![\"pdf_icon\"](\"http:\/\/jolt.richmond.edu\/files\/2012\/05\/pdf_icon1.gif\")
<\/p>\nCite as: Stacey Blaustein et al.,\u00a0Digital Direction for the Analog Attorney<\/em>\u2014<\/strong>Data Protection, E-Discovery, and the Ethics of Technological Competence in Today\u2019s World of Tomorrow<\/em>, 22 Rich. J.L. & Tech. 10 (2016), http:\/\/jolt.richmond.edu\/v22i4\/article10.pdf.<\/p>\n \u00a0<\/strong>Stacey Blaustein,*<\/a> Melinda L. McLellan,**<\/a> and James A. Sherer***<\/sup><\/p>\n <\/p>\n I. \u00a0Introduction<\/strong><\/p>\n \u00a0<\/strong>[1]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Over the past twenty years, the near-constant use of sophisticated technological tools has become an essential and indispensable aspect of the practice of law. The time and cost efficiencies generated by these resources are obvious, and have been for years.[1]<\/a> And because clients expect their counsel to take full advantage,[2]<\/a> savvy attorneys understand that they must keep up with ever-evolving legal technologies to stay competitive in a crowded marketplace.[3]<\/a><\/p>\n [2]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 With increased globalization and exponential growth in the creation, collection, use, and retention of electronic data, the challenges to all lawyers\u2014especially those who may not have tech backgrounds or a natural aptitude for the mechanics of these innovations\u2014are multiplying with breathtaking speed.[4]<\/a> Nevertheless, many attorneys are either blissfully unaware of the power and potential danger associated with the tools they now find themselves using on a daily basis, or they are willfully avoiding a confrontation with reality. For lawyers, technological know-how is no longer a \u201cnice to have\u201d bonus; it now poses an ethical obligation. Where competent client representation demands a minimum level of tech proficiency, however, many lawyers come up short with respect to this fundamental component of their professional responsibilities.[5]<\/sup><\/sup><\/a><\/p>\n [3]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 What types of privacy and data security threats do various technologies pose to attorneys, their firms, their clients, and the legal profession in general? What rules and regulations govern how attorneys may make use of technology in their practice, and how might clients seek to impose restrictions around such use when it comes to their corporate data? Must attorneys gain mastery over the intricate mechanics of the technological resources they employ, or is basic knowledge sufficient? How can we weigh the potential risks and rewards of cutting-edge, emerging digital products and electronic resources about which clients\u2014and indeed, even the lawyers themselves\u2014may understand very little? These are just a few of the questions that arise when we consider the issue of technological competence in the legal profession and corresponding ethical requirements.<\/p>\n [4]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 To begin to answer these questions, we look to the applicable Model Rules issued by the American Bar Association (\u201cABA\u201d), various state-level professional ethics rules that incorporate the Model Rules, associated ethics opinions and guidance issued by the states, state and federal court decisions, and guidelines issued by sector-specific agencies and organizations.[6]<\/sup><\/sup><\/a> Our focus in this investigation concerning lawyerly \u201ctechnological competence\u201d will be on privacy and data security risks and safeguards, e-Discovery-related challenges, and the potential perils of various uses of social media in the legal sphere.<\/p>\n \u00a0II. \u00a0<\/strong>The Threat Landscape: Law Firms as Prime Targets<\/strong><\/p>\n [5]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 In recent years, the volume and severity of attacks on electronically-stored data, and the information systems and networks that house that data, have increased exponentially. The modern-day \u201cthreat environment\u201d is \u201chighly sophisticated,\u201d and \u201cmassive data breaches are occurring with alarming frequency.\u201d[7]<\/a> For attorneys, such perils implicate multiple ethical and professional responsibilities with respect to how they handle data, including the duty to protect the confidentiality of client information and the obligation to provide \u201ccompetent\u201d representation.<\/p>\n [6]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Unfortunately, law firms can provide a proverbial back door for hackers seeking access to a company\u2019s data, as attorneys often are custodians of a veritable \u201ctreasure trove\u201d of valuable client information \u201cthat is extremely attractive to criminals, foreign governments, adversaries and intelligence entities.\u201d[8]<\/a> Some hackers even focus their efforts primarily on law firms, especially those firms collecting vast amounts of data from corporate clients in the course of E-Discovery or corporate due diligence.[9]<\/a> Corporate secrets, business strategies, and intellectual property all may be found in a law firm\u2019s collection of its clients\u2019 data.[10]<\/a> In some cases, the interceptors may be looking for competitive information relevant to merger negotiations, or trying to suss out evidence of as-yet unannounced deals for insider trading purposes.[11]<\/a><\/p>\n [7]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 A 2015 report estimated that 80% of the biggest 100 law firms have experienced some sort of data security incident.[12]<\/a> And as is the case with so many companies that suffer a breach, law firms that have<\/em> been hacked may not know about it for a considerable period of time. Moreover, unlike other industry sectors subject to various reporting requirements, law firms generally do not have a statutory obligation to publicly report cybercrimes that do not involve personally identifiable information.[13]<\/a> Lack of obligations notwithstanding, a recent report indicated that \u201c[t]he legal industry reported more \u201ccyber threats\u201d threats in January [2016] than nearly any other sector,\u201d topped only by the retail industry and financial services.[14]<\/a><\/p>\n [8]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Although these reported \u201cthreats\u201d might not necessarily result in data compromises, the fact that the legal industry frequently is among the most targeted for data theft should concern attorneys.