Ethics in the Cloud
As more organizations move their information to the cloud, attorneys must also understand the potential ethical issues involved in storing data off-site on the Internet, rather than on physical servers that the organization owns. There are several ethical issues to consider with the cloud:
Records Management in the Cloud
When organizations store information in the cloud, attorneys need to understand how the data can be retrieved. They must also know who is considered a custodian, and whether that custodian is a company representative or a third-party vendor.
Lawyers also have an ethical duty to be familiar with retention policies for data in the cloud, so they know whether those policies are consistent with the organization's policies and whether the organization or the vendor is responsible for records management and destruction.
Protecting Data in the Cloud
When data is stored in the cloud, jurisdictional issues become much more complicated. Attorneys must know whether the organization's cloud provider is in compliance with relevant data protection regulations and privacy notification requirements, including those for the European Union and other foreign jurisdictions.
Recently, North Carolina issued a cloud computing ethics opinion. Although the opinion does not set forth specific security requirements it does state that due diligence and education are required. The attorney must make a reasonable effort to ensure that the cloud services are provided in a manner that is compatible with the professional obligations of the lawyers. They recommend:
- an agreement on how to handle confidential client information;
- a method to retrieve the data in a non-proprietary format;
- an agreement to return or destroy data at the request of the attorney;
- a review of the security policy; and
- a review of backup protocols.
Pennsylvania also has an ethics opinion on cloud computing. Formal Opinion 2011-200, Ethical Obligations for Attorneys Using Cloud Computing/Software As A Service While Fulfilling The Duties Of Confidentiality And Preservation Of Client Property. Lawyers may store data in the cloud if they can reasonably assure that (1) the materials remain confidential, and (2) reasonable safeguards ensure the data is protected from breaches.
Many other states are also weighing in our cloud computing as it relates to a lawyer's ethical obligations:
- State Bar of Arizona Ethics Opinion 09-04: Confidentiality; Maintaining Client Files; Electronic Storage; Internet;
- State Bar of Arizona Ethics Opinion 05-04: Electronic Storage; Confidentiality (07/05);
- California State Bar Standing Committee on Professional Responsibility and Conduct Proposed Formal Opinion Interim No. 08-0002 (Confidentiality and Technology);
- Iowa State Bar Association Committee on Ethics and Practice Guidelines: Ethics Opinion 11-01: "Use of Software as a Service -- Cloud Computing" (9/9/11);
- Maine State Bar Professional Ethics Commission: "Client Confidences: Confidential firm data held electronically and handled by technicians for third-party vendors;" Opinion 194 (6/30/08);
- New Jersey Bar Advisory Committee on Professional Ethics: "Electronic Storage and Access of Client Files;" Opinion 701 (4/24/06);
- New York State Bar Association Committee on Professional Ethics: Opinion 842 (9/10/10);
- New York State Bar Association Committee on Professional Ethics: Opinion 820 (2/8/08); and
- Oregon State Bar Association Formal Ethics Opinion Number 2011-188: "Information Relating to the Representation of a Client: Third-Party Electronic Storage of Client Materials".
In the end, no matter which state you practice in, you must be competent to understand the technology, make an informed decision about the risks and benefits of placing client data in the cloud, and bear the responsibility of ensuring the data is safe and secure.
Litigation Holds in the Cloud
When it comes to litigation holds and e-discovery in the cloud, attorneys must consider who receives a litigation hold. Attorneys must also be particularly careful to avoid spoliation. Preserving data in the cloud can be tricky in that data can be stored across multiple physical storage volumes. You may be required to isolate your data on the cloud resources.
The careful review of contracts should be a priority for attorneys when their organizations consider a move to the cloud. Contracts should spell out exactly who will have access to sensitive information, how the data will be stored, whether adequate data maps will exist, what the organization's rights are when issuing legal holds and conducting e-discovery and how disaster recovery is managed. Attorneys should also be sure that flexible termination terms are built into contracts with cloud providers, so the organization can make changes when necessary.
Lawyers have always faced ethical complications, but existing and evolving technology presents entirely new issues. Attorneys can't ignore these challenges any longer. If they try to, they will only harm themselves, their profession and their clients.