ETHICS QUESTION OF THE MONTH

This content is generated by the Texas Center for Legal Ethics and is for informational purposes only. Look for the reasoning behind the answers at legalethicstexas.com.

I’ve Looked at Clouds from Both Sides Now

Attorney Ginger is looking at options for backing up files on her law firm’s server. She considers backing them up to an external storage device each night before leaving the office and taking it home with her. She’s concerned, however, that this method is cumbersome and that she lacks the discipline to stick with it.

Ginger likes the idea of a system that will automatically back up her files to backup servers via the internet, more commonly known as backing up to the cloud. She is considering using a cloud-based service recommended by one of her clients who uses the cloud to back up files for his online business. Ginger knows she has an ethical obligation to secure and keep confidential all client information, and she is concerned that using the cloud may violate that obligation. After all, cloud servers are owned by private entities over which she has no control and may be located in foreign countries. She is also worried about employees of these entities or third-party hackers obtaining her client information.

As Ginger considers her options, which of these statements is most accurate?

A. She should not use the cloud to back up her law firm files because of the risk of disclosure
B. She may use the cloud as long as she is unaware of any reason to believe that the particular cloud service she chooses poses a risk to client information
C. She may use a cloud service as long as she does reasonable due diligence as to the security of the particular cloud service she chooses
D. She may use the cloud service, but must get client approval first
E. She can use the cloud storage service but only for documents that are not confidential or privileged client documents
F. Both C and D

Answer

Rule 1.05 of the Texas Disciplinary Rules of Professional Conduct requires that, with limited exceptions, an attorney keep confidential all privileged information and all non-privileged information “relating to a client or furnished by the client, other than privileged information, acquired by the lawyer during the course of or by reason of the representation of the client.” The advent of cloud computing has added a new wrinkle to this requirement that would not have been considered or anticipated by the drafters of this rule.

Fortunately, in 2018, the Professional Ethics Committee for the State Bar of Texas addressed this very issue in Ethics Opinion 680. The committee found that attorneys may ethically use the cloud for file backup so long as they take “reasonable precautions in the adoption and use of cloud-based technology,” which include acquiring “a general understanding” of how it works. Attorneys who wish to use the cloud should develop the technological competence to evaluate and remain alert to the risks of cloud-based storage systems. The committee declined to require client consent, though it did note that attorneys should consult with clients regarding cloud security where “appropriate” or when raised by the client. The best answer is C. For a more in-depth discussion, go to legalethicstexas.com/ethics-question-of-the-month.^TBJ

ABOUT THE CENTER
The Texas Center for Legal Ethics was created by three former chief justices of the Supreme Court of Texas to educate lawyers about ethics and professionalism. Lawyers can access the Texas Disciplinary Rules of Professional Conduct, the Texas Lawyer’s Creed, and a variety of other online ethics resources by computer or smart device at legalethicstexas.com.

DISCLAIMER
The information contained in Ethics Question of the Month is intended to illustrate an ethics issue of general interest in the Texas legal community; it is not intended to provide ethics advice that applies regardless of particular facts. For specific legal ethics advice, readers are urged to consult the Texas Disciplinary Rules of Professional Conduct (including the official comments) and other authorities and/or a qualified legal ethics adviser.

{Back to top}