Can a Tennessee lawyer store confidential client information in the cloud?

Plain-English summary

The opinion answers whether a lawyer may ethically store confidential client information in "the cloud," meaning remote third-party servers the lawyer does not control. The opinion concludes that a lawyer may do so if the lawyer takes reasonable care to assure that the information remains confidential and that reasonable safeguards protect it from breaches, loss, and other risks. Because technology changes rapidly, the Board declines to set a fixed standard of care and instead offers guidance drawn from other jurisdictions.

The opinion grounds the analysis in the lawyer's existing duties: competence under RPC 1.1, confidentiality under RPC 1.6 (and the duty to former clients under RPC 1.9(c)), and the supervision of nonlawyer assistance under RPC 5.3. It explains that placing a provider between the lawyer and client information adds a layer of risk and a loss of direct control, but that the lawyer owes the same duties to client information in the cloud as to information in any other form. Competence does not require the lawyer to become a data-storage expert, but does require the lawyer to remain aware of how and where data are stored and what the provider's service agreement says, and (per the amended Comment to Model Rule 1.1, identical to Tennessee's) to keep abreast of the benefits and risks of relevant technology. The duty is to use reasonable care, not infallible methods; RPC 1.6, Comment [16], does not require special security measures where the method affords a reasonable expectation of privacy, though special circumstances and sensitive data may warrant special precautions.

The opinion then collects, as guidance the Board says it does not adopt, practices from other states' opinions: investigating and selecting a reliable provider; an agreement that the provider will handle confidential information consistent with the lawyer's responsibilities; a method to retrieve data in a usable format if the service ends; review of the provider's terms and security policy; notice if a third party seeks the data; and internal firm policies such as backups and employee training on security measures like passwords.

In practice

The opinion holds that a lawyer may use cloud-based services for confidential client information if the lawyer uses reasonable care to protect confidentiality (RPC 1.6(a), 1.9(c)) and safeguard client property, competently selects and continues to use the provider (RPC 1.1), and, where the lawyer is a partner or has managerial authority, uses reasonable efforts to ensure the firm has measures so providers' conduct is compatible with the lawyer's ethical obligations (RPC 5.3(a), (b)). The opinion frames the standard as reasonable care rather than a fixed checklist and declines to mandate specific technologies, while listing provider-selection and internal-policy considerations as guidance.

Common questions

Q: Can a Tennessee lawyer keep client files and information in the cloud?

A: Yes. The opinion concludes a lawyer may store confidential client information in the cloud if the lawyer takes reasonable care to keep it confidential and to employ reasonable safeguards against breaches, loss, and other risks.

Q: What standard applies?

A: Reasonable care, not perfection. The opinion states the lawyer is not required to use infallible methods, and (citing RPC 1.6, Comment [16]) need not use special security measures where the method affords a reasonable expectation of privacy, though sensitive data or special circumstances may warrant more.

Q: What does competence require with cloud storage?

A: Per the opinion, the lawyer need not become a data-storage expert but must remain aware of how and where data are stored and what the provider agreement says, must competently select a reliable provider after investigating its qualifications, and must keep abreast of the benefits and risks of relevant technology (RPC 1.1).

Q: What are a firm manager's responsibilities?

A: Under RPC 5.3, a partner or lawyer with managerial authority must use reasonable efforts to ensure the firm has measures giving reasonable assurance that the provider's conduct is compatible with the lawyer's ethical obligations.

Q: What should a lawyer look for in a cloud provider?

A: The opinion lists guidance from other jurisdictions: the provider's ability to protect and back up the data, limit access to necessary personnel, handle confidential information consistent with the lawyer's duties, allow data retrieval in a usable format if the service ends, and respond appropriately to third-party or government data requests.