[15]<\/a> Anecdotal evidence of actual and attempted interference with law firms\u2019 data security systems abounds as well. In 2014, a report indicated that communications between lawyers from the law firm of Mayer Brown and officials with the Indonesian government were intercepted by an Australian intelligence agency that had ties with the U.S. National Security Agency (\u201cNSA\u201d).[16]<\/a> And the managing partner of the Washington-area offices of Hogan Lovells LLP recently noted that her firm \u201cconstantly intercept[s] attacks.\u201d[17]<\/a><\/p>\n [9]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The message to law firms seems clear: first, if \u201cyou\u2019re a major law firm, it\u2019s safe to say that you\u2019ve either already been a victim, currently are a victim, or will be a victim.\u201d[18]<\/a> Second, \u201c[f]irms have to make sure they are not a weak link\u2026which at its most basic level means their standards for protecting data need to be at least equivalent to those of the companies they represent.\u201d[19]<\/a><\/p>\n [10]\u00a0\u00a0\u00a0\u00a0 It seems inevitable that client expectations and demands with regard to their legal service providers\u2019 security will continue to evolve and expand. One commentator recently predicted that in the future \u201cclients across the board will demand firms demonstrate they\u2019re prepared for all shapes and sizes of cybersecurity breaches,\u201d[20]<\/sup><\/sup><\/a> while another prophesized that \u201cin the name of risk management and data leakage prevention, a large financial industry corporation will challenge their outside counsel\u2019s [Bring Your Own Device] program.\u201d[21]<\/a> Indeed, according to a 2014 report in the New York Times:<\/p>\n Banks are pressing outside law firms to demonstrate that their computer systems are employing top-tier technologies to detect and deter attacks from hackers bent on getting their hands on corporate secrets for their own use of sale to others\u2026.Some financial institutions are asking law firms to fill out lengthy 60 page questionnaires detailing the [law firm\u2019s] cybersecurity measures, while others are demanding on-site inspections\u2026.Other companies are asking law firms to stop putting files on portable thumb drives, to stop emailing non-secure iPad or working on computers linked to a share network in countries like China and Russia.[22]<\/sup><\/sup><\/a><\/p>\n [11]\u00a0\u00a0\u00a0\u00a0 In short, lawyers, law firms, and other legal services providers cannot afford to be complacent when it comes to cybersecurity.<\/p>\n A. \u00a0Lawyering in the Cloud <\/strong><\/p>\n [12]\u00a0\u00a0\u00a0\u00a0 Firm adoption of cloud services is on the rise, especially among boutiques and solo practitioners that previously lacked the resources to compete effectively with larger law firms when it came to technology and data storage.[23]<\/a> At first, the added value of cloud services created a perception that \u201cnirvana had arrived\u201d in terms of leveling the playing field for smaller firms.[24]<\/a> Notwithstanding the apparent advantages of the cloud, attorneys were quick to identify concerns associated with the technology and its supporting practices, including \u201cincreased sensitivity to cyber-threats and data security.\u201d[25]<\/a> Some commentators opted for a cautious and conservative approach, noting that the \u201clegal profession has developed many safeguards to protect client confidences,\u201d and that the use of cloud hosting, among other practices, fell on a continuum where, as \u201can individual attorney gives up direct control of his or her client\u2019s information, he or she takes calculated risks with the security of that information.\u201d[26]<\/a><\/p>\n [13]\u00a0\u00a0\u00a0\u00a0 There is hope for attorneys drawn to the advantages of cloud services, but vigilance and diligence is required. As noted in tech law guidance from March 2014, \u201c[u]sing the cloud to hold data is fine, so long as you understand the security precautions.\u201d[27]<\/a> Security concerns have put a damper on adoption rates and the development of attorney-specific cloud services lags behind other industries. This reluctance is unsurprising given the slow rate of technological advancements within the profession generally,[28]<\/a> and a deserved reputation that the tendency of firms is \u201cto be technology followers, not leaders.\u201d[29]<\/a> That said, lawyers do seem to be embracing the cloud to some extent,[30]<\/a> with the majority utilizing cloud solutions in some capacity,[31]<\/a> even if implementation is mostly through \u201csporadic action and adoption among firms and law departments.\u201d[32]<\/a><\/p>\n [14]\u00a0\u00a0\u00a0\u00a0 With respect to professional obligations, this type of implementation may not require specific technological expertise on the part of the attorneys. New York State Bar Association Opinion 1020, which addressed ethical implications of the \u201cuse of cloud storage for purposes of a transaction,\u201d determined that compliant usage \u201cdepends on whether the particular technology employed provides reasonable protection to confidential client information and, if not, whether the lawyer obtains informed consent from the client after advising the client of the relevant risks.\u201d[33]<\/a><\/p>\n [15]\u00a0\u00a0\u00a0\u00a0 Further, New Jersey Opinion 701 addresses the reality that it is<\/p>\n [N]ot necessarily the case that safeguards against unauthorized disclosure are inherently stronger when a law firm uses its own staff to maintain a server. Providing security on the Internet against hacking and other forms of unauthorized use has become a specialized and complex facet of the industry, and it is certainly possible that an independent [Internet Service Provider] may more efficiently and effectively implement such security precautions.[34]<\/a><\/p>\n [16]\u00a0\u00a0\u00a0\u00a0 Opinion 701 does include an additional caveat, that<\/p>\n [W]hen client confidential information is entrusted in unprotected form, even temporarily, to someone outside the firm, it must be under a circumstance in which the outside party is aware of the lawyer\u2019s obligation of confidentiality, and is itself obligated, whether by contract, professional standards, or otherwise, to assist in preserving it.[35]<\/a><\/p>\n \u00a0B. \u00a0<\/strong>E-Discovery Tools<\/strong><\/p>\n \u00a0<\/strong>[17]\u00a0\u00a0\u00a0\u00a0 To begin with, federal judges are unconvinced that many of the attorneys appearing before them understand how to make proper use of the technologies and related strategies associated with E-Discovery. A recent report, \u201cFederal Judges Survey on E-Discovery Best Practices & Trends,\u201d[36]<\/a> compiled some of the judges\u2019 concerns, noting first \u201cthe typical attorney\u2026does not have the legal and technical expertise to offer effective advice to clients on e-discovery.