ways, including how data is stored and accessed. “Cloud computing” can be an economical and efficient way to store and use data. However, a lawyer who uses cloud computing must be aware of its effect on the lawyer’s professional responsibilities. The NHBA Ethics Committee adopts the consensus among states that a lawyer may use cloud computing consistent with his or her ethical obligations, as long as the lawyer takes reasonable steps to ensure that sensitive client information remains confidential. INTRODUCTION As technology becomes more pervasive in the practice of law, lawyers encounter cloud computing. Cloud computing is the storage of data and the ability to run applications on remote servers over the Internet, rather than on a desktop computer or a server in a law office. Cloud computing is already a part of many devices and services which lawyers use, including smart phones, stored emails, and online data storage services such as Google Docs, Microsoft Office 365, and DropBox.1

Cloud computing offers many benefits. Typically, it is purchased on a subscription basis, usually for a monthly fee, which reduces upfront licensing costs.2 The provider takes over the responsibility for keeping up with new technology and software updates, while the lawyer enjoys access to all the data stored in the cloud from any location which has Internet access. Increased mobility and accessibility, however, may come with the loss of immediate control over the stored or transmitted data. Like any middleman, the provider of cloud computing adds a layer of risk between the lawyer and sensitive client information.

A lawyer who uses cloud computing should therefore be aware of its effect on the lawyer’s professional responsibilities. The consensus among states is that a lawyer may use cloud computing consistent with his or her ethical obligations. To date, every state bar association that has issued an opinion on using cloud computing has said that it is permissible, as long as the lawyer takes reasonable steps to ensure that sensitive client information remains confidential.3 Several rules are implicated by the use of cloud computing. This opinion discusses cloud computing, but not emails. The two are separate and raise different issues. As explained in the Pennsylvania Bar Association’s opinion on cloud computing, email presents unique risks and challenges which must be addressed and mitigated separately: these include “confidentiality, authenticity, integrity, misdirection or forwarding, permanence (wanted e-mail may become lost and unwanted e-mail may remain accessible even if deleted), and malware.”4

Rule 1.1. Competence
A lawyer must provide competent legal representation, and minimal competence requires a lawyer to perform the techniques of practice with skill. Rule 1.1 (b) (2). Techniques of practice include the way a client’s information and the lawyer’s work product are maintained, stored, and organized.5 As the revised Comment [6] to the ABA Model Rule 1.1 states, a lawyer must “keep abreast of changes in the law and its practice, including the benefits or risks associated with relevant technology.”6 The comment was revised recently in response to “the sometimes bewildering pace of technological change,” including cloud computing7 A competent lawyer using cloud computing must understand and guard against the risks inherent in it.

There is no hard and fast rule as to what a lawyer must do with respect to each client when using cloud computing. The facts and circumstances of each case, including the type and sensitivity of client information, will dictate what reasonable protective measures a lawyer must take when using cloud computing. The same rationale applies to the transmission of metadata, as discussed in NH Bar Ethics Op. 2008-2009/04 on the disclosure, review, and use of metadata in electronic materials.

Competent lawyers must have a basic understanding of the technologies they use. Furthermore, as technology, the regulatory framework, and privacy laws keep changing, lawyers should keep abreast of these changes.8

Rule 1.6. Confidentiality of Information and Rule 1.0 (e). Informed Consent Protecting client confidences is one of the most significant obligations imposed upon lawyers and is the core of the attorney-client relationship. Rule 1.6(a) states that “[a] lawyer shall not reveal information relating to the representation of a client[.]” Confidentiality applies not only to matters communicated in confidence by the client, but also to all information related to the representation, whatever its source. See 2004 ABA Model Rule Comment [3]. A lawyer may reveal such information if the client gives informed consent or if the disclosure is impliedly authorized.9

As cloud computing comes into wider use, storing and transmitting information in the cloud may be deemed an impliedly authorized disclosure to the provider, so long as the lawyer takes reasonable steps to ensure that the provider of cloud computing services has adequate safeguards. Recent revisions to Comment [16] to the ABA Model Rule 1.6 note that “if the lawyer has made reasonable efforts to prevent the access or disclosure” of confidential information, then the unauthorized access to, or the inadvertent or unauthorized disclosure of, client information does not constitute a violation of a lawyer’s duty of confidentially.10

The comment sets forth a number of “[f]actors to be considered in determining the reasonableness of the lawyer’s efforts” to prevent such unauthorized access or disclosure. These factors “include, but are not limited to, the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).”11

