Wisconsin Lawyer: Ethics Opinion EF-12-01: Prevent Disclosure of Metadata:

State Bar of Wisconsin

Sign In

Top Link Bar

News & Pubs Search

Advanced
  • Wisconsin Lawyer
    October
    01
    2012

    Ethics Opinion EF-12-01: Prevent Disclosure of Metadata

    Share This:
    On June 15, 2012, the State Bar Professional Ethics Committee issued Formal Opinion EF-12-01, discussing lawyers' responsibility to avoid disclosing confidential information contained in metadata in electronic documents.

    Wisconsin LawyerWisconsin Lawyer
    Vol. 85, No. 10, October 2012

    EF-12-01: The Transmission and Receipt of Electronic Documents Containing Metadata

    SecuritySynopsis: A lawyer who transmits documents containing information relating to the representation of clients to third parties must act competently to prevent the disclosure of significant information in the form of metadata contained in such documents. A lawyer who receives an electronic document is not prohibited by the Rules of Professional Responsibility from searching for metadata contained in such a document. A lawyer who chooses to review such a document for metadata and discovers information of material significance must normally assume such information was inadvertently disclosed and notify the sender. Lawyers are not compelled to routinely search electronic documents for metadata.

    Introduction

    Metadata is embedded information contained in electronic documents. This information describes the document's history, tracking, and management. By searching (that is, "mining") for this data, it may be possible for a user to identify changes that were made to the document during its preparation and revision, comments made by the individuals that prepared or reviewed the document, and other information embedded within the document.

    For example, many word processing programs allow users to track changes made in a document. Tracking these changes allows users to identify what was added and deleted. These changes may be readily visible or hidden. However, even if the changes are hidden, other users can often locate them by simply clicking on a software icon contained in the program. Additionally, many programs (for example, Microsoft Word) allow users to make comments on a document. Like track-changes, these comments may be visible or hidden. However, it may be possible for users to locate hidden comments by simply moving the cursor over their location or by changing the settings within the word document program itself.

    Lawyers routinely send and receive electronic documents in the course of representing their clients, and these documents may contain metadata. Much of the metadata compiled in the creation of an electronic document is irrelevant, such as changes correcting a simple spelling error. Some of the information, however, may have the potential to be damaging if it is shared with opposing counsel. The revelation of such metadata could result in the disclosure of confidential information, legal strategies and theories, attorney work product, or lawyer-client communications. A lawyer can avoid many of these consequences by being familiar with the types of metadata contained within an electronic document and by taking steps to protect or remove (that is, "scrub") the information whenever it is necessary.

    In this opinion, the State Bar's Standing Committee on Professional Ethics (the "Committee") discusses the duties arising under Wisconsin's Rules of Professional Conduct for Attorneys (the "Rules") associated with the transmission and receipt of documents containing metadata. It is important to note first that the obligations arising under the disciplinary rules discussed in this opinion do not take precedence over the discovery rules, either in state or federal court. Discovery of electronic material raises issues that extend beyond the scope of this opinion; this opinion discusses obligations of lawyers outside the context of formal discovery.

    Ethical Obligations of the Transmitting Lawyer

    One of the most significant obligations imposed upon attorneys is their duty not to disclose information relating to the representation of a client. In Wisconsin, this obligation is imposed by SCR 20:1.6(a), which states "[a] lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, except for disclosures that are impliedly authorized in order to carry out the representation, and except as stated in pars. (b) and (c)." As stated in Comment [4] of the Rule, "[t]his prohibition also applies to disclosures by lawyers that do not in themselves reveal protected information but could reasonably lead to the discovery of such information by a third person."

    Additionally, lawyers have a duty to provide clients with competent representation. SCR 20:1.1 states "[a] lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation." The duty of competence applies to a lawyer's obligation to safeguard against the potential revelation of confidential information contained within electronic documents. This derives from SCR 20:1.6, Comment [16], which states that "[a] lawyer must act competently to safeguard information relating to the representation of a client against inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client." To competently safeguard information embedded within an electronic document, attorneys transmitting client information must "take reasonable precautions to prevent the information from coming into the hands of unintended recipients." SCR 20:1.6, Comment [17].