\u201d[37]<\/a> Some of the judges\u2019 comments were quite blunt, with one noting that \u201c[s]ome attorneys are highly competent; but most appear to have significant gaps in their understanding of e-discovery principles.\u201d[38]<\/a><\/p>\n [18]\u00a0\u00a0\u00a0\u00a0 Legal ethical rules and related opinions and scholarship provide guidance for what attorney E-Discovery competence should look like. At least one author has made the connection between professional responsibility and technological savoir-faire, noting that:<\/p>\n There is growing recognition across the country that the practice of law requires some degree of competence in technology. In the forum of litigation, competence in technology necessarily equates with competence in e-discovery. It is only a matter of time before ethics bodies across the nation call for competence in e-discovery.[39]<\/a><\/p>\n [19]\u00a0\u00a0\u00a0\u00a0 The opinions of courts and bar associations may carry the most weight, but a number of influential professional and industry groups also have offered useful commentary on technological competence. For example, competence is<\/p>\n \u2026highlighted in the very first rule of legal ethics, according to the American Bar Association[\u2019s] Rule 1.1 of the ABA Model Rules of Professional Conduct,\u201d which \u201cspecifically recognized the need for technological competence through a significant change in August 2012 that formally notified all lawyers (and specifically those in jurisdictions following the Model Rules) that competency includes current knowledge of the impact of e-Discovery and technology on litigation.[40]<\/a><\/p>\n [20]\u00a0\u00a0\u00a0\u00a0 This guidance predated and perhaps presaged a number of state and federal reactions to technology and the impact of these developments on the practice of law, especially within the realm of E-Discovery. Delaware amended its Lawyers\u2019 Rules of Professional Conduct as they related to technology in 2013;[41]<\/a> North Carolina[42]<\/a> and Pennsylvania[43]<\/a> did the same shortly thereafter.<\/p>\n [21]\u00a0\u00a0\u00a0\u00a0 California\u2019s relatively recent Formal Opinion No. 2015-193 (the \u201cCalifornia Opinion\u201d) addresses a number of issues associated with attorney ethical duties vis-\u00e0-vis E-Discovery. Although advisory in nature, the California Opinion states \u201cattorneys have a duty to maintain the skills necessary to integrate legal rules and procedures with \u2018ever-changing technology.\u2019\u201d[44]<\/a> That reads broadly, but the California Opinion has been interpreted to indicate that, because E-Discovery arises \u201cin almost every litigation matter, attorneys should have at least a baseline understanding of it.\u201d[45]<\/a> Specifically, the California Opinion begins with the premise that E-Discovery requires an initial assessment of its inclusion at the beginning of a matter.[46]<\/a> If E-Discovery will be a component of a matter,<\/p>\n [T]he duty of competence requires an attorney to assess his or her own e-discovery skills and resources as part of the attorney\u2019s duty to provide the client with competent representation. If an attorney lacks such skills and\/or resources, the attorney must try to acquire sufficient learning and skill, or associate or consult with someone with expertise to assist.[47]<\/a><\/p>\n [22]\u00a0\u00a0\u00a0\u00a0 Other commentators have noted that the California Opinion focuses on \u201cnine (9) core competency issues\u201d which would offer \u201csolid guidelines for attorneys\u2026to maintain competency and protect client confidentiality in the era of eDiscovery.\u201d[48]<\/a> One author notes that one of these core competency issues and its related directive, that of performing data searches, stretches across the entirety of the E-Discovery process \u201coccurring at each of these steps, from preservation and collection to review and redaction.\u201d[49]<\/a><\/p>\n [23]\u00a0\u00a0\u00a0\u00a0 Soon after the California Opinion was decided, Magistrate Judge Mitchell Dembin issued a Southern District of California decision that addressed \u201ccounsels\u2019 ethical obligations and expected competency\u201d in HM Electronics, Inc. v. R.F. Technologies, Inc<\/em>.[50]<\/a> The HM Electronics<\/em> case focused both on specific steps the attorneys should have<\/em> taken<\/em> (such as implementing a legal hold and doing the legwork necessary to certify discovery responses as true) as well as behavior actively detrimental to the case (instructing client personnel to destroy relevant documents).[51]<\/a> Of note in Judge Dembin\u2019s excoriation of the misbehaving attorneys is his statement that \u201ca judge must impose sanctions for a violation of the Rule that was without substantial justification.\u201d[52]<\/a> One article suggests that part of the problem may be simply that \u201ccounsel and clients alike\u2026fail to take seriously judges\u2019 expectations for how they conduct themselves throughout the discovery process.\u201d[53]<\/a><\/p>\n [24]\u00a0\u00a0\u00a0\u00a0 New York attorneys followed the California Opinion with interest, first noting that it merely presented \u201cthe standard tasks one should engage in and competently execute to properly collect and produce responsive ESI [Electronically Stored Information] to the opposing party.\u201d[54]<\/a> A 2009 S.D.N.Y. opinion had chastised attorneys who would otherwise disclaim experience, warning that it was \u201ctime that the Bar\u2014even those lawyers who did not come of age in the computer era\u201d understood E-Discovery technologies and their application.[55]<\/a> A recent article indicated that there is \u201can ample basis to discern a framework for ethical obligations, derived from ethics rules, court rules, and sanctions decisions in the e-discovery context\u201d based in part on the history of New York courts as \u201cleaders in the advancement of e-discovery law.\u201d[56]<\/a><\/p>\n [25]\u00a0\u00a0\u00a0\u00a0 But such a \u201cframework for ethical obligations\u201d might not even be necessary where competence is the ethical rule at issue. Competence \u201crequires that lawyers have the legal knowledge, skill, thoroughness, and preparation to conduct the representation, or associate with a lawyer who has such skills\u201d[57]<\/a> and that supervision is appropriate to ensure that the work of others \u201cis completed in a competent manner.