Background and rules framework

The opinion interprets several Tennessee rules against their Model Rule counterparts: RPC 1.1 / Model Rule 1.1 (competence, including keeping abreast of relevant technology), RPC 1.6 / Model Rule 1.6 (confidentiality, including Comments [15] and [16] on acting competently to preserve confidentiality), RPC 1.9(c) / Model Rule 1.9(c) (duties to former clients), and RPC 5.3 / Model Rule 5.3 (responsibilities regarding nonlawyer assistance). It draws on cloud-computing ethics opinions from many states (Alabama, Alaska, California, Florida, Kentucky, Maine, North Carolina, Pennsylvania, and others) as non-binding guidance.

Citations and references

Rules of Professional Conduct:

• Model Rule 1.1 / Tennessee RPC 1.1 (competence; technology)
• Model Rule 1.6 / Tennessee RPC 1.6 (confidentiality), Comments [15]-[16]
• Model Rule 1.9(c) / Tennessee RPC 1.9(c) (duties to former clients)
• Model Rule 5.3 / Tennessee RPC 5.3 (responsibilities regarding nonlawyer assistance)

Other opinions cited:

• Alabama Op. 2010-02 (2010); Alaska Op. 2014-3 (2014); Kentucky Op. E-437 (2014)
• Maine Op. 207 (2013); North Carolina 2011 Formal Op. 6 (2012); Pennsylvania Formal Op. 2011-200; Florida Op. 12-3 (2012)

See also

• ABA Formal Op. 477R: Securing Communication of Client Information
• CA COPRAC Op. 2012-184: Virtual Law Office and the Cloud
• Alaska Ethics Op. 2014-3: Cloud Storage of Client Data

Source

• Landing page: https://www.tbpr.org/ethic_opinions/2015-f-159

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

2015-F-159 - Storing client information in the cloud

BOARD OF PROFESSIONAL RESPONSIBILITY OF THE SUPREME COURT OF TENNESSEE

FORMAL ETHICS OPINION 2015-F-159

May an attorney ethically store confidential client information or material in “the cloud”?

OPINION

A lawyer may ethically allow confidential client information to be stored in "the cloud" if the lawyer takes reasonable care to assure that: (1) all such information or materials remain confidential; and (2) reasonable safeguards are employed to ensure that the information is protected from breaches, loss, and other risks. Due to rapidly changing technology, the Board doesn’t attempt to establish a standard of care, but instead offers guidance from other jurisdictions.

DISCUSSION

Technological advances have changed the way lawyers and law firms may store, retrieve and access client information.An inquiry has been made regarding whether a lawyer can ethically store confidential client files and information in "the cloud".

Cloud computing is technology which allows a lawyer to store and access software or data through the cloud—a remote location which is not controlled by the lawyer but by a third party which provides the storage or other computing services. It is the use of a network of remote servers, hardware and/or software to store, manage, transmit, process and/or retrieve data off the lawyer’s premises, rather than on a server or personal computer on the lawyer's premises.

The services, which may be long-term storage of confidential client information or shorter-term storage or services to enable data processing or web-based email, are typically purchased from a provider on a subscription fee basis. The service provider assumes the responsibility for new technology and software updates. The lawyer's computing device is simply a way of accessing the information stored in the cloud from any location with Internet access.1

Because cloud computing places data, including client data, on remote servers outside of the lawyer's direct control, it has given rise to some concerns regarding its acceptability under applicable ethics rules. See "Cloud Ethics Opinions Around the U.S.", American Bar Association, Legal Technology Resource Center. This summary lists the standard of "reasonable care" with regard to the lawyer's use of cloud technology from all states supporting the use of cloud storage.

Due to the fact that technology is constantly evolving, this opinion only provides lawyers with guidance in the exercise of reasonable care and judgement regarding the lawyer's use of cloud technology in compliance with the rules of professional conduct, rather than mandating specific practices regarding the use of such technology. Ky. Ethics Op. E-437 (2014); Penn. Formal Ethics Op. 2011-200 (undated); Vt. Ethics Op. 2010-6 (2010).

