ABA: Lawyers Must Implement Reasonable Data Security for Client Information

Back on August 2, in response to yet another breach involving a law firm’s records, I wrote to the American Bar Association to ask what the ABA advised members in terms of disposal of records. I got a pro forma response that was totally non-responsive to the question I had posed to them. I wrote back and tried again. This time I got no answer at all. Way to go, ABA.

Thankfully, Jim Brashear has blogged about this very issue. He writes, in part:

This week, the American Bar Association (ABA) House of Delegates adopted changes to Model Rule 1.6 of the ABA Model Rules of Professional Conduct. New subsection (c) adds the following sentence to the model rule:

“A lawyer shall make reasonable efforts to prevent the inadvertent disclosure of, or unauthorized access to, information relating to the representation of a client.”
In comments to the revised model rule, the ABA provides a non-exclusive list of factors to be considered in determining the reasonableness of the lawyer’s data security efforts. They include:

• the sensitivity of the information,
• the likelihood of disclosure if additional safeguards are not employed,
• the cost of employing additional safeguards,
• the difficulty of implementing the safeguards, and
• the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).

Read more on ZixCorp Insight.

So… if most of the records are part of court records that are publicly available, does the lawyer have a duty to shred/securely dispose of the records or not? It almost sounds like they wouldn’t, but I hope that’s not the case.

Update: I put the question to Jim Brashear, who answered me in a series of tweets:

@pogowasright Exsting rules say client files belong to the client; lawyers must keep information related to the representation confidential.

— Jim Brashear (@JFBrashear) August 8, 2012

 

@pogowasright New ABA rule clarifies existing ethics obligations. No lawyer should dispose of client files before making them unreadable.

— Jim Brashear (@JFBrashear) August 8, 2012

 

@pogowasright Ethics rules and opinions are set by state bars, not the ABA, but dumping unshredded client files clearly is an ethics breach.

— Jim Brashear (@JFBrashear) August 8, 2012

Well, I think they are an ethics breach, too, if not a violation of state law, but I wonder how often such breaches involving lawyers or law firms are brought to state bar associations.