\u201d[58]<\/a> The issue of supervision came up in another advisory opinion, Ethics Opinion 362 of the District of Columbia Bar, which indicated that retaining an e-Discovery vendor that provided all of the E-Discovery services was both impermissible (as the unauthorized practice of law on the part of the vendor) as well as a circumstance where the attorney engaging such a vendor was not absolved from understanding and supervising the work performed, no matter how technical.[59]<\/a><\/p>\n \u00a0<\/strong>1. Metadata in Electronic Files<\/strong><\/p>\n [26]\u00a0\u00a0\u00a0\u00a0 A very basic threat to client confidentiality (as well as the secrecy of counsel\u2019s strategy) is the existence of metadata embedded in electronic files exchanged between the parties or produced as evidence. Most frequently this threat exists in the form of automatically created information about a file, including changes made to the file, that can be recovered and viewed by a third party if not removed (or \u201cscrubbed\u201d) prior to disclosing the file. This \u201capplication metadata\u201d can include information about the document itself, the author, comments and prior edits, and may also detail when the document was created, viewed, modified, saved or printed.[60]<\/a> In addition to the fact that access to metadata can provide opposing parties with everything from revealing insights to damning evidence, there\u2019s also a \u201creal danger\u201d that \u201capplication metadata may be inaccurate.\u201d[61]<\/a><\/p>\n [27]\u00a0\u00a0\u00a0\u00a0 Further, disputes related to metadata regularly arise in the E-Discovery context. Indeed, one of the \u201cbiggest challenges in electronic discovery\u201d concerns \u201c[u]nderstanding when metadata is relevant and needs to be preserved and produced.\u201d[62]<\/a> To cite just one example, the concurring opinion in State v. Ratcliff<\/em> noted that judges must determine whether submitted evidence contained more than the information visible on the face of the document, or whether metadata was included as well, where the distinction \u201cis critical, both on an ethical and adjudicative basis.\u201d[63]<\/a><\/p>\n [28]\u00a0\u00a0\u00a0\u00a0 Accordingly, understanding and managing metadata has become a baseline requirement for technological competence when dealing with client data and attorney work product. Numerous products exist to help save lawyers from themselves when it comes to accidental disclosure of metadata, including software applications that may be integrated into email programs to prevent documents from being sent outside the network without first passing through a scrubbing filter. And the e-filing portal in many jurisdictions \u201ccontains a warning reminder that it is the responsibility of the e-filer to strip metadata from the electronic file before submitting it through the portal.\u201d[64]<\/a> Reliance on these tools, however, may not suffice for long as the sophistication and complexity of issues related to the creation and manipulation of metadata continue to evolve.<\/p>\n III. Overview of U.S. Data Privacy and \u00a0<\/strong>[29]\u00a0\u00a0\u00a0\u00a0 The sectoral approach to privacy and data security law in the United States often is described as \u201ca patchwork quilt\u201d comprised of numerous state and federal laws and regulations that apply variously to certain types of data, certain industries, the application of particular technologies, or some combination of those elements. These laws may be enforced by a variety of regulators, with state Attorneys General and the Federal Trade Commission often leading the way.[65]<\/a> Plaintiffs\u2019 lawyers also are prominent actors in this space, bringing an ever-increasing number of class action and other civil suits alleging violations of privacy rights, data protection laws, and information security standards.<\/p>\n [30]\u00a0\u00a0\u00a0\u00a0 Although there are no federal or state privacy statutes specifically applicable solely to lawyers, numerous data protection laws and regulations may apply to attorneys in their role as service provider to their clients or in other contexts. The obligations associated with these laws often implicitly or explicitly demand that lawyers handling client data (1)\u00a0have a thorough understanding of the potential privacy and security risks to that data; (2)\u00a0assess and determine how best to secure the data and prevent unauthorized access to the data; and (3)\u00a0supervise anyone acting on their behalf with respect to the data to ensure the data is appropriately protected at all times.<\/p>\n [31]\u00a0\u00a0\u00a0\u00a0 Below we describe a few of the privacy and data security laws that tend to come up frequently for lawyers and impose requirements on their handling of client data that may involve technological competence. This discussion is by no means exhaustive, as technology touches upon virtually every aspect of data protection regulation and information security counseling by attorneys in the field. To provide just a few examples, advising companies on restrictions applicable to cross-border data transfers, data localization requirements, cybersecurity standards and information sharing obligations, and regulatory action around the use of biometrics and geolocation technologies are just a few examples of areas where a lawyer must have an understanding of the underlying technology to effectively assist clients.<\/p>\n \u00a0<\/strong>A. \u00a0HIPAA \u2013 Business Associate Agreements<\/strong><\/p>\n [32]\u00a0\u00a0\u00a0\u00a0 The Health Insurance Portability and Accountability Act of 1996 (\u201cHIPAA\u201d), is the most significant health privacy law in the United States, imposing numerous obligations on \u201ccovered entities\u201d and \u201cbusiness associates\u201d of those \u201ccovered entities\u201d to protect the privacy and security of \u201cprotected health information\u201d (\u201cPHI\u201d).[66]<\/a> As required by HIPAA, the Department of Health and Human Services (\u201cHHS\u201d) issued two key sets of regulations to implement the statute: the Privacy Rule[67]<\/a> and the Security Rule.[68]<\/a><\/p>\n [33]\u00a0\u00a0\u00a0\u00a0 Although attorneys and law firms are not themselves considered covered entities directly subject to HIPAA\u2019s requirements,[69]<\/a> when attorneys obtain PHI from covered entity clients in the course of a representation, the law firm may be subject to certain HIPAA Privacy Rule requirements[70]<\/a> in its role as a business associate.