Although cloud computing offers increased mobility and accessibility to client information, the placement of a service provider between the lawyer and confidential client information for which the lawyer is responsible adds a layer of risk and loss of direct control by the lawyer over the stored or transmitted information. N.H. Adv. Ethics Op. 2012-13/4 (2013). A lawyer owes the same ethical duties, obligations and protections to clients with respect to information for which they employ cloud computing as they otherwise owe clients pursuant to the Rules of Professional Conduct with respect to information in whatever form. Me. Ethics Op. 207 (2013); Ohio Informal Ethics Op. 2013-13 (2013); Penn. Formal Ethics Op. 2011-200 (undated).

Often, in house counsel has no input with regard to the technology used by the corporation, but owes the duty of communication with the corporate client regarding the risks and benefits of cloud storage. Comment 3 to RPC 1.132 states that when constituents of the organization make decisions for it, the decisions ordinarily must be accepted by the lawyer even if their utility or prudence is doubtful. Decisions concerning policy and operations, including ones entailing serious risk, are not as such in the lawyer's province.

Use of the technology is ethically proper if the lawyer abides by the Rules of Professional Conduct: to act competently, RPC 1.13, to take reasonable measures to protect the confidentiality, security, and accessibility of client information stored and transmitted through the cloud, RPC 1.64, 5, 6 and 1.9(c)7; by competently choosing the provider of the cloud services.

The lawyer is not required by the rules to use infallible methods of protection. "When transmitting a communication that includes information relating to the representation of a client, the lawyer must take reasonable precautions to prevent the information from coming into the hands of unintended recipients. This duty, however, does not require that the lawyer use special security measures if the method of communication affords a reasonable expectation of privacy…" RPC 1.6, cmt. [16]6. "…Rather, the lawyer must use reasonable care to select a mode of communication that, in light of the circumstances, will best protect confidential client information and the lawyer must advise affected parties if there is reason to believe that the chosen communications technology presents an unreasonable risk to confidentiality." Me. Ethics Op. 207 (2013); N. C. 2011 Formal Ethics Op. 6 (2012). "Special circumstances, however, may warrant special precautions." RPC 1.6, cmt. [16]6. What safeguards are appropriate depends upon the nature and sensitivity of the data. Alaska Ethics Op. 2014-3 (2014).

Fla. Ethics Op. 12-3 (2012) states that lawyers should "consider whether the lawyer should use the outside service provider or use additional security in specific matters in which the lawyer has proprietary client information or has other particularly sensitive information.”

The duties of competence 3 and confidentiality 4, 5, 6 owed to the client by the lawyer are ongoing and are not delegable.8, 9, 10 While competence does not require a lawyer to become an expert in data storage, it does require that the lawyer remain aware of how and where data are stored and what the provider service agreement says. Alaska Ethics Op. 2014-3 (2014).

The American Bar Association Model Rule of Professional Conduct 1.1,11 which is identical in its wording to Rule 1.1 of the Tennessee Rules of Professional Conduct, has amended its Model Rule Comment on maintaining competence to include keeping abreast of changes "including the benefits and risks associated with relevant technology". Otherwise the comment is the same as the Tennessee version of the comment on maintaining competence.

Because the delegation of file storage to a provider of cloud computing services adds a layer between the lawyer and confidential client information over which the lawyer has responsibility, competence also requires that the lawyer ensure that tasks are delegated to competent service providers which the lawyer has selected after investigating the qualifications, competence, and diligence of the provider to ensure that client information is reasonably likely to remain confidential and secure through storage and retrieval. Ky. Ethics Op. E-437 (2014). The primary obligation is to select a reliable provider under the circumstances. In making this selection, the lawyer should consider the provider's ability to protect the information, to limit authorized access only to necessary personnel and to ensure that the information is backed up, is reasonably available to the lawyer and is reasonably safe from unauthorized intrusion. Alaska Ethics Op. 2014-3 (2014); Penn. Formal Ethics Op. 2011-200 (undated).

Suggested guidelines in helping lawyers competently choose the provider of the cloud services with the Rules of Professional Conduct are set forth in the following opinions:12

Ala. Ethics Op. 2010-02 (2010) concludes "that a lawyer may use "cloud computing" or third-party providers to store client data provided that the attorney exercises reasonable care in doing so." The Commission defined "reasonable care" as requiring the lawyer to:

• Learn how the provider would handle the storage and security of the data;

• reasonably ensure that the provider abides by a confidentiality agreement in handling the data; and

• stay abreast of appropriate safeguards that should be employed by both the lawyer and the third party.

