The Massachusetts Bar Association published Ethics Opinion 12-03 regarding the use of cloud computing in law practice, specifically referring to lawyers’ use of Google docs. The scenario posed in the opinion is this: “A lawyer wishes to store and synchronize the electronic work files that he creates in the course of his law practice across multiple computers and devices (e.g., smartphones, iPads, etc.) so that he can access them remotely.”
The question posed is “whether it [the use of cloud computing] would violate Lawyer’s obligations under the Massachusetts Rules of Professional Conduct to store confidential client information using Google docs or some other Internet based storage solution, and to synchronize his computers and other devices that contain or access such information over the Internet.”
This opinion mirrors several that we have seen in the past year that focus on compliance with Rule 1.6 and protection of the client’s confidentiality. The State Bar acknowledges that it has gone through similar analysis with two existing MA ethics opinions, the first related to the use of email and the second related to providing a third-party software vendor with remote access to confidential client information stored on the firm’s computers. Accordingly, the State Bar concludes that the reasoning in these two earlier ethics opinions would also allow for cloud computing as it is being used in law practices today.
The ethics opinion states that the lawyer should obtain client consent to the use of cloud computing when “particularly sensitive client information” will be stored or transmitted over the Internet. The Lawyer must also follow his or her client’s instructions regarding the use of cloud computing if the client does not want to use such methods to store or transmit the client’s confidential information.
Similar to other ethics opinions on cloud computing, the MA State Bar provides a brief description of what it recommends as “reasonable efforts” that should be taken by the lawyer in selecting a cloud-based technology. I particularly like the last one: “(e) periodically revisiting and reexamining the provider’s policies, practices and procedures to ensure that they remain compatible with Lawyer’s professional obligations to protect confidential client information reflected in Rule 1.6(a).” A key component of responsibly using cloud-based technology in law practice is keeping updated on the changes in the technology and with the provider and not resting on your haunches after having done the “reasonable care” process initially. The Opinion also specifically refers to Google’s terms of service and questionable sections of it, perhaps to emphasize this point.
The Opinion concludes:
Ultimately, the question of whether the use of Google docs, or any other Internet based data storage service provider, is compatible with Lawyer’s ethical obligation to protect his clients’ confidential information is one that Lawyer must answer for himself based on the criteria set forth in this opinion, the information that he is reasonably able to obtain regarding the relative security of the various alternatives that are available, and his own sound professional judgment. (emphasis added)