[71]<\/a> The Privacy Rule and the Security Rule apply to a covered entity\u2019s interactions with third parties (e.g., service providers) that handle PHI on the covered entity\u2019s behalf.[72]<\/a> The covered entity\u2019s relationships with these \u201cbusiness associates\u201d are governed by obligatory contracts known as business associate agreements (\u201cBAAs\u201d) that must contain specific terms.[73]<\/a> With respect to technological competence specifically, for example, the BAA requires the business associate to implement appropriate safeguards to prevent use or disclosure of PHI other than as provided for by the BAA, and states that the business associate must ensure that any agents\/subcontractors that receive PHI from the business associate also protect the PHI in the same manner. And attorneys who \u201chold HIPAA data or [other PII] may be governed by state or federal law beyond the scope of the proposed rules, which is noted in the new comments\u201d[74]<\/a> to ABA Rule 1.6, discussed further below.<\/p>\n B. \u00a0GLBA Safeguards Rule Requirements<\/strong><\/p>\n [34]\u00a0\u00a0\u00a0\u00a0 Pursuant to the Gramm-Leach-Bliley Act (\u201cGLBA\u201d), the primary federal financial privacy law in the United States, various federal agencies promulgated rules and regulations addressing privacy and data security issues.[75]<\/a> For example, the Safeguards Rule requires financial institutions to protect security of personally identifiable financial information by maintaining reasonable administrative, technical, and physical safeguards for customer information.[76]<\/a> To comply with the Safeguards Rule, a financial institution must develop, implement, and maintain a comprehensive information security program, and that program must address the financial institution\u2019s oversight of service providers that have access to customers\u2019 nonpublic personal information (\u201cNPI\u201d).[77]<\/a><\/p>\n [35]\u00a0\u00a0\u00a0\u00a0 Again, although a law firm is not a financial institution directly subject to the GLBA, when it acts as counsel to a financial institution, GLBA requirements may apply to its handling of NPI received from that client. To the extent a financial institution\u2019s law firm will have access to such NPI in the course of the representation, the financial institution-client must take reasonable steps to ensure the law firm has the ability to safeguard such data prior to disclosing it to the firm, and require the firm to contractually agree (in writing) to safeguard the NPI. Assuming such data will be stored electronically (a safe assumption in virtually all cases), it is incumbent on the law firm to understand the potential data security risks and how to prevent unauthorized access, use, transfer, or other processing of their clients\u2019 NPI.<\/p>\n \u00a0<\/strong>C. \u00a0State Data Security Laws<\/strong><\/p>\n [36]\u00a0\u00a0\u00a0\u00a0 At the state level, there are numerous laws and regulations regarding the protection of personal information (and other types of data) that apply to all entities that maintain such data, including lawyers, law firms, and other legal service providers.<\/p>\n [37]\u00a0\u00a0\u00a0\u00a0 A number of states, such as California, Connecticut, Maryland, Nevada, Oregon, and Texas, have enacted laws that require companies to implement information security measures to protect personal information of residents of the state that the business collects and maintains.[78]<\/a> These laws of general application are relevant to attorneys and law firms with respect to the personal information they maintain\u2014both client data and data relating to their employees. Typically, these laws are not overly prescriptive and include obligations to implement and maintain reasonable security policies and procedures to safeguard personal information from unauthorized access, use, modification, disclosure, or destruction (though most do not offer a definition or description of what is meant by \u201creasonable\u201d security). Some laws, such as California\u2019s, impose a requirement to contractually obligate non-affiliated third parties that receive personal information from the business to maintain reasonable security procedures with respect to that data.[79]<\/a><\/p>\n [38]\u00a0\u00a0\u00a0\u00a0 Massachusetts was the first state to enact regulations that directed businesses to develop and implement comprehensive, written information security programs (\u201cWISPs\u201d) to protect the personal information of Massachusetts residents.[80]<\/a> These regulations apply to all private entities (including law firms) that maintain personal information of Massachusetts residents, including those that do not operate in Massachusetts; they also list a number of minimum standards for the information security program.[81]<\/a> The Massachusetts regulations are relatively prescriptive as compared to other similar state laws of this nature, and they include numerous specific technical requirements.<\/p>\n [39]\u00a0\u00a0\u00a0\u00a0 These requirements apply to law firms directly, but they also apply to law firms as service providers to businesses that maintain personal information of Massachusetts residents. A compliant WISP must address the vetting of service providers, and the contract must include provisions obligating the service provider to protect the data.[82]<\/a><\/p>\n IV. \u00a0Applicable Ethical Rules and Guidance<\/strong><\/p>\n [40]\u00a0\u00a0\u00a0\u00a0 The myth of the Luddite[83]<\/a> or caveman[84]<\/a> lawyer persists, even if this type of anachronism is, in fact, an ethical violation waiting to happen.[85]<\/a> But even attorneys who \u201conly touch a computer under duress, and take comfort in paper files and legal research from actual books\u201d[86]<\/a> must deal with technology.[87]<\/a> The adequate practice\u2014or perhaps simply \u201cthe practice\u201d of law does not exist without technology, and there is no longer a place for lawyers who simply \u201chope to get to retirement before they need to fully incorporate technology into their lives.\u201d[88]<\/a><\/p>\n [41]\u00a0\u00a0\u00a0\u00a0 \u201cReally?\u201d goes the refrain. \u201cWhy can\u2019t I just practice the way I always have, without [insert mangled, vaguely-recognizable technology portmanteau] getting in the way?