    Because lawyers often transmit electronic documents containing information relating to the representation of their clients, the duties imposed by SCR 20:1.6 and SCR 20:1.1 require lawyers to stay reasonably informed about the types of metadata that are included in electronic documents they generate and take steps, when necessary, to remove the metadata.

    Many states have issued ethics opinions considering the ethical obligations of lawyers with respect to metadata. There is near unanimous agreement that lawyers who send electronic documents are ethically required to take reasonable care to avoid the disclosure of confidential information contained within metadata. See, e.g., Comments to MN Lawyers Prof. Responsibility Board Op. 22 (2010) ("a lawyer must take reasonable steps to prevent the disclosure of confidential metadata"); NYCLA Committee on Professional Ethics Op. 738 ("attorneys are advised to take due care in sending correspondence, contracts, or other documents to opposing counsel by scrubbing the documents to ensure that they are free of metadata"); AL Ethics Op. 2007-02 (2007) ("Lawyers have a duty ... to use reasonable care when transmitting electronic documents to prevent the disclosure of metadata containing client confidences or secrets"). The Committee agrees with the position expressed in these opinions and believes that Wisconsin lawyers likewise have a duty to take reasonable precautions to avoid disclosure of confidential information contained in metadata.

    The determination of what constitutes reasonable precautions to avoid disclosure of confidential information will vary according to the circumstances of each case. In determining whether a lawyer took reasonable precautions, consideration must be given to "the sensitivity of the information and the extent to which the privacy of the communication is protected by law or by a confidentiality agreement." SCR 20:1.6, Comment [17]. As noted above, much metadata is of little or no importance, and lawyers do not violate their ethical duties by failing to remove such metadata. Also, in some situations, lawyers may intentionally wish to provide documents containing metadata, or may be required by law to refrain from scrubbing documents for metadata. Lawyers, however, must be cognizant of when the metadata contained within a document is of such importance that the lawyer is ethically obliged to prevent disclosure. Whenever it is reasonably foreseeable that metadata contained within a document may be relevant and detrimental to the client if disclosed to a third party, the lawyer must take steps to remove the metadata.

    Unless lawyers obtain a reasonable understanding of the risks inherent in sending and receiving electronic documents and the reasonable steps necessary to prevent any unintended disclosure, they risk violating their ethical obligations to clients. This requires lawyers to either familiarize themselves sufficiently with the technological means to detect and remove, when necessary, metadata from electronic documents or obtain the assistance of someone possessing such knowledge.1 Due to the rapidly changing nature of technology, it is beyond the scope of this opinion to detail specific methods for removing metadata from electronic documents.2

    Ethical Obligations of the Receiving Lawyer

    There are three independent issues relating to a receiving lawyer's obligations regarding metadata which the Committee addresses in this opinion. First, whether the receiving lawyer may ethically mine for and review metadata. Second, if a receiving lawyer may mine for metadata, what must the lawyer do if the information that was revealed appears to contain significant information? Third, whether lawyers using modern technology would be compelled by their duty of competence to actively search documents for metadata.

    May a Receiving Lawyer Ethically Search for Metadata? While the majority of jurisdictions agree that lawyers transmitting electronic documents have a duty to use reasonable care to guard against the disclosure of metadata that may contain confidential information, there is a pronounced split regarding whether it is permissible for lawyers to mine for and use metadata received from opponents or third parties.

