Duty to Safeguard Information

Duty to Safeguard Information

Paragraph (a) restrains what a lawyer chooses to reveal: without the client's informed consent, implied authorization, or a paragraph (b) exception, the lawyer may not reveal information relating to the representation.¹ A lawyer who leaves a client's file on a train seat has chosen to reveal nothing, and an intruder who breaks into the firm's server has taken what the lawyer never offered. Paragraph (c) reaches both losses: “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”²

The text names three events. An inadvertent disclosure is one the lawyer did not intend, such as an email sent to the wrong recipient. An unauthorized disclosure is one that no one with authority approved. Unauthorized access is entry by an outsider to whom the lawyer gave nothing at all. The information protected is the category paragraph (a) protects, so everything earlier in this chapter about what counts as information relating to the representation carries over unchanged.³

A separate paragraph is needed because a leak does the client the same damage whether or not the lawyer meant it. The client cannot guard what has been handed over, while the lawyer controls the cabinets, devices, accounts, and staff through which the information moves. Paragraph (c) therefore converts the lawyer's silence into an affirmative duty of care: the lawyer must protect the information as well as refrain from announcing it.

The duty is framed around efforts, and the efforts must be reasonable. The next subsection explains how reasonableness is measured. The two after it apply the duty to the people who handle information for the lawyer and to the electronic channels through which it travels.

Reasonable Efforts Standard

Paragraph (c) judges a lawyer by the precautions taken, not by whether information escaped. The rule asks for “reasonable efforts,”⁴ and Comment 18 states the consequence: unauthorized access to, or inadvertent disclosure of, client information is not an ethics violation if the lawyer made reasonable efforts to prevent it.⁵ A leak tells you where to look. The quality of the lawyer's precautions decides whether a violation occurred.

Two alternative rules show why the standard is built this way. A rule keyed to results would make the lawyer an insurer against every outsider. No filing system or network can be made impenetrable, so a skilled intruder's success would turn the victim into a rule violator, and lawyers would have reason to avoid efficient tools altogether. A rule keyed to intent would fail the client instead, because a lawyer who never decided to reveal anything can do the same damage by leaving a file where anyone can read it. The efforts standard demands real precautions and measures them against what a careful lawyer could have done.

Comment 18 supplies five considerations: the sensitivity of the information, the likelihood of disclosure if no additional safeguards are used, the cost of additional safeguards, the difficulty of implementing them, and the effect of the safeguards on the lawyer's ability to represent the client.⁶ The first two measure risk. Sensitivity asks how much harm exposure would cause, which is why a client's trade secrets or medical history demand more care than a routine scheduling note. Likelihood asks how probable a leak is as things stand: where ordinary practices already make exposure remote, an extra safeguard buys little, and where the setting invites leakage, as a shared room open to visitors does, the case for more protection grows.

The other three measure burden. Cost keeps the standard proportionate, since a safeguard that costs more than a modest matter is worth is not one a reasonable lawyer must buy. Difficulty recognizes that some measures need technical skill or staff time that a small office cannot readily supply. The last consideration ties the standard to the purpose of confidentiality: a safeguard so cumbersome that the lawyer cannot communicate with the client or move the matter forward defeats the reason for protecting the information. Reasonableness is therefore a weighing of risk against burden, and the heavier the risk, the more burden the lawyer is expected to bear.

Above the baseline of ordinary office care, more sensitive information, a confidentiality agreement, or a client's demand may call for special security measures.⁷

Both the coworking lawyer and the firm lost control of client information, and the only difference between them lies in what each did beforehand. The firm's result follows directly from Comment 18: unauthorized access is not a violation when reasonable efforts were made to prevent it.⁸ A fact pattern that reports exposed files therefore decides nothing in either direction. It does not condemn the careful lawyer, and it does not excuse the careless one.

The client can move the standard up or down for a particular file. A client may require special security measures, and a client may give informed consent to forgo particular measures.⁹ The information concerns the client's affairs, so the client's instruction legitimately sets how much protection matters for that file. Consent to do without a safeguard counts only if it is informed in the sense taught earlier: the client heard the risks of dropping the measure and the alternatives before agreeing.

Supervising Staff and Vendors

The efforts paragraph (c) requires cannot stop at the lawyer's own conduct, because client information rarely stays in one pair of hands.¹¹ Paralegals and secretaries open the file, couriers carry the envelopes, and outside companies maintain the servers on which the documents sit. Reasonable efforts therefore include the arrangements the lawyer makes for everyone who touches the information on the lawyer's behalf.

The rule attaches the obligation to the lawyer because the lawyer holds the control. A duty that bound only the lawyer would leave the client's protection exactly as strong as its weakest participant, and the client cannot choose, instruct, or monitor the people in the lawyer's office or the lawyer's vendors. The lawyer decides who gets access, writes the instructions, and signs the contracts. Unless the client has said that only designated lawyers may see the information, the lawyer may share it with others in the firm as necessary to do the work;¹² the safeguarding question is what those people do with that access.