\u201d<\/p>\n [42]\u00a0\u00a0\u00a0\u00a0 Well, for one thing, to the extent attorneys rely on the protections of privilege to serve their clients, said attorneys must understand how the confidentiality of their communications and work product may be compromised by the technology they use. Technologies introduce complexity that, in turn, may affect privilege\u2014especially when \u201cmany lawyers don\u2019t understand electronic information or have failed to take necessary precautions to protect it.\u201d[89]<\/a> But how much understanding, exactly, may be required to competently represent clients in matters concerning E-Discovery, or data security, or even privacy? At many organizations, \u201c[p]rivacy issues get handled by anyone who wants to do them\u201d because the subject matter area is understaffed or ignored.[90]<\/a> The key technological issues relevant to E-Discovery versus data privacy may be somewhat different, but the \u201csolutions\u201d companies find are eerily similar: the practitioners that are actually doing the work are often those who have been delegated the work, whose \u201cexpertise\u201d is somewhat home-grown and may, in fact, not really represent true technological competence at all.[91]<\/a><\/p>\n [43]\u00a0\u00a0\u00a0\u00a0 What, then, are the requirements for expertise? Perhaps a pragmatic approach is best. Certainly, practitioners who use technology\u2014again, likely all of them\u2014must take some well-defined, initial steps toward acquiring the appropriate skill set. This might be as straightforward as the lawyer familiarizing herself with the relevant technologies at issue. Although it may sound a bit too<\/em> easy, \u201cjust being well-versed enough to understand the issues is a big plus.\u201d[92]<\/a> That being said, \u201cthose considering a career in cybersecurity or privacy will need to spend time developing some level of technical expertise.\u201d[93]<\/a> In short, the answer is \u201cit depends\u201d and \u201cno one really knows \u2013 yet.\u201d In this relatively new space, actual decisions and definitive standards for \u201ctechnological competence\u201d are thin on the ground. Below we will examine some of the relevant rules and guidelines to consider.<\/p>\n \u00a0<\/strong>A. \u00a0Recent Guidelines in the Ethics Rules<\/strong><\/p>\n [44]\u00a0\u00a0\u00a0\u00a0 Most attorneys do not have specialized training focused on a particular technological field. Certainly the vast majority do not hold themselves out as experts in cybersecurity, cloud-based storage, social media, biometrics, or any of a variety of related disciplines. However, even in the absence of expertise, there are some basic ethical rules that provide a framework for determining a practitioner\u2019s professional duties and obligations with regard to technology\u2014specifically, rules pertaining to competent client representation, adequate supervision, confidentiality, and communications.[94]<\/a><\/p>\n 1. \u00a0Competent Client Representation (Model Rule 1.1)<\/strong><\/p>\n [45]\u00a0\u00a0\u00a0\u00a0 As discussed briefly above, almost four years ago, the America Bar Association formally approved a change to the Model Rules of Professional Conduct to establish a clear understanding that lawyers have a duty to be competent not only in the law and its practice, but also with respect to technology. Detailed below, the passage of this rule contemplated changes in technology and eschewed specifics. Rather than a paint-by-numbers approach, ABA Model Rule 1.1 puts the responsibility on attorneys to understand their own\u2014and their clients\u2019\u2014needs, and how new technologies impact their particular practice.<\/p>\n [46]\u00a0\u00a0\u00a0\u00a0 ABA Model Rule 1.1 states that:<\/p>\n A lawyer shall provide competent representation to a client. Competent representation requires legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.[95]<\/a><\/p>\n [47]\u00a0\u00a0\u00a0\u00a0 ABA Model Rule 1.1 was amended in 2012 by Codified Comment 8 as follows:<\/p>\n To maintain the requisite knowledge and skills, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology<\/em>, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject.[96]<\/a><\/p>\n [48]\u00a0\u00a0\u00a0\u00a0 Some note that Rule 1.1 \u201cdoes not actually impose any new obligations on lawyers;\u201d[97]<\/a> neither does it require perfection.[98]<\/a> Instead it \u201csimply reiterates the obvious, particularly for seasoned eDiscovery lawyers, that in order for lawyers to adequately practice, they need to understand the means by which they zealously advocate for their clients.\u201d[99]<\/a> One article noted, in fact, that Comment 8 was evidence of \u201cthe ABA\u2019s desire to nudge lawyers into the 21st<\/sup> century when it comes to technology.\u201d[100]<\/a> It did, however, caution that it was \u201ca very gentle nudge.\u201d[101]<\/a><\/p>\n \u00a0<\/strong>[49]\u00a0\u00a0\u00a0\u00a0 Nudge or not, that message has resonated across the United States. In the four years since that amendment was approved and adopted by the ABA, twenty-one states since have adopted the ethical duty of technological competence for lawyers.[102]<\/a> As for many of the states that have not formally adopted the change to their Model Rules of Professional Conduct, those may still explicitly or implicitly acknowledge this emerging duty to be competent in technology, having a basic understanding of technologies their clients use, and a duty to keep abreast of such changes including a required awareness of regulatory requirements and privacy laws.[103]<\/a><\/p>\n 2. \u00a0Supervision (Model Rules 5.1 and 5.3)<\/strong><\/p>\n [50]\u00a0\u00a0\u00a0\u00a0 ABA Model Rule 5.1 also bears on a lawyer\u2019s duties regarding technology insofar as duties aided or supported by technology are performed by someone other than the attorney. This responsibility extends to immediate as well as remote support staff, with ABA Model Rule 5.1 requiring that \u201c[l]awyers must also supervise the work of others to ensure it is completed in a competent manner.\u201d[104]<\/a> This attempt at establishing \u201cthe principle of supervisory responsibility without introducing a vicarious liability concept\u201d[105]<\/a> has led to considerations regarding inexperience generally,[106]<\/a> but the implications for technological applications should be clear\u2014an associate or other paralegal professional is much more likely to use technology to support legal work[107]<\/a> than she is to make a representation before a court or like body.<\/p>\n [51]\u00a0\u00a0\u00a0\u00a0 ABA Model Rule 5.3 also sets forth responsibilities of partners and supervising attorneys to non-lawyer assistants. This set of ethical considerations further reinforces the responsibilities attorneys have to apply sufficient care in their practice when outsourcing supporting legal work to inexperienced non-professionals, and to ensure that confidentiality is maintained with outsourcing staff.