Not all information is alike. For example, where highly sensitive data is involved, it may become necessary to inform the client of the lawyer’s use of cloud computing and to obtain the client’s informed consent. “‘Informed consent’ denotes the agreement by a person to a proposed course of conduct after the lawyer has communicated adequate information and explanation about the material risks of and reasonably available alternatives to the proposed course of conduct.” Rule 1.0 (e). The material risks and reasonably available alternatives will of course vary by client, scope of representation, the sensitivity of the stored or transmitted information, provider, and other considerations.12 But if the information is highly sensitive, consent of the client to use cloud computing may be necessary. Rule 1.15. Safekeeping Property “Property of clients or third persons which a lawyer is holding in the lawyer’s possession,” other than funds, “shall be identified as property of the client, promptly upon receipt, and safeguarded.” Rule 1.15(a). The New Hampshire Supreme Court has held that the contents of a client’s file belong to the client and that, upon request, an attorney must provide the client with the file. Averill v. Cox, 145 N.H. 328, 339 (2000). Electronic communications are also part of the client’s file. NH Bar Ethics Op. 2005-06/3.

Additionally, Rule 1.16(d) of the New Hampshire Rules of Professional Conduct states that, as a condition to termination of representation, a lawyer shall “surrender[] papers and property to which the client is entitled” and only “retain papers relating to the client to the extent permitted by law.” In the context of cloud computing, the lawyer must take steps to safeguard data stored in and transmitted through the cloud. What safeguards are appropriate depends on the nature and sensitivity of the data. More particularly, a lawyer must take reasonable steps to ensure that electronic data stored in the cloud is secure and available while representing a client. The data must be returned to the client and deleted from the cloud after representation is concluded or when the lawyer decides to no longer to preserve the file: in either case, the lawyer must know at all times where sensitive client information is stored, be it in the cloud or elsewhere.

Rule 5.3. Responsibilities Regarding Nonlawyer Assistants
Cloud computing is a form of outsourcing the storage and transmission of data. What was once a matter of documents and file cabinets is now online.13 This means that a provider of cloud computing services is, in effect, a nonlawyer retained by a lawyer. As a result, the lawyer must make reasonable efforts to ensure that the provider understands and is capable of complying with its obligation to act in a manner compatible with the lawyer’s own professional responsibilities. N.H. Rule 5.3 (a).

The same rationale applies when, instead of directly engaging a cloud computing provider, a lawyer hires an intermediary, such as an information technology professional or other support staff, to find and engage a provider. As noted in NH Bar Ethics Op. 2011-12/05, “Lawyers regularly engage companies to provide support services. Banks hold client funds; telephone companies carry privileged communications; credit card companies facilitate the payment of bills; computer consultants maintain necessary technology.” When engaging a cloud computing provider or an intermediary who engages such a provider, the responsibility rests with the lawyer to ensure that the work is performed in a manner consistent with the lawyer’s professional duties.
Rule 5.3 (a). Additionally, under Rule 2.1, a lawyer must exercise independent professional judgment in representing a client and cannot hide behind a hired intermediary and ignore how client information is stored in or transmitted through the cloud.

Thus, a lawyer who uses cloud computing must take reasonable steps to ensure that sensitive client information remains confidential and secure.14 What these steps are depends on the sensitivity of the transmitted information.15 It bears repeating that a lawyer’s duty is to take reasonable steps to protect confidential client information, not to become an expert in information technology. When it comes to the use of cloud computing, the Rules of Professional Conduct do not impose a strict liability standard. As one ethics committee observed, “Such a guarantee is impossible, and a lawyer can no more guarantee against unauthorized access to electronic information than he can guarantee that a burglar will not break into his file room, or that someone will not illegally intercept his mail or steal a fax.”16

Which providers of cloud computing may be used and what security measures the provider must take are beyond the scope of this opinion. This opinion addresses instead what an attorney may consider when storing data on or transmitting data through the cloud. For recommendations on which cloud computing services to use, see American Bar Association, “Delivering Value and Efficiency with Technology: Effectively Collecting and Managing Data in a Virtual World,” p.
12.17 For more information on which factors to consider when choosing a provider of cloud computing services, see American Bar Association, “Your ABA: Evaluating Cloud-Computing Providers.”18

Cloud Computing Considerations:

The issues which an attorney must consider before using a cloud computing service include the following:

