Also known as: accesses without authorization · accessed without authorization · accessing without authorization · unauthorized access
Written by attorneys · grounded in primary & secondary sources — see below
An obligation imposed on lawyers to take reasonable steps to avoid improper entry into client files or data. The duty requires protective measures calibrated to the sensitivity of the information and the risks of exposure.
Amy transmitted spreadsheets containing a client's bidding strategy through a file-sharing service that created a password-free link. She omitted expiration dates and IP restrictions she had used for less sensitive files in the past. The link remained active for weeks, became indexed by a search engine, and allowed public access to the confidential materials.
Ida saved interview notes and a draft report on faculty misconduct to a shared firm folder. The folder granted read-write access to every attorney and staff member by default, including a paralegal not assigned to the matter. No additional restrictions were applied despite the personal and academic information involved.
Select any source to read its text and confirm it supports the definition.
The sensitivity of the client information, the number of people with access, and the ease of access are key factors. Measures such as encryption, login credentials, and matter-specific restrictions may be considered. A general firm confidentiality policy alone may not suffice when default permissions are broad.
Supporting sources
No actual unauthorized access does not automatically establish that reasonable efforts were made. The rule focuses on the reasonableness of the protective measures taken rather than whether a breach occurred. Courts weigh the precautions against the risks presented by the specific information.
Supporting sources
Industry custom and prior safe experience with a platform provide some support for a lawyer's choices. They do not override the need for heightened protections when highly sensitive strategic materials are involved. The rule requires efforts calibrated to the circumstances rather than mere adherence to common practices.
Supporting sources