[108]<\/a> This is not just a matter of supervising specific tasks. It also contemplates knowing which tasks are appropriate for delegation, both within the firm and to third-party vendors. For example, if a delegate of the attorney uses technology to begin an engagement, it\u2019s possible that such an arrangement could be viewed as \u201cestablish[ing] the attorney-client relationship,\u201d which may be prohibited under ABA Model Rule 5.5.[109]<\/a><\/p>\n 3. \u00a0Duty of Confidentiality (Model Rule 1.6)<\/strong><\/p>\n [52]\u00a0\u00a0\u00a0\u00a0 ABA Model Rule 1.6 states that it is critical that lawyers do not reveal confidential or privileged client information.[110]<\/a> When information was kept in an attorney\u2019s head, or perhaps committed to a sheet of paper, historical precedent on how to comply with this duty may have been helpful. In the \u201cworld of tomorrow,\u201d[111]<\/a> looking to the past for answers makes little sense, especially in those instances where the attorney is unclear as to how information is stored, accessed, maintained, or utilized.<\/p>\n [53]\u00a0\u00a0\u00a0\u00a0 Model Rule 1.6 also considers a duty of confidentiality that resides at the core of every attorney\u2019s role and serves as one of the attorney\u2019s most important ethical responsibilities. Model Rule 1.6 generally defines the duty of confidentiality as follows: \u201cA lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation or the disclosure is permitted [elsewhere].\u201d[112]<\/a><\/p>\n [54]\u00a0\u00a0\u00a0\u00a0 This rule is broad. It encompasses any client information, confidential or privileged, shared or accessible to the attorney and is not limited to just confidential communications. Further, it may only be relinquished under the most onerous of circumstances.[113]<\/sup><\/sup><\/a> A lawyer shall not, therefore, reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation, or the disclosure is permitted elsewhere in the rules.<\/p>\n [55]\u00a0\u00a0\u00a0\u00a0 In 2000, the Advisory Committee looked into its crystal ball and considered ESI on various platforms, in different repositories, in various forms. It then added Comment 18 to Rule 1.6, requiring reasonable precautions to safeguard and preserve confidential information. Comment 18 states that, \u201c[A] lawyer [must] act competently to safeguard information relating to the representation of a client against \u2026 inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client or who are subject to the lawyer\u2019s supervision.\u201d[114]<\/a> Indeed, \u201c[p]artners and supervising attorneys are required to take reasonable actions to ensure that those under their supervision comply with these requirements.\u201d[115]<\/a><\/p>\n [56]\u00a0\u00a0\u00a0\u00a0 In addition to the ABA\u2019s commentary, state and local professional organizations have issued guidance as well. In establishing a specific roadmap for lawyers to attain the skills necessary to meet their ethical obligations with respect to relevant technology in the practice of law, and returning to the California Bar\u2019s Formal Opinion 2015-193, there is a sort of checklist that may assist lawyers in meeting their ethical obligations to develop and maintain core E-Discovery competence in the following areas:[116]<\/a><\/p>\n [57]\u00a0\u00a0\u00a0\u00a0 But this technological competence inherent in the Duty of Competence represents only one third of the ethical duties that govern an attorney\u2019s interaction with technology. This ESI and litigation skills checklist does not<\/em> address \u201cthe scope of an attorney\u2019s duty of competence relating to obtaining an opposing party\u2019s ESI;\u201d[118]<\/a> nor does it consider the skills required of non-litigation attorneys, which must be inferred from the rule.<\/p>\n [58]\u00a0\u00a0\u00a0\u00a0 In addition, the State Bar of California\u2019s Standing Committee on Professional Responsibility and Conduct, Formal Opinion 2010-179 states that \u201c[a]n attorney\u2019s duties of confidentiality and competence require the attorney to take appropriate steps to ensure that his or her use of technology in conjunction with a client\u2019s representations does not subject confidential client information to an undue risk of unauthorized disclosure.\u201d[119]<\/sup><\/sup><\/a><\/p>\n [59]\u00a0\u00a0\u00a0\u00a0 In reference to the duty of confidentiality, the New York County Lawyer\u2019s Association\u2019s Committee on Professional Ethics examined shared computer services amongst practitioners in Opinion 733, noting that an \u201cattorney must diligently preserve the client\u2019s confidences, whether reduced to digital format, paper, or otherwise. The same considerations would also apply to electronic mail and websites to the extent they would be used as vehicles for communications with the attorney\u2019s clients.\u201d[120]<\/sup><\/sup><\/a> The New York State Bar\u2019s Committee on Professional Ethics Opinion 842 further stated that, when \u201ca lawyer is on notice that the [client\u2019s] information\u2026is of \u2018an extraordinarily sensitive nature that it is reasonable to use only a means of communication that is completely under the lawyer\u2019s control,\u2026the lawyer must select a more secure means of communication than unencrypted Internet e-mail.\u2019\u201d[121]<\/sup><\/sup><\/a>\u00a0<\/strong><\/p>\n 4. \u00a0Communications (Model Rule 1.4)<\/strong><\/p>\n [60]\u00a0\u00a0\u00a0\u00a0 ABA Model Rule 1.4 on Communications also applies to the attorney\u2019s use of technology and requires appropriate communications with clients \u201cabout the means by which the client\u2019s objectives are to be accomplished,\u201d including the use of technology.[122]<\/a><\/p>\n [61]\u00a0\u00a0\u00a0\u00a0 In construing all of these Model Rules and comments, it is clear that attorneys who are not tech-must (1) understand their limitations; (2)\u00a0obtain appropriate assistance; (3)\u00a0be aware of the areas in which technology knowledge is essential; and (4)\u00a0evolve to competently handle those challenges; or (5)\u00a0retain the requisite expert assistance. This list applies equally to data security issues, such as being aware of the risks associated with cloud storage, cybersecurity threats, and other sources of potential harm to client data, and can easily be extended to include awareness and understanding with respect to domestic and foreign data privacy issues.