Can a West Virginia lawyer store client files electronically, including with an off-site or cloud provider, and what must the lawyer do to protect them?

Plain-English summary

The Lawyer Disciplinary Board issued this formal opinion in response to a question about retention and destruction of closed client files kept in electronic form, and used the occasion to address electronic file storage more broadly. The opinion is meant to be used together with the Board's earlier opinion on retention and destruction of closed client files, L.E.I. 2002-01, and it reiterates the principle from prior inquiries that the client file belongs to the client.

The Board concludes that the West Virginia Rules of Professional Conduct do not limit the way in which a client file is retained, so a lawyer may use available electronic storage. It anchors the analysis in Rule 1.6(a), which provides that a lawyer shall not reveal information relating to representation of a client unless the client consents after consultation. While the opinion states explicit client consent to electronic storage is not required, it notes the attorney may want to advise the client of the method of file storage and destruction in the retainer agreement or engagement letter.

The opinion then lists the considerations the Board ties to due diligence, organized under three headings. For confidentiality: security of data during transmission, storage, and destruction; the attorney's control over the data (including who has access, what happens if a storage bill goes unpaid, what country the data is stored in and how that country's laws affect privacy or ownership, and what happens if the provider is sold); safeguarding of privilege by monitoring emerging law on online storage and waiver; and compliance with state and federal laws governing personally identifiable information, such as HIPAA. For accessibility: maintaining compatible technology so the file can be accessed and reproduced throughout its retention, and providing alternative access when the lawyer is no longer available (who holds passwords and account authorization, and who can access the files of a lawyer who abandons practice or dies). For file integrity: retaining originals where legally necessary, including relevant communications such as emails and voicemails that are part of the client file, preventing inadvertent destruction or degradation of data, and backing up all data.

In practice

Under this opinion, electronic storage of client files (including off-site and cloud storage) is treated as permissible conduct, provided the lawyer exercises due diligence across the three areas the Board identifies. The opinion holds that the analysis turns on protecting the client's confidentiality, the client's continued accessibility to the file, and the file's integrity, rather than on any prohibition of the technology itself.

The opinion is framed in terms of considerations rather than fixed rules. The Board lists factors a lawyer should weigh (data security, who controls and can access the data, where it is stored, privilege preservation, applicable privacy laws, technology compatibility over time, succession access, retention of originals, and backups) but does not prescribe specific technical measures. The opinion notes it addresses only obligations under the West Virginia Rules of Professional Conduct and reminds lawyers that files may contain other protected information, such as Social Security numbers and health information, for which separate federal or state liability may attach.

Common questions

Q: Does a West Virginia lawyer need the client's consent to store files electronically or in the cloud?

A: The opinion states explicit consent is not required, but the lawyer may want to advise the client of the method of file storage and destruction in the retainer agreement or engagement letter. The governing rule is Rule 1.6(a) on confidentiality.

Q: Is cloud or off-site storage of client files allowed in West Virginia?

A: Yes. The opinion concludes the Rules of Professional Conduct do not limit the way a client file is retained, so a lawyer can use available electronic storage, subject to due diligence on confidentiality, accessibility, and file integrity.

Q: What confidentiality issues does the opinion flag for cloud storage?

A: The opinion lists data security during transmission, storage, and destruction; the attorney's control over the data (access, what happens if a storage bill is unpaid, the country where data is stored and its laws, and what happens if the provider is sold); safeguarding privilege; and compliance with laws such as HIPAA covering personally identifiable information.

Q: What does the opinion say about access to electronic files if the lawyer dies or stops practicing?

A: Under the accessibility heading, the opinion directs the lawyer to consider alternative access when the lawyer is no longer available, including who would hold passwords and account authorization and who could access the files of a practitioner who abandons practice or passes away.

Background and rules framework

The opinion interprets the West Virginia Rules of Professional Conduct, adopted by the Supreme Court of Appeals of West Virginia. The central rule is Rule 1.6 (Model Rule 1.6), Confidentiality of Information; the opinion quotes Rule 1.6(a)'s prohibition on revealing information relating to the representation absent client consent after consultation. The opinion builds on the Board's prior file-retention guidance in L.E.I. 89-02, 92-02, and 2002-01, all reflecting that the client file belongs to the client. The opinion's footnote points to the Pennsylvania Bar's Formal Opinion 2011-200 as a helpful out-of-state discussion of reasonable care as technology advances, while cautioning that what is allowable in one jurisdiction may not be allowable in West Virginia.

