Vol. 85, No. 2, February 2012
I use a lot of technology equipment in my law practice. What steps must I take to ensure confidentiality of client information when disposing of this equipment?
Dean R. Dietrich, Marquette 1977, of Ruder Ware, Wausau, is past chair of the State Bar Professional Ethics Committee. He can be reached at firstname.lastname@example.org.
Maintaining confidentiality of client information is a crucial element of the lawyer/client relationship. Lawyers must always be aware of the facts and circumstances surrounding communication of client information and make sure that confidentiality is preserved. The duty to preserve confidentiality extends to the use of various types of equipment, such as copy machines, cell phones, personal digital assistants (PDAs), flash drives, and fax machines, that hold data on a hard drive or store data as part of their functioning. All client information that is stored on that equipment would be considered client information and subject to the confidentiality requirements. SCR 20:1.6 clearly provides that “information relating to the representation of a client” shall not be revealed by the lawyer unless the client gives informed consent. The comment to this rule makes clear that the rule “applies not merely to matters communicated in confidence by the client but also to all information relating to the representation, whatever its source....”
This duty of confidentiality raises a significant question regarding lawyers’ obligations when using different types of technology equipment and when discontinuing the use of that equipment, such as by discarding a fax machine, a hard drive, or a cell phone. It is clear that a lawyer has a duty to be aware of and understand the type of equipment being used and the potential for breach of confidentiality when using the equipment or when discarding the equipment. Florida Bar Opinion 10-2 (Sept. 24, 2010) summarized this duty as follows:
“If a lawyer chooses to use the Devices that contain Storage Media, the lawyer has a duty to keep abreast of changes in technology to the extent that the lawyer can identify potential threats to maintaining confidentiality. The lawyer must learn such details as whether the Device has the ability to store confidential information, whether the information can be accessed by unauthorized parties, and who can potentially have access to the information. The lawyer must also be aware of different environments in which confidential information is exposed such as public copy centers, hotel business centers, and home offices. The lawyer should obtain enough information to know when to seek protection and what Devices must be sanitized, or cleaned of all confidential information, before disposal or other disposition....”
Ensuring Confidential Client Communications
The December 2011 ethics column, entitled “Ensuring Confidential Client Communications,” referenced ABA Ethics Opinion 11-461, which addresses the right of a lawyer to consult with a client about the client’s direct contact with the opposing party in a matter. The ABA opinion suggests that a lawyer, as part of his or her duties in the representation, could prepare documents that the client would transmit to the opposing party as long as those documents did not result in the opposing party admitting information that would be used against the party.
The ABA Committee on Professional Ethics is reviewing Opinion 11-461 based on the suggestion from many lawyers that the opinion goes too far in authorizing activity by counsel that would be shared with an opposing party by the client. I will keep you updated regarding the status of this ethics opinion. – Dean R. Dietrich
The opinion also suggests that the duty of competence is applicable from the time the lawyer receives the equipment until the equipment is disposed of, even if disposal occurs when the equipment is no longer under the lawyer’s control. The opinion further suggests that:
“A lawyer has a duty to obtain adequate assurances that the Device has been stripped of all confidential information before disposition of the Device. If a vendor or other service provider is involved in the sanitization of the Device, such as at the termination of a lease agreement, or upon sale of the Device, it is not sufficient to merely obtain an agreement that the vendor will sanitize the Device upon sale or turn back of the Device. The lawyer has an affirmative obligation to ascertain that the sanitization has been accomplished, whether by some type of meaningful communication, by having the sanitization occur at the lawyer’s office, or by other means.”
The Florida opinion suggests the following regarding the overall duty of the lawyer to maintain client confidentiality:
“In conclusion, when a lawyer chooses to use Devices that contain Storage Media, the lawyer must take reasonable steps to ensure that client confidentiality is maintained and that the Device is sanitized before disposition. These reasonable steps include: (1) Identification of the potential threat to confidentiality along with the development and implementation of policies to address the potential threat to confidentiality; (2) Inventory of the Devices that contain Hard drives or other Storage Media; (3) Supervision of non-lawyers to obtain adequate assurances that confidentiality will be maintained; and (4) Responsibility for sanitization of the Device by requiring meaningful assurances from the vendor at the intake of the Device and confirmation or certification of the sanitization at the disposition of the Device.”
Although this topic is still subject to much discussion and debate, it is clear that lawyers are required to have some basic understanding of the function and operations of equipment that is used in their practices, especially if that equipment is storing client information as part of its functioning. Special care must be exercised at the time of disposing of equipment used in the practice to make sure that client information is not somehow transmitted or left on the equipment for discovery by someone else.