<\/p>\n [62]\u00a0\u00a0\u00a0\u00a0 The ethical obligations to safeguard information require reasonable security, not absolute security. Accordingly, under such rules and related guidance from the Proposal from the ABA Commission on Ethics 20\/20,[123]<\/a> the factors to be considered in determining the reasonableness of the lawyers\u2019 efforts with respect to security include:<\/p>\n (1) The sensitivity of the information;<\/p>\n (2) The likelihood of disclosure if additional safeguards are not employed;<\/p>\n (3) The cost of employing additional safeguards;<\/p>\n (4) The difficulty of implementing the safeguards; and<\/p>\n (5) The extent to which the safeguards adversely affect the lawyer\u2019s ability to represent the client.[124]<\/a><\/p>\n As New Jersey Ethics Opinion 701 states, \u201c[r]easonable care however does not mean that the lawyer absolutely and strictly guarantees that the information will be utterly invulnerable against all unauthorized access. Such a guarantee is impossible.\u201d[125]<\/a><\/p>\n B. \u00a0Ethics and Social Media<\/strong><\/p>\n [63]\u00a0\u00a0\u00a0\u00a0 When considering their ethical duties with respect to technology, lawyers today must confront a host of challenges that would have been almost unimaginable even ten years ago. The rise and proliferation of social media as a daily part of most people\u2019s personal and professional lives has created one such challenge.[126]<\/sup><\/sup><\/a> Numerous courts have addressed\u2014and continue to address\u2014attorney duties with respect to social media in the context of spoliation motions when social media evidence has been lost, destroyed, or obfuscated due to negligence, or in accordance with attorney advice.[127]<\/a> In addition, given the novelty and complexity of the issues, and in the interest of consistency, state bar associations have begun to address issues associated with attorney use of, counseling on, and preservation of social media.<\/p>\n [64]\u00a0\u00a0\u00a0\u00a0 The Association of the Bar of the City of New York\u2019s Committee on Professional and Judicial Ethics, in Formal Opinion 2010-2, provided some helpful guidelines on attorney access to social media, stating that \u201c[a] lawyer may not use deception to access information from a social networking webpage,\u201d either directly or through an agent.[128]<\/a> While focused on behaviors that attorneys and their agents should not undertake when developing a case, the opinion does note that the \u201cpotential availability of helpful evidence on these internet-based sources makes them an attractive new weapon in a lawyer\u2019s arsenal of formal and informal discovery devices,\u201d and also offers up \u201cthe Court of Appeals\u2019 oft-cited policy in favor of informal discovery.\u201d[129]<\/a> Simply put, the duty is twofold: an attorney must both be aware of social media and know how to use social media to provide effective representation.<\/p>\n \u00a02. \u00a0<\/strong>State Bar Association Guidance<\/strong><\/p>\n [65]\u00a0\u00a0\u00a0\u00a0 State bar associations are becoming increasingly involved in providing guidance on social media and its implications for the practice of law. For example, in 2014, the New York and Pennsylvania State Bar Associations and the Florida Professional Ethics Committee issued guidance on social media usage by attorneys and addressed the obligations of attorneys to understand how various platforms work, what information will be available to whom, the ethical implications of advising clients to alter or change social media accounts, and the value of ensuring adequate preservation of social media evidence.<\/p>\n i. \u00a0New York<\/strong><\/p>\n [66]\u00a0\u00a0\u00a0\u00a0 The Social Media Ethics Guidelines of the Commercial and Federal Litigation Section of the New York State Bar Association provide specific guidance for the use of social media by attorneys.[130]<\/a> Guideline 4, relating to the review and use of evidence from social media, is divided into four subparts, all of which provide specific and pertinent guidance to attorneys:<\/p>\n ii. \u00a0Florida<\/strong><\/p>\n [67]\u00a0\u00a0\u00a0\u00a0 In Advisory Opinion 14-1, the Florida Bar Association\u2019s Professional Ethics Committee confirmed that an attorney could advise a client to increase privacy settings (as so to conceal from public eye) and remove information relevant to the foreseeable proceedings from social media as long as an appropriate record was maintained\u2014the data preserved\u2014and no rules or substantive laws regarding preservation and\/or spoliation of evidence were broken.[135]<\/sup><\/sup><\/a><\/p>\n iii. Pennsylvania<\/strong><\/p>\n [68]\u00a0\u00a0\u00a0\u00a0 In 2014, the Pennsylvania Bar Association issued a Formal Opinion that included detailed guidance regarding an attorney\u2019s ethical obligations with respect to the use of social media. Among other guidelines, the Opinion specifically stated that:<\/p>\n 3. \u00a0ABA Model Rule 3.4<\/strong><\/p>\n [69]\u00a0\u00a0\u00a0\u00a0 Finally, although ABA Model Rule 3.4 on Fairness to Opposing Party and Counsel does not directly address social media, the principles behind the rule apply in the social media context. The Rule provides that an attorney shall not \u201cunlawfully obstruct another party\u2019s access to evidence or unlawfully alter, destroy or conceal a document or other material having potential evidentiary value\u201d nor shall the attorney \u201ccounsel or assist another person\u201d to undertake such actions.[137]<\/a><\/p>\n C. \u00a0Guidance on Duties Related to<\/strong> Cybersecurity <\/strong><\/p>\n [70]\u00a0\u00a0\u00a0\u00a0 As we discussed above in Section II, attorneys face a complex threat landscape when it comes to security concerns related to the protection of their clients\u2019 data.[138]<\/a> Although the scope of an attorney\u2019s ethical obligations in this regard remains somewhat unclear, there are several sources of guidance relevant to how lawyers are expected to manage cybersecurity risks.<\/p>\n [71]\u00a0\u00a0\u00a0\u00a0 One such source that squarely addresses the issue is the Resolution issued by the ABA\u2019s Cybersecurity Legal Task Force. The Resolution contains a detailed Report explaining the ABA\u2019s position regarding the growing problem of intrusions into computer networks utilized by lawyers and law firms, and urges lawyers and law firms to review and comply with the provisions relating to the safeguarding of confidential client information.
\nInformation Security Law<\/strong><\/p>\n\n
\n
\n
\n
\n
\n