Rule 5.3 supplies the supervisory duty. Lawyers must manage and supervise nonlawyer assistants by taking reasonable measures to uphold professional obligations, which Comment 2 says include “the obligation not to disclose information relating to the representation of the client.”¹³ Within that responsibility, the lawyer must give employees appropriate instructions about professional obligations, and the instruction singled out is the one about the duty to safeguard protected information about clients.¹⁴ Instruction does real work. A new assistant who has never been told what is protected has no reason to think a lunchtime remark about a client's pending deal is a breach. It also costs little, which matters under the weighing described above: a short conversation and a standing office practice add a great deal of protection for almost no burden.

Drafting work shows what instruction looks like in practice. A lawyer who prepares agreements for prominent individuals or businesses handles material that others want to see, such as the terms of a celebrity separation or a company's trade secrets, and a leak can come from anyone privy to it, including someone whose only motive is the pleasure of passing along gossip.¹⁵ The lawyer therefore has an affirmative obligation to educate everyone involved in the matter, even couriers, about confidentiality, and drafts containing sensitive information should be shredded rather than dropped in a trash can.¹⁶ A wastebasket gives whoever empties or searches it the access the lawyer was trying to prevent. Both measures are cheap, and each closes a route that the lawyer's personal care could not close alone.

Outside contractors raise the same concern with a different structure. When a firm delegates support work to an outside company, the managerial and supervisory lawyers must adopt appropriate measures to ensure that the independent contractors also understand and adhere to professional ethical standards.¹⁷ For an outside computer-maintenance company, the ABA's Standing Committee on Ethics and Professional Responsibility advises the firm to “ensure that the company has in place, or will establish, reasonable procedures to protect the confidentiality” of the firm's computer files.¹⁸ A vendor's employees answer to the vendor, so the firm cannot instruct them one by one as it instructs its own assistants. What the firm can do is act at the outset: ask about the vendor's procedures, require the vendor to establish them where they are missing, and tell the vendor that client files must be protected. A maintenance contractor with run of the file server may see every client's matter, so the exposure from an unexamined vendor can reach everything the firm handles.

Each scene turns on what the firm did beforehand, because paragraph (c) asks for reasonable efforts to prevent a leak and does not make the firm answerable for every leak.¹⁹ Two answers fail. One treats hiring a vendor as the end of the firm's concern and so misses the duty to see that the contractor understands and follows confidentiality standards. The other assumes assistants know the duty by instinct and so misses the requirement to instruct them. Delegating the work does not delegate the responsibility.

Technology and Communications

Rule 1.6(c) requires reasonable efforts to prevent inadvertent disclosure and unauthorized access,²¹ and that standard now has to be applied to the channels lawyers actually use: email, cell phones, and electronic documents. Comment 19 describes the duty as taking “reasonable precautions to prevent the information from coming into the hands of unintended recipients,” and it adds that the duty does “not require that the lawyer use special security measures if the method of communication affords a reasonable expectation of privacy.”²²

The limiting half of that comment is practical. Where the method already gives the sender a reasonable expectation of privacy, a lawyer who had to add encryption or client waivers to every message would take on cost and delay for little added protection. The expectation of privacy is also backed by law, because unauthorized interception of an electronic message is a violation of federal criminal law.²³

The ABA's Standing Committee on Ethics and Professional Responsibility and most states that addressed the question concluded early on that the expectation of privacy in email is no less reasonable than in ordinary telephone calls. A lawyer therefore does not violate Rule 1.6 by communicating with a client over unencrypted internet email without specific client consent.²⁴ Cell phones follow the same logic. Most now use digital technology, which is harder to intercept than a wired line, and interception of cellular communications is also a federal crime, so their use for attorney-client conversations fits within a reasonable expectation of privacy.²⁵

That conclusion holds in ordinary circumstances, and it does not mean that “email is always safe.” Special circumstances change the answer: when information is of greater sensitivity, a confidentiality agreement so requires, or the client demands additional measures, special security measures may need to be implemented.²⁶ Greater sensitivity raises the harm from exposure, so even a small chance of a leak deserves more protection, and an agreement or a client's demand can fix the required measures directly.

Two opposite mistakes are common on exams. One treats unencrypted email as always acceptable and so ignores a client's instruction or an agreement that says otherwise. The other treats encryption as mandatory for every message and so overlooks that ordinary methods generally need nothing extra. Reasonableness sits between them, and it moves with the sensitivity of the information and the circumstances of the transmission.

Electronic documents carry a risk that the visible text does not show. A file can hold embedded information, such as redlined changes and margin comments, that never appears on the page the sender is reading. That information still relates to the representation, so paragraph (c) calls for reasonable efforts to keep it from reaching the other side.²⁷ Keeping abreast of this kind of risk is also part of competence, since Comment 8 to Rule 1.1 tells lawyers to stay current on “the benefits and risks associated with relevant technology.”²⁸

The steps open to the sender are modest. The sender can avoid creating embedded data by skipping the redlining function and embedded comments, delete any comments that exist, and scrub remaining embedded information before sending. The recipient is counsel for a contending party, and the adversary system contemplates that each side marshals its case competitively,²⁹ so the sender cannot count on the other side to look away.