    The State Bar of Arizona Ethics Committee concluded that "a lawyer who receives an electronic communication may not examine it for the purpose of discovering the metadata embedded in it." Arizona Ethics Op. 07-03. This conclusion was shared by the bar association ethics committees of Alabama, Maine, New York, and New Hampshire. See, Alabama Ethics Op. 2007-02 (2007) (the receiving lawyer has "an ethical obligation to refrain from mining an electronic document"); Maine Ethics Op. 196 (2008) ("an attorney may not ethically take steps to uncover metadata, embedded in an electronic document sent by counsel for another party, in an effort to detect information that is legally confidential and is or should be reasonably known not to have been intentionally communicated"); New York Committee on Professional Ethics Op. 738 (2008) ("when a lawyer sends opposing counsel correspondence or other material with metadata, the receiving attorney may not ethically search the metadata in those electronic documents with the intent to find privileged material or if finding privileged material is likely to occur from the search"); New Hampshire Ethics Op. 2008-2009/4 (receiving lawyers must "refrain from reviewing metadata"). The ethical foundation for these opinions rests on the belief that attorneys who search for metadata are unjustifiably infringing on the opposing counsel's confidential relationship with his or her client, which is conduct these jurisdictions believe to be dishonest or deceitful, and thus in violation of Model Rule 8.4(c). Additionally, some jurisdictions, such as Alabama, also believe that attorneys who search for metadata are engaging in conduct that violates their version of ABA Model Rule 8.4(d), which prohibits attorneys from engaging in conduct that "is prejudicial to the administration of justice." See, Alabama Ethics Op. 2007-02 ("[t]he mining of metadata constitutes a knowing and deliberate attempt by the recipient attorney to acquire confidential and privileged information in order to obtain an unfair advantage against an opposing party").

    On the other hand, the American Bar Association (ABA), Colorado, and Vermont concluded that receiving lawyers may review information contained in metadata in certain circumstances. ABA Formal Op. 06-442 (2006) opined that the Model Rules of Professional Conduct do not prohibit attorneys from mining for and using metadata they received from their opponent. The Colorado State Bar Association, in Formal Ethics Op. 119 (2008), concluded that "a Receiving Lawyer generally may ethically search for and review metadata embedded in an electronic document that the Receiving Lawyer receives from opposing counsel or other third party." The Vermont Bar Association, in Ethics Op. 2009-1 (2009), found "nothing to compel the conclusion that a lawyer who receives an electronic file from opposing counsel would be ethically prohibited from reviewing that file using any available tool to expose the file's content, including metadata."

    Other jurisdictions adopted variations of the Arizona and ABA views. For example, Pennsylvania, in Formal Ethics Op. 2009-100, concluded that the ethical obligations of a receiving attorney would be made on a case-by-case basis. The Pennsylvania bar stated that a receiving attorney "(a) must determine whether he or she may use the data received as a matter of substantive law; (b) must consider the potential effect on the client's matter should the lawyer do so; and, (c) should advise and consult with the client about the appropriate course of action under the circumstances." Similarly, Minnesota's Professional Responsibility Board did not establish a clear rule regarding the mining of metadata. In Ethics Op. 22, the Professional Responsibility Board found that "[w]hether and when a lawyer may be advised to look or not to look for metadata is a fact specific question." The District of Columbia took another approach, this one based upon whether or not the receiving attorney had actual knowledge that the metadata was inadvertently sent. D.C. Bar Ethics Op. 341 (2007), stated that "mere uncertainty by the receiving lawyer as to the inadvertence of the sender does not trigger an ethical obligation by the receiving lawyer to refrain from reviewing that metadata. ... Where there is such actual prior knowledge ..., the receiving lawyer's ethical duty of honesty requires that he refrain from reviewing the metadata until he has consulted with the sending lawyer to determine whether the metadata includes privileged or confidential information."

    A significant minority of the Committee believes that the Rules as currently drafted either prohibit searching for metadata or, at a minimum, do not clearly permit it. In the opinion of this minority, if an electronic document contains metadata that is material to the representation, then the most compelling inference is that the adverse party did not intend to disclose it. In general, one person's discovery of property inadvertently misplaced by another does not give rise to a right to keep, use, impair, or destroy it. Information is a species of property, and the acquisition of confidential information by one for whom it is not intended impairs or destroys a valuable characteristic of that property. The Rules prohibit an attorney from engaging in "conduct involving dishonesty." SCR 20:8.4(c). Dishonesty is not limited to deception (fraud, deceit, and misrepresentation are separately enumerated); under at least some common definitions, the term denotes not only untruthfulness but cheating, stealing, or taking unfair advantage. Thus, because the only metadata worth searching for consists of another's property whose value may be diminished, destroyed, or misappropriated by the very act of discovery, searching for metadata is either potentially dishonest (if the information is material) or pointless (if it is not).