N. C. 2011 Formal Ethics Op. 6 (2012) and Me. Ethics Op. 207 (2013) suggest that in dealing with providers of cloud computing services or hardware, lawyers should adopt additional safeguards made relevant by the Rules of Professional Conduct, such as:

• An agreement between the cloud service provider and the lawyer or law firm that the provider will handle confidential client information in keeping with the lawyer's professional responsibilities.

• If the lawyer terminates use of the cloud computing services or product, the provider goes out of business, or the service otherwise has a break in continuity, the law firm will have a method for retrieving the data, the data will be available in a non-proprietary format that the law firm can access, or the firm will have access to the vendor's software or source code.

• Careful review of the terms of the law firm's user or license agreements with the provider, including the security policy.

• Evaluation of the cloud provider's (or any third party data hosting company's) measures for safeguarding the security and confidentiality of stored data.

Pa. Formal Ethics Op. 2011-200 (undated), Maine Ethics Op. 207 (2013), N.H. Advisory Ethics Op. 2012-13/4 (2013) and Ohio Informal Ethics Op. 2013-13 (2013) listed issues which lawyers should consider before using a cloud computing service, including that the service provider:

• will notify the lawyer if requested to produce data to a third party, and provide the lawyer with the ability to respond to the request before the provider produces the requested information;

• has procedures to respond to government or judicial attempts to obtain disclosure of client data;

Lawyers also need to have internal policies and procedures to aid in complying with the Rules of Professional Conduct with regard to cloud computing. Penn. Formal Ethics Op. 2011-200 (undated) and Me. Ethics Op. 207 (2013) list internal policies and procedures that lawyers should adopt in connection with cloud usage such as:

• backing up data to allow the firm to restore data that has been lost, corrupted, or accidentally deleted;

• educating and training employees of the firm who use cloud computing to abide by all end user security measures, including, but not limited to, the creation and regular replacement of passwords.

CONCLUSION

A lawyer may use cloud-based services with regard to confidential client information. In using cloud-based services, a lawyer must use reasonable care to assure that client confidentiality is protected and client property is safeguarded. See, RPC 1.6(a) and 1.9(c). A lawyer must comply with his or her duty of competence in the selection and continued use of the providers of cloud-based services. See, RPC 1.1. A lawyer must use "reasonable efforts" to ensure that the conduct of providers of cloud-based services is compatible with ethical obligations of the lawyer, and, if the lawyer is a partner or otherwise has managerial authority in a law firm, the lawyer must use "reasonable efforts" to make sure that the firm has measures in place to assure that providers of cloud-based services engage in conduct compatible with ethical obligations of the lawyer. See, RPC 5.3(a) & (b).

This 11th day of September, 2015.

ETHICS COMMITTEE:

Wade Davies

H. Scott Reams

Michael Callaway

APPROVED AND ADOPTED BY THE BOARD

1 Ala. Ethics Op. 2010-02 (2010); Alaska Ethics Op. 2014-3 (2014); Ariz. Ethics Op. 09-04 (2009); Cal. Ethics Op. 2010-179 (2010); Conn. Informal Op. 2013-07 (2013); Fla. Ethics Op. 12-3 (2012); Iowa Ethics Op. 11-01 (2011); Ky. Ethics Op. E-437 (2014); Me. Ethics Op. 207 (2013); Mass. Ethics Op. 12-03 (2012); N.H. Adv. Ethics Op. 2012-13/4 (2013); N.Y. Ethics Op. 842 (2010); Nev. Ethics Op. 33 (2006); N. C. 2011 Formal Op. 6 (2012); Ohio Informal Ethics Op. 2013-13 (2013); Or. Ethics Op. 2011-188 (2011); Penn. Formal Ethics Op. 2011-200 (undated); Va. Legal Ethics Op. 1872 (2013); Wash. Advisory Op 2215 (2012).

