Question

You previously addressed several considerations that a lawyer must think about when trying to protect client confidential information. What else should be considered to show the lawyer is acting reasonably?

Answer

A lawyer must think about and act on various considerations when seeking to protect client information, whether that information is stored on the lawyer’s computer or the devices being used to communicate with the client. The ethics column in the November Wisconsin Lawyer addressed some of the basics a lawyer must consider. The recent opinion from the ABA Standing Committee on Ethics and Professional Responsibility suggested additional considerations regarding the exercise of reasonable efforts to protect confidential information.

The lawyer must determine how electronic communications are going to be protected and, at the start of the representation, discuss with the client the protective measures the lawyer will use. The lawyer and client might decide that some types of communications need extra security such as encryption because of the nature of the communication and the information included within the communication. Third-party cloud-based file storage systems or portals could be used to exchange documents instead of using communication by email with attachments.

The lawyer also should be careful when communicating information to the client, by not using public access services that could be invaded by a third party. The lawyer should also advise the client about communications by electronic methods and make sure that the client is only communicating through a secure communication system and not using a system owned by a third party.

Lawyers also need to understand that information communicated to a client should be properly marked or identified to ensure some protection from inappropriate access or review of the information. Lawyers should mark important communications as privileged and confidential and make those disclosures early in the email communication instead of relying solely on a disclaimer at the end of the communication.

Lawyers should take particular care to ensure that information that will be treated as privileged under the evidence rules is carefully marked to avoid any misunderstanding by someone reading the document.

Lawyers must also ensure that nonlawyer assistants and other staff members are properly trained and understand what is expected of them in maintaining the security and confidentiality of client information.

Lawyers also need to be trained in technology and information security so they understand which protections are provided and which are not provided by the different devices and methods they use to communicate with their clients. Lawyers must also ensure that nonlawyer assistants and other staff members are properly trained and understand what is expected of them in maintaining the security and confidentiality of client information. Any policies the lawyer adopts must be carefully implemented for all staff working on client matters.

Finally, lawyers must conduct proper due diligence on any vendors that are providing communication technology and assisting in the communication of information to clients. This involves reference checks and verification of a vendor’s security policies and protocols and some type of confidentiality agreement so that the vendor clearly understands the importance of maintaining the confidentiality of client information.

The considerations identified in the ABA Standing Committee Opinion are an initial starting point for lawyers to assess whether they are taking reasonable steps to ensure confidentiality and protect client information in their possession. Each situation will be different depending on the information involved and the particular client’s needs. Lawyers must make sure they have taken proper steps to protect the confidentiality of that information.