1. Is the provider of cloud computing services a reputable organization?
   2. Does the provider offer robust security measures? Such measures19 must include at a minimum password protections or other verification procedures limiting access to the data; safeguards such as data back-up and restoration, a firewall, or encryption; periodic audits by third parties of the provider’s security; and notification procedures in case of a breach.20
2. Is the data stored in a format that renders it retrievable as well as secure? Is it stored in a
   proprietary format21 and is it promptly and reasonably retrievable by the lawyer in a format acceptable to the client? See also PA Bar Ethics Op. 2011-200, p. 9. It bears repeating that, if a client requests a copy of her file, the lawyer has an obligation to provide all files pertinent to representation of that client. NH Bar Ethics Op. 2005-06/03; Averill, 145 N.H. at 339-40.
3. Does the provider commingle data belonging to different clients and/or different practitioners such
   that retrieval may result in inadvertent disclosure?22
4. Do the terms of service state that the provider merely holds a license to the stored data, as for
   example Google’s do?23 Some providers routinely inform those accessing their service that it is the provider−not the user −that “owns” the data.24 If the provider owns the stored data, the lawyer may run afoul of Rule 1.15, which requires that the client’s property “be identified as property of the client.” To comply with Rule 1.15, the provider may not “own” the data stored in the cloud.
5. Does the provider have an enforceable obligation to keep the data confidential?
6. Where are the provider’s servers located and what are the privacy laws in effect at that location
   regarding unauthorized access, retrieval, and destruction of compromised data?25 If the servers are located in a foreign country, do the privacy laws of that country reasonably mirror those of the United States? If the servers are relocated, will the provider notify the lawyer in advance?
7. Will the provider retain the data – and, if so, for how long – when the representation ends or the
   agreement between the lawyer and provider is terminated for another reason? The data must not be destroyed immediately and without notice or compromised in case of nonpayment.26
8. Do the terms of service obligate the provider to warn the lawyer if information is being subpoenaed
   by a third party, where the law permits such notice? Such a provision may be especially timely given that the Senate Judiciary Committee recently considered, but rejected legislation which would have expanded law enforcement agencies’ access to privately stored data.27
9. What is the provider’s disaster recovery plan with respect stored data? Is a copy of the digital data
   stored on-site?28
   The New Hampshire Ethics Committee concurs with the consensus among states that a lawyer may use cloud computing in a manner consistent with his or her ethical duties by taking reasonable steps to protect client data. Granted, a lawyer may not find a provider of cloud computing services whose terms of service address all of the issues addressed above, but it bears repeating, that while a lawyer need not become an expert in data storage, a lawyer must remain aware of how and where data is stored and what the service agreement says.29 Although the New Hampshire Rules of Professional Conduct do not impose a strict liability standard, the duties of confidentiality and competence are ongoing and not delegable. The requirement of competence means that even when storing data in the cloud, a lawyer must take reasonable steps to protect client information and cannot allow the storage and retrieval of data to become nebulous.

ENDNOTES:

[1] American Bar Association, Cloud Computing/Software as a Service for Lawyers (last accessed on October 23, 2012). See also PA Bar Ethics Op. 2011-200 and Robinson, Free at What Cost?: Cloud Computing Privacy Under the Stored Communications Act, 98 Geo. L.J. 1195, 1199-1200 (2010).

[2] PA Bar Ethics Op. 2011-200, p. 1.

[3] AL Bar Ethics Op. 2010-02; AZ Bar Ethics Op. 09-04 (2009); CA Bar Ethics Op. 2010-179, p. 3; FL Bar Ethics Op. 06-1 (2006) ; IA Bar Ethics Op. 11-01 (2011), p. 2; IL Bar Ethics Op. 10-01 (2009), p. 3; ME Bar Ethics Op. 194 (2008); MA Bar Ethics Op. 05-04 (2005); NV Bar Ethics Op. 33 (2006); NJ Bar Ethics Op. 107 (2006); NY Bar Ethics Op. 842 (2010); NC Bar Ethics Op. 6 (2011); ND Bar Ethics Op. 99-03 (1999), p. 3; OR Bar Ethics Op. 2011-188; PA Bar Ethics Op. 2011-200, p. 1; VT Bar Ethics Op. 2003-03; VA Bar Ethics Op. 1818 (2005).

[4] PA Bar Ethics Op. 2011-200, p. 12.