    The minority also notes that the Attorney's Oath, SCR 40.15, mandates that attorneys shall "employ ... such means only as are consistent with ... honor...." Honor, in turn, commonly denotes not only honesty but "fairness or integrity in one's beliefs and actions"; integrity, "adherence to moral and ethical principles." Unlike formal discovery, in which the adversary is given fair warning of the information sought and an opportunity to protect its confidentiality if appropriate, mining for metadata could be characterized as unfair. Because it is professional misconduct for a lawyer to violate the attorney's oath, pursuant to SCR 20:8.4(g), this, too, suggests that mining for metadata may constitute an ethical violation.

    The minority is cognizant of SCR 20:4.4(b), which imposes a limited duty of notification if a lawyer receives a "document" that was inadvertently sent. By its terms, the rule does not literally apply to the intentional transmission of a document that inadvertently contains hidden information. Moreover, the rule was promulgated before the problem of hidden metadata was widely recognized. Unlike an electronic document, the entire content of a written or printed paper appears on the paper's face and has already been disclosed. For these reasons, the minority does not believe that Rule 4.4(b)'s failure to address the issue of hidden metadata can be construed as an authorization to search for it.

    Having considered the approaches and rationales of the various jurisdictions, and the views expressed by the minority of the Committee, the majority of the Committee does not believe that the Rules prohibit Wisconsin lawyers from searching for metadata in documents received from opposing counsel or third parties. This conclusion is supported by the following considerations.

    First, the majority of the Committee agrees with the ABA and does not believe that a receiving lawyer is engaging in deceitful or dishonest behavior when searching for metadata contained within electronic documents. Much of the metadata contained within an electronic document can be revealed by simply clicking on a software icon or by moving a cursor over a document. Even when more elaborate methods are used to mine for metadata, there is nothing inherently deceitful or dishonest about such tactics. Therefore, searching documents received from opposing parties does not violate SCR 20:8.4(c). Second, unlike states such as Alabama, Wisconsin does not have an equivalent of ABA Model Rule 8.4(d), which prohibits attorneys from engaging "in conduct that is prejudicial to the administration of justice," and therefore such a Rule cannot be invoked to prohibit lawyers from searching for metadata.3 Third, an absolute bar on reviewing metadata ignores the fact that lawyers may, in certain circumstances, be compelled by their duty of competent representation to closely examine documents received from opponents or third parties. Therefore, it is the opinion of the majority of the Committee that Wisconsin's Rules do not prohibit lawyers from searching for and reviewing metadata included in an electronic document. A lawyer who searches an electronic document for metadata does not violate Wisconsin's Rules.

    Finally, given the split among jurisdictions, Wisconsin attorneys who appear in other jurisdictions should be aware that the rules of some courts obligate a lawyer receiving metadata to cease reviewing it until consulting with the sending party and to then follow that party's instructions as to its disposition (see footnote 4). Because it is difficult to shield oneself from information once discovered, a deliberate search for metadata by a lawyer appearing before such a tribunal could be interpreted as courting a violation of SCR 20:3.4(c), which prohibits the knowing violation of a tribunal's rules.

    The Receiving Lawyer's Obligations on Discovering that He or She Received Metadata that Appears to Contain Confidential Information. Some jurisdictions that allow lawyers to review metadata hold that receiving lawyers must promptly notify the sender if metadata is discovered. There is, however, some divergence on what lawyers should do if they are informed of the existence of metadata before they review the information.

    The District of Columbia Bar Ethics Committee concluded that a receiving lawyer must stop reviewing metadata until after he or she has consulted with the sending attorney if the receiving lawyer has actual knowledge that the metadata was transmitted inadvertently. DC Ethics Op. 341. The receiving attorney must then follow the instructions of the sending party regarding the return or destruction of the information. The DC Ethics Committee found that the continued review of such information would be considered a dishonest act under D.C. Rule 8.4(c) ("[i]t is professional misconduct for a lawyer to engage in Conduct involving dishonesty, fraud, deceit or misrepresentation") and D.C. Rule 4.4(b) ("[a] lawyer who receives a writing relating to the representation of a client and knows, before examining the writing, that it has been inadvertently sent, shall not examine the writing, but shall notify the sending party and abide by the instructions of the sending party regarding the return or destruction of the writing"). Similarly, the Colorado Ethics Committee found that a receiving lawyer must not review confidential metadata in an electronic file if the receiving lawyer was notified of the inadvertent transmission of the information prior to its review. Colorado Formal Ethics Op. 119 (2008). Like DC, Colorado attorneys must then abide by the sender's instructions as to the information's disposition.  

