Technology is changing the way we practice law. ABA’s 20/20 Ethics Commission is debating changes to the model rules to reflect the impact of technology. Confidentiality
A few states have already begun to address technology and how we practice law by issuing advisory ethics opinions.
“Sorry, I’m computer-illiterate.”
Florida Rule of Professional Conduct 4-1.1 requires the legal knowledge, skill, thoroughness and preparation reasonably necessary to protect confidentiality. “Lawyers must keep abreast of changes in technology to the extent that the lawyer can identify potential threats to maintaining confidentiality.”
Florida Bar Opinion 10-2 suggests the following best practices:
(1) identification of the potential threat to confidentiality. . . ;
(2) inventory of the devices that contain hard drives or other storage media;
(3) supervision of non-lawyers to obtain adequate assurances that confidentiality will be maintained; and
(4) responsibility for erasing the data. . .
“How do I identify these potential threats?”
Identifying the threats to client confidentiality can be difficult. Here is a list of common devices and environments where the risk of exposure may be found:
“Danger Zone” Environments
- Unsecured public WiFi systems
- Cloud computing (i.e. Dropbox, Google Docs)
- Copy and business centers
- Home offices
- Crowded rooms
“Danger Zone” Devices
- Cellular phones
- Memory sticks, DVDs, CDs, Memory Cards, Tapes
- External hard drives
- Voicemail
- Cameras
- Copiers
- Scanners
- Printers
- Faxes
- Keylogging hardware
- RFID/NFC (near field communication) enabled devices
- GPS devices
“But I don’t know how to erase data on half of these devices!”
For lawyers without the technical proficiency required to sanitize devices, Florida Bar Opinion 10-2 allows non-lawyers to aid in the [erasing] of data, pursuant to Rule 4-5.3, Responsibilities Regarding Non-lawyer Assistants. There is “an affirmative obligation to ascertain that the [erasing] has been accomplished, whether by some type of meaningful confirmation, by having the [erasing] occur at the lawyer’s office, or by other similar means. . . it is not sufficient to merely obtain an agreement that the vendor will sanitize the device upon [disposal] of the device.” Professional Ethics of the Florida Bar Opinion 10-2 (September 24, 2010).
