Ethics Corner Article
New Hampshire Bar News – August 23, 2013
Dear Ethics Committee: I have heard about attorneys using cloud data storage services, and, although I don’t know exactly what cloud computing is, it seems like the wave of the future. I understand that I can store my client files in the cloud. As a solo practitioner with a small office and limited storage space, this is intriguing to me. What do you think about this?
Cloud computing is the storage of data and the ability to run applications on remote servers over the Internet, rather than on a desktop computer or a server physically located in a law office. The “cloud” in which data are stored is really a network of servers or server-farms located throughout the country and world. Companies such as Apple and Google own server-farms.
Assuming that you use the Internet, you likely already have some of your information in the cloud, as services such as Gmail, Facebook, Flickr, and LinkedIn all operate in the cloud. If you have a LinkedIn account, for example, your account information and news stream is not stored on the computer that you use to access the Internet; that information is stored on a third-party’s servers.
A lot of attorneys are using cloud computing to either store information (including client files) or to collaborate online with a client or colleague on a document. Not surprisingly, there are risks – and, therefore, ethical considerations – associated with the storage of client information in the cloud.
The New Hampshire Bar Association’s Ethics Committee has recently issued an advisory opinion (#2012-13/4) on cloud computing in which the committee adopts the consensus of states that an attorney may use cloud storage services consistent with his or her ethical obligations, as long as the attorney takes reasonable steps to ensure that sensitive client information remains confidential. Please read the advisory opinion, as it offers much more detail and consideration than there is space for here in Ethics Corner.
Among the Rules of Professional Conduct implicated by cloud storage is Rule 1.1, which requires an attorney to provide competent legal representation. Although you need not become a data storage expert to provide competent legal representation, if you are going to use a cloud storage service such as Dropbox, Box, Google Drive, or Legal Workspace you must be aware of how that data are stored and what the service agreement says, including which jurisdiction’s law applies to the agreement and where the servers are located. When you upload information into a cloud storage folder, you are putting your client’s confidential and privileged information in the hands of a third party. Essentially, you are outsourcing the storage of this information to a non-lawyer assistant, which is governed by Rule 5.3.
As a foundational component of lawyering, Rule 1.6 requires that you keep confidential all information relating to the client or your representation of the client, unless the client gives informed consent or if the disclosure is impliedly authorized. If you are going to store client files with a cloud storage service, you must consider whether such storage is impliedly authorized or whether you need to obtain informed consent. Important factors for you to consider include the prevalence of cloud storage, your client’s familiarity with cloud storage, and the sensitivity of the particular information you seek to put in the cloud.
Cloud storage also implicates Rules 1.15 and 1.16(d) because you are the safe-keeper of your client’s property and must return a client’s file to a client upon request. Thus, you must be aware of the safeguards that the cloud storage provider has in place with regard to the security of, and the availability of, stored data. You will also need to determine how you will return a file to the client and ensure that the data are deleted from the cloud after the representation is concluded.
There is a lot of information available to help you decide whether to use cloud storage and, if you do, what services are available. For starters, the ABA has published an article titled “Delivering Value and Efficiency with Technology: Effectively Collecting and Managing Data in a Virtual World,” that discusses services such as Dropbox, Box, Google Drive, Legal Workspace, and others. Members of the New Hampshire Bar may contact the Ethics Committee regarding access to the article.
The Ethics Committee provides general guidance on the NH Rules of Professional Conduct with regard to a lawyer’s own prospective conduct. New Hampshire lawyers may contact the Ethics Committee for confidential and informal guidance by emailing the Ethics Committee Staff Liaison. Brief ethics commentaries based upon member inquiries and suggestions will be published monthly in the NH Bar News.