    The conclusions reached in both of these opinions are not supported by Wisconsin's Rules. First, unlike the District of Columbia, the majority of the Committee does not believe that a lawyer engages in dishonest or deceitful behavior by reviewing inadvertently sent metadata, even if he or she has actual knowledge that the information was inadvertently sent prior to reviewing the information. As stated above, the mere act of searching for metadata within a document is not dishonest. Second, unlike Colorado and DC, Rule 4.4(b) of Wisconsin's Rules of Professional Conduct (SCR 20:4.4(b)) does not contain a provision that requires receiving lawyers to abide by the sending lawyer's instructions as to the disposition of inadvertently sent information. Under SCR 20:4.4(b), the only ethical obligation imposed on lawyers upon receipt of an inadvertently sent document is the duty to notify the sender. While the law does not require an attorney to return the document, Comment [3] states that "the decision to voluntarily return such a document is a matter of professional judgment ordinarily reserved to the lawyer." Thus, unlike Colorado and DC, Wisconsin's Rules give a receiving lawyer discretion as to the disposition of the document, unless the law requires the lawyer to do otherwise, and does not impose any duty beyond notification in the case of an inadvertently sent document.

    Much of the metadata compiled in the creation of an electronic document is irrelevant. This information, such as changes in punctuation and grammar, generally has little impact on a case and often should be viewed as immaterial. If a lawyer discovers such immaterial metadata in a document, the Committee does not believe that SCR 20:4.4(b) applies and the lawyer has no obligations arising under the Rules. However, when metadata contains material information, such as legal strategies or a note to a client about a settlement, whether a lawyer has ethical obligations is a closer question.

    It is reasonable to expect that a sending lawyer will attempt to competently represent his or her client. It is also reasonable to expect that a sending lawyer will attempt to protect the information relating to the representation of his client. Accordingly, it is reasonable to assume that a sending lawyer would not intentionally transmit confidential information of material significance included as metadata in an electronic file to an opposing counsel. Thus, absent circumstances indicating otherwise, a receiving lawyer should normally assume that any metadata of material significance that is exposed in an opposing counsel's electronic document was inadvertently transmitted and SCR 20:4.4(b) is directly applicable. SCR 20:4.4(b) states, "[a] lawyer who receives a document relating to the representation of the lawyer's client and knows or reasonably should know that the document was inadvertently sent shall promptly notify the sender." A lawyer who chooses to review a document for metadata, and discovers metadata of material significance, must notify the sender of the discovery of the metadata.4 The Rules do not, however, impose any duty beyond notification of the sender.5

    A lawyer should normally consider information about legal strategies, settlement parameters, communications between lawyer and client, previously undisclosed relevant facts, information which contradicts previously asserted facts, and any information which appears to be privileged to be information of "material significance" and thus sufficient to trigger a notification requirement. It is not possible to enumerate every category of information that may be of material significance, but lawyers should normally assume that any information that is relevant and the disclosure of which is potentially detrimental to the sending party to fall within this category.

    Finally, the duty of notification arising under SCR 20:4.4(b) supersedes the duty of confidentiality arising under SCR 20:1.6. Thus, a lawyer discovering metadata of material significance must notify the sender even if the lawyer's client instructs the lawyer not to provide such notification.

    As previously noted, other considerations outside the scope of the Rules of Professional Conduct may come into play, including applicable substantive and procedural law. However, the only requirement imposed by the Rules is that an attorney must promptly notify the sender if he or she receives materially significant information contained in metadata from an opposing lawyer.

    Are Receiving Lawyers Compelled By Their Duty of Competence to Actively Search Documents for Metadata? As stated above, Wisconsin's Rules of Professional Conduct require attorneys to take reasonable steps to prevent the inadvertent revelation of confidential information contained within electronic documents. Additionally, Wisconsin's Rules of Professional Conduct do not prohibit attorneys from searching for metadata contained within electronic documents. Thus, the question arises whether lawyers would be compelled by their duty of competence to actively search documents for metadata. The Committee does not believe that any such general duty exists because there is no reasonable basis to conclude that any specific document would contain significant metadata.

