Can Lawyers Ethically Store and Transmit Client Info in the Cloud?

QUESTION: Our law firm would like to reduce our paper and physical storage use and costs by “going to the cloud” with our data. Before we invest in training our attorneys and staff, how do we know what companies are secure and trustworthy? We don’t want an ethics violation due to a data breach of our clients’ confidential information.

ANSWER: In many instances, data you are using and communicating with your clients are already being stored and managed with cloud-based technology. For example, your practice management software may be entirely managed and hosted in the cloud. When you cannot email certain documents due to their size, you might be turning to services like Dropbox, Microsoft OneDrive and Google Drive for easy file storage and sharing — they’re all cloud-based.

So, let’s focus on two parts of your question:

1. Do the Rules of Professional Conduct allow lawyers to store and transmit client information in the cloud?
2. What steps should lawyers take to ensure the security of the data stored there?

First, lawyers may use cloud-based data storage of confidential information while still protecting their client confidentiality responsibilities. Over 20 state bar associations have issued ethics opinions on this very topic, and all have reached the conclusion that lawyers may ethically use cloud computing, so long as they exercise reasonable care to keep client information and files confidential. Some of those opinions may be found on the ABA Legal Technology Resource Center’s webpage. (Note that it is an incomplete list with Illinois and possibly others omitted.)

As you know by now, especially if you live in one of the over 30 states that has adopted it, ABA Model Rule 1.1requires attorneys to keep abreast of changes in law and its relation to technology. This means that attorneys need to be aware of the benefits and risks of technological applications and the standards that regulate them. You certainly don’t have to have a computer science degree to know how it all works. You just need to take reasonable due diligence to know it is secure.

READ MORE Attorney At Work July 16, 2018