By Eric Deitz
The utility, portability and convenience of laptops, tablets and smartphones make them an integral part of our daily practice lives, but our reliance upon and the ubiquity of these devices requires us to be mindful of the ethical considerations affecting their use. This is particularly true when an electronic storage device contains privileged or confidential client information and is lost or stolen.
Consider the number of times each day you check your devices, and the physical locations where you do so. This may occur while distracted by other activities, increasing the likelihood a laptop, tablet or smartphone may be set down and left behind.
Once you realize your “right hand” is missing, you may begin a frantic but fruitless search to locate and retrieve the missing device. Ideally, you and the missing piece of equipment are reunited before any harm is done. But what about the alternative scenario, when the absent laptop or smartphone is not returned or is accessed while missing? What duties do you owe to clients when information stored or accessible on your missing device may have been compromised, and what rules apply to the analysis?
There are at least three (3) ethical duties implicated by the loss of a laptop, tablet or smartphone, and the response to such a scenario may be affected by the extent and type of information stored on the missing device(s). These are the duty of confidentiality; the duty of competency; and the duty to communicate “significant developments.”
An attorney must “maintain inviolate the confidence, and at every peril to himself or herself … [must] preserve the secrets, of his or her client.” (Bus. & Prof. Code § 6068(e).) The duty of confidentiality is broader than the attorney-client privilege, which protects only confidential attorney-client communications. (See, Cal. Evid. Code § 954.) In addition, Rule 3-100 of the California Rules of Professional Conduct prohibits an attorney from revealing information subject to section 6068(e) without client consent.
Broadly speaking, an attorney owes a duty to protect client secrets from disclosure. This duty obligates an attorney to take steps to prevent the disclosure of confidential information, the dissemination of which may subject the attorney to professional discipline. (See, e.g., State Bar of California Formal Op. 2016-195; Ainsworth v. State Bar 46 Cal. 3d 1218, 1222-1223.)
Preliminarily, an attorney should consider whether it is necessary or appropriate to store files locally on a portable device, and for how long. If local storage is required to facilitate the representation, relatively easy to implement steps may help prevent inadvertent disclosures. Readily available protections include the use of strong passwords, multi-factor authentication, and encryption. Use of a virtual private network (VPN) may also be an option. Some operating systems (e.g., macOS) permit the use of “hidden” folders, while other devices have built-in protections that lock and/or wipe clean a device if a user attempts to access it too many times.
Knowing of such technology – and appropriately implementing and using it – ties into the duty of competence. Rule 3-110(A) provides: “A member shall not intentionally, recklessly, or repeatedly fail to perform legal services with competence.” Subsection B defines “competence” as applying the “1) diligence, 2) learning and skill, and 3) mental, emotional, and physical ability reasonably necessary for the performance of such service.” (Rule 3-110(B).)
If an attorney currently lacks the requisite skill or knowledge to represent a client, s/he “may nonetheless perform such services competently by 1) associating with or, where appropriate, professionally consulting another lawyer reasonably believed to be competent, or 2) by acquiring sufficient learning and skill before performance is required.” (Rule 3-110(C).)
This last consideration implicates the duty of competency with regard to attaining and maintaining sufficient technical proficiency to protect privileged and confidential information. While failing to act competently may not trigger discipline under rule 3-110, doing so in a manner that is intentional, reckless, or repeated may result in discipline. (See, e.g., State Bar of California Formal Op. 2015-193; see, also, In the Matter of Torres (Review Dept. 2000) 4 Cal. State Bar Ct. Rptr. 138, 149.)
Commentators in California have noted with approval the ABA Model Rules and, specifically, Comment 8 to Model Rule of Professional Conduct 1.11, which provides: “To maintain the requisite knowledge and skill, a lawyer should keep abreast of … the benefits and risks associated with relevant technology.” (See, State Bar of California Formal Op. 2015-193, at p. 3.) Thus, an attorney should be familiar with the benefits and risks of using portable technology, and should disclose the same to their clients.
This last consideration applies at the outset of an attorney’s representation of a client, as well as when client secrets may be compromised by the loss or theft of a device upon which confidential information may be accessed. Rule of Professional Conduct 3-500 and Business & Professions Code section 6068(m) requires an attorney to keep their clients reasonably apprised of “significant developments” affecting the representation.
While not related to the scenario of a lost or stolen laptop, the decision in Chambers v. Kay(2002) 29 Cal. 4th 142, is instructive regarding what constitutes a “significant development.” There, the Supreme Court considered whether a fee division among lawyers from different firms had to be disclosed to the clients to be enforceable. The Court held that such “information may affect the client’s level of confidence in the attorneys and is indispensable to the client’s ability to make an informed decision regarding whether to accept the fee division and whether to retain or discharge a particular attorney.” (Id., at p.157.)
Most clients would reasonably want to know that information shared in confidence may have been compromised, and the circumstances leading up to that result. While the prudent attorney will obviously take reasonable steps to avoid such a risk to client secrets, if a loss or theft does occur, a duty of disclosure to clients may well follow.
Eric Deitz is a partner with Gordon Rees Scully Mansukhani, LLP.
1 While the ABA Model Rules are not binding in California, “[e]thics opinions and rules and standards promulgated by other jurisdictions and bar associations may also be considered.”
No portion of this article is intended to constitute legal advice. Be sure to perform independent research and analysis. Any views expressed are those of the author only and not of the SDCBA or its Legal Ethics Committee.
This article was originally published in the April 2018 issue of For the Record.