    As stated above, under SCR 20:1.1, it is reasonable to expect that a sending attorney will attempt to competently represent his or her client. Under SCR 20:1.6, it is also reasonable to expect that a sending attorney will attempt to protect confidential information relating to the representation of his or her client. Accordingly, a receiving attorney may normally reasonably believe that any metadata of material significance was removed from an electronic document prior to its transmission. Thus, there should be no reasonable basis for an attorney to conclude that any specific document would contain significant metadata. Since there is no reasonable basis for concluding that any electronic document will contain significant metadata, SCR 20:1.1 does not compel Wisconsin attorneys to actively search documents for metadata.

    Further, as stated above, lawyers normally should assume that metadata of material significance was inadvertently sent and therefore, should promptly notify the sender pursuant to SCR 20:4.4(b). As stated in Comment [3] to SCR 20:4.4, it is within the professional discretion of a lawyer who receives an inadvertently sent document to decide whether to return the document unread. This compels the conclusion that lawyers do not have an affirmative duty arising under the Rules to routinely search documents for metadata. The Committee notes however, that specific circumstances may warrant that a lawyer search a specific document for metadata.

    Conclusion

    Wisconsin lawyers should be aware of the ethical responsibilities associated with the transmission and receipt of electronic documents containing metadata. Lawyers who send electronic materials are ethically required to take reasonable care to avoid the disclosure of confidential information contained within metadata. Additionally, it is generally permissible for Wisconsin attorneys to search for and review metadata contained within electronic documents. However, when an electronic document contains material metadata, a lawyer should know that the information was inadvertently sent and he or she should promptly notify the sending lawyer. The receiving lawyer then has the discretion to return the information, unless the law requires him to do so. Furthermore, it should be noted that the ability to mine for and review metadata contained within an electronic document does not create an ethical obligation for Wisconsin attorneys to actively search for metadata contained within electronic documents.

    Endnotes

    1 While a full discussion of the topic is beyond the scope of this opinion, it may be the case that lawyers today must have or obtain a minimum level of technological ability in order to competently practice law. See, e.g., ABA Formal Op. 11-459; Pennsylvania Formal Ethics Op. 2011-200. Most clients expect their lawyers to use modern methods of communication, such as email, and some courts require that documents be filed electronically. A lawyer must be able to understand the technology in order to understand the risks involved in its use, and thus act competently to preserve the confidentiality of electronically stored or transmitted client information. See also SCR 20:1.1, Comment [5].

    2 As of the date of this opinion, in most instances attorneys can limit the likelihood of transmitting electronic documents containing confidential information in metadata by avoiding its creation during the drafting and editing stages, by subsequently deleting it using a scrubbing program, converting the document to pdf format, as well as by sending a different version of the document without the information (for example, a scanned or faxed version).

    3 The closest analogy to MR 8.4(d) in Wisconsin's Rules is SCR 40:15 (the Attorney's Oath), which, pursuant to SCR 20:8.4(g), is misconduct to violate. The majority of the Committee, however, does not believe that any of the provisions of SCR 40.15 prohibit a lawyer from searching for metadata.

    4 Lawyers who choose to review a document for metadata and discover information that appears to be privileged, should not necessarily assume that they are free to use the information as they see fit. While the Rules do not prohibit searching or reviewing such information, that does not necessarily mean that that information has lost its privileged status. See Harold Sampson Children's Trust v. The Linda Gale Sampson 1979 Trust, 2004 WI 57, 679 N.W.2d 794.

    5 Notwithstanding the limited requirements of Rule 4.4(b), courts in various jurisdictions have imposed duties upon lawyers in receipt of materials that may have been wrongfully obtained that go beyond the requirements of the Rules. See, e.g., Castellano v. Winthrop, 27 So. 3d 134 (Fla. Dist. Ct. App 2010). As of the date of this opinion, the Committee is unaware of any such case in Wisconsin. Lawyers should nonetheless be alert to obligations imposed by case law.