2 Comment [3], to RPC 1.13 provides:

When constituents of the organization make decisions for it, the decisions ordinarily must be accepted by the lawyer even if their utility or prudence is doubtful. Decisions concerning policy and operations, including ones entailing serious risk, are not as such in the lawyer's province. Paragraph (b) makes clear, however, that when the lawyer knows that the organization is likely to be substantially injured by action of an officer or other constituent that violates a legal obligation to the organization or is in violation of law that might be imputed to the organization, the lawyer must proceed as is reasonably necessary in the best interest of the organization. As defined in RPC 1.0(f), knowledge can be inferred from circumstances, and a lawyer cannot ignore the obvious.

3 RPC 1.1 Competence, provides:

A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness, and preparation reasonably necessary for the representation.

4 Rule 1.6 (a): Confidentiality of Information provides:

(a) A lawyer shall not reveal information relating to the representation of a client unless:

• the client gives informed consent;

• the disclosure is impliedly authorized in order to carry out the representation; or

• the disclosure is permitted by paragraph (b) or required by paragraph (c).

5 Comment [15], Acting Competently to Preserve Confidentiality, to RPC 1.6 provides:

[15] A lawyer must act competently to safeguard information relating to the representation of a client against inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client or who are subject to the lawyer's supervision. See RPCs 1.1, 5.1, and 5.3.

6 Comment [16], to RPC 1.6 provides:

[16] When transmitting a communication that includes information relating to the representation of a client, the lawyer must take reasonable precautions to prevent the information from coming into the hands of unintended recipients. This duty, however, does not require that the lawyer use special security measures if the method of communication affords a reasonable expectation of privacy. Special circumstances, however, may warrant special precautions. Factors to be considered in determining the reasonableness of the lawyer's expectation of confidentiality include the sensitivity of the information and the extent to which the privacy of the communication is protected by law or by a confidentiality agreement. A client may require the lawyer to implement special security measures not required by this Rule or may give informed consent to the use of a means of communication that would otherwise be prohibited by this Rule.

7 Rule 1.9: Duties to Former Clients, provides in part:

(c) A lawyer who has formerly represented a client in a matter or whose present or former firm has formerly represented a client in a matter shall not thereafter reveal information relating to the representation or use such information to the disadvantage of the former client unless (1) the former client gives informed consent, confirmed in writing, or (2) these Rules would permit or require the lawyer to do so with respect to a client, or (3) the information has become generally known.

8 Rule 5.1: Responsibilities of Partners, Managers, and Supervisory Lawyers, provides in part:

(a) A partner in a law firm, and a lawyer who individually or together with other lawyers possesses comparable managerial authority in a law firm, shall make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that all lawyers in the firm conform to the Rules of Professional Conduct.

9 Rule 5.3: Responsibilities Regarding Nonlawyer Assistants, provides:

With respect to a nonlawyer employed, retained by, or associated with a lawyer:

(a) a partner and a lawyer who individually or together with other lawyers possesses comparable managerial authority in a law firm shall make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that the nonlawyer's conduct is compatible with these Rules;

(b) a lawyer having direct supervisory authority over a nonlawyer shall make reasonable efforts to ensure that the person's conduct is compatible with these Rules;

10 Comment [1] to RPC 5.3 provides:

[1] Lawyers generally employ nonlawyer assistants in their practice, including secretaries, investigators, law student interns, and paraprofessionals. Such assistants, whether employees or independent contractors, act for the lawyer in rendition of the lawyer's professional services. A lawyer must give such assistants appropriate instruction and supervision concerning the ethical aspects of their employment, particularly regarding the obligation not to disclose information relating to representation of the client, and should be responsible for their work product. The measures employed in supervising nonlawyer assistants should take account of the fact that they do not have legal training and are not subject to professional discipline.

11

Maintaining Competence [8] To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject. Underlining added.

12 The Board is not adopting these opinions, but they are set forth as guidance to consider.