[5] PA Bar Ethics Op. 2011-200, p. 4.
[6] In 2012, the ABA revised Comment [6] to Rule 1.1. American Bar Association Commission on Ethics 20/20, Report to the House of Delegates, Resolution, 105A Revised, p. 3 www.americanbar.org (last accessed December 27, 2012). On behalf of the New Hampshire Supreme Court’s Rules Committee, the Bar’s Ethics Commitee is currently reviewing the revision to Comment [6]. The proposed revision has not yet been recommended to the Rules Committee or adopted by the Supreme Court. New Hampshire Rules of Professional Conduct (last accessed December 27, 2012).

[7] American Bar Association Commission on Ethics 20/20, Introduction and Overview, p. 8.

[8] For example, recent Senate amendments to H.R. 2471 (2012) would have amended the Electronic Communications Privacy Act to permit warrantless searches of emails by a number of federal agencies. The amendments were introduced and then withdrawn in the face of widespread criticism, but such legislative uncertainties highlight the need to be aware of changes in technology regulation.

[9]See NH Bar Ethics Op. 2008-2009/04.

[10] American Bar Association Commission on Ethics 20/20, Report to the House of Delegates, Resolution, 105A Revised, p. 5. On behalf of the New Hampshire Supreme Court’s Rules Committee, the Bar’s Ethics Commitee is currently reviewing the revision to Comment [16]. The proposed revision has not yet been recommended to the Rules Committee or adopted by the Supreme Court. New Hampshire Rules of Professional Conduct (last accessed December 27, 2012).

[11] Id.

[12] PA Bar Ethics Op. 2011-200, p. 7; IA Bar Ethics Op. 11-01 (2001), p. 2.

[13] PA Bar Ethics Op. 2011-200, p. 7.

[14] NH Bar Ethics Op. 2008-2009/4.
[15] IA Bar Ethics Op. 11-01 (2001), p. 2.

[16] N.J. Advisory Committee on Professional Ethics Op. No. 701 (electronic filing systems).

[17] www.americanbar.org (members of the New Hampshire Bar may contact the Ethics Committee regarding access to the article); see also American Bar Association, eLawyering in an Age of Accelerating Technology (last accessed January 29, 2013).

[18] www.americanbar.org (last accessed on December 3, 2012).

[19] PA Bar Ethics Op. 2011-200, pp. 8-9.

[20] NH law, RSA 359-C:20 (2009), already requires any person doing business in New Hampshire to notify (or cooperate in notifying) those individuals who are affected by any security breach of unencrypted computerized data that contains personal information. See, generally, Gallagher, Callahan & Gartrell, New Hampshire Mandates Data Breach Notification, August 2006, (last accessed on October 23, 2012).

[21] Proprietary formats can only be opened by certain programs or applications. For example, Microsoft Word, which used to save word processing documents in the proprietary .DOC format now saves documents in the .DOCX format, which is supported by multiple applications. See also PA Bar Ethics Op. 2011-200, p. 9.

[22] American Bar Association, “Cloud Computin’: A Storm is A-brewin’,” p. 26 (members of the New Hampshire Bar may contact the Ethics Committee regarding access to the article).

[23] Google Terms of Service (last modified March 1, 2012) (last accessed on December 4, 2012); see also MA Bar Ethics Op. 2012-03.

[24] IA Bar Ethics Op. 11-01 (2001), p. 3.

[25] PA Bar Ethics Op. 2011-200, p. 6.
[26] IA Bar Ethics Op. 11-01 (2001), p. 3.

[27] CNet, “Leahy scuttles his warrantless e-mail surveillance bill,” November 20, 2012, (last accessed December 27, 2012); see also CNet, “Senate bill rewrite lets feds read your e-mail without warrants,” November 20, 2012, (last accessed December 27, 2012).

[28] PA Bar Ethics Op. 2011-200, p. 10.

[29] PA Bar Ethics Op. 2011-200, p. 13.

This opinion was submitted for publication to the NHBA Board of Governors at its February 21, 2013 meeting, and was published in Bar News on ___. NH RULES OF PROFESSIONAL CONDUCT: Rule 1.8(c) Rule 1.0(e) Rule 1.1 Rule 1.6 Rule 1.15 Rule 2.1 Rule 5.3 SUBJECTS: Informed Consent Competence Confidentiality of Information Safekeeping Property Responsibilities Regarding Nonlawyer Assistants
• By the NHBA Ethics Committee
This opinion was submitted for publication to the NHBA Board of Governors at its February 21, 2013.