Citations and references

Rules of Professional Conduct:

• Model Rule 1.6 / WV RPC 1.6(a) (confidentiality of information; no disclosure absent client consent after consultation)

Statutes:

• HIPAA (referenced as an example of state and federal laws governing retention and destruction of documents containing personally identifiable information)

Other opinions cited:

• WV L.E.I. 2002-01: retention and destruction of closed client files (to be used in conjunction with this opinion)
• WV L.E.I. 89-02 and 92-02: the client file belongs to the client
• Pennsylvania Bar Formal Op. 2011-200 (2011): potential pitfalls and reasonable care as technology advances

See also

• WV LEO 2024-01: Lawyers' use of artificial intelligence
• CA COPRAC Op. 2010-179: Confidentiality and lawyer use of technology
• TX Ethics Op. 680: Cloud storage of client confidential information

Source

• Landing page: https://wvodc.org/Legal-Ethics-Opinion
• Original PDF: https://storage.googleapis.com/msgsndr/Rgd68xOkcVdteTsBkf6O/media/66a7ea7e3c9fe0750345e815.pdf

Original opinion text

Best-effort transcription from a scanned PDF. Minor errors may remain; the linked PDF is authoritative.

L.E.O. 2012-01

USE OF ELECTRONIC MEDIA FOR FILE STORAGE

INTRODUCTION

The Lawyer Disciplinary Board sees the need to issue a formal advisory opinion on electronic storage. This is based on a question we received about retention and destruction of closed client files kept in electronic form and our belief that we needed a formal opinion to address broader issues.

Rule 1.6(a) of the West Virginia Rules of Professional Conduct provides that "[a] lawyer shall not reveal information relating to representation of a client unless the client consents after consultation." The attorney's use of electronic storage is permissible under the West Virginia Rules of Professional Conduct, but there must be a protection of the client's confidences. The Lawyer Disciplinary Board previously addressed the retention and destruction of closed client files in L.E.I. 2002-01. This opinion is to be used in conjunction with that opinion in regards to electronic storage. The attorney should always remember that the client file belongs to the client. See L.E.I 89-02, 92-02, and 02-01. The primary concern regarding file retention is the accessibility by the client to his property. This L.E.O. is intended to address only obligations under the West Virginia Rules of Professional Conduct, but lawyers are reminded that information in their files may also contain other protected information such as social security numbers, health information, etc., which this L.E.O. does not specifically address, but which the lawyer may have liability or responsibility for disclosure under federal or state law.

The West Virginia Rules of Professional Conduct do not limit the way in which the client file is retained. While explicit consent is not required, the attorney may want to advise of the method of file storage and destruction in the retainer agreement or engagement letter. The attorney can use the various sources of electronic storage that are available, but certain precautions should be taken to ensure the attorney has used due diligence to protect the client's file, client's confidentiality, accessibility, and file integrity as follows:

CONFIDENTIALITY - due diligence requires consideration of:

• Security of data (e.g. during transmission to off-site storage, during storage and during destruction of file)

• Control of the data by the attorney (e.g. Who has access to stored data? What happens if lawyer cannot pay storage bill? What country is the data stored in, and how might that country's laws affect privacy/ownership of the data? If provider sells company, what changes might occur to data or the contract to store data?)

• Safeguarding of privilege (e.g. monitoring emerging law regarding online storage and waiver/loss of privilege)

• State and federal laws that apply to retention and destruction of documents containing personally identifiable information (e.g. HIPAA)

ACCESSIBILITY - due diligence requires consideration of:

• Maintenance of compatible technology for access/reproduction throughout the duration of the file's retention (may want to disclose electronic storage to clients in retainer agreement or engagement letter; can client reproduce the file from electronic format?)

• Alternative access when lawyer no longer available (e.g. Who would have passwords? Authorization on accounts? Who could access files of practitioners who abandon their practice or pass away?)

FILE INTEGRITY - due diligence requires consideration of:

• Retention of originals where legally necessary

• Inclusion of relevant communications that may be considered part of the client file (e.g. emails, electronically filed documents, voice mail communications, etc.)

• Prevention of inadvertent destruction/modification/degradation of data (e.g. quality)

• Backup of all data

CONCLUSION

While the Board finds use of electronic storage of client files to be permissible under the Rules of Professional Conduct, the attorney must ensure not only the confidentiality of the data and its accessibility to the client, but also the integrity of the file. The use of an electronic storage provider presents additional issues that should be considered.

APPROVED by the Lawyer Disciplinary Board on the 14th day of September, 2012, and ENTERED this 14th day of September, 2012.

Charles J. Kaiser, Jr., Chairperson
Lawyer Disciplinary Board

[1] These same issues have been reviewed by other jurisdictions and a review of those opinions can be helpful. For example, the Penn. Bar Ass'n Comm. on Legal Ethics and Professional Responsibility, Formal Op. 2011-200 (2011) describes potential pitfalls for practice as technology rapidly advances, and provides helpful discussion of what might be included in a standard of reasonable care for protecting client and attorney interests. As always, attorneys should note that what may be allowable in one jurisdiction may not be allowable in West Virginia.