Metadata – NC Bar Proposed Ethics Opinion

A proposed ethics opinion by the NC State Bar covers the review and use of metadata.  The proposed opinion dated January 22, 2009 states the following conclusion,

…a lawyer must use reasonable care to prevent the disclosure of confidential client information hidden in metadata when transmitting an electronic communication and a lawyer who receives an electronic communication from another party or another party’s lawyer must refrain from searching for and using confidential information found in the metadata embedded in the document.

The concern with metadata is that it may reveal privileged or confidential client information.  With even basic computer skills, if you know how to look for metadata, it’s easy to obtain information about who wrote a document and when and to find detailed notes and information embedded in the document.  Attorneys must observe “reasonable care” to protect and preserve confidential information when they are using forms of electronic communication.

Likewise, when receiving an electronic communication, the opinion states that the attorney should not actively seek out metadata.  This is in line with ethics opinions issued in recent years by the NY State Bar followed by other state bars and backed up by the ABA Standing Committee on Ethics and Professional Responsibility.  Visit the ABA’s Legal Tech Resource Center for a complete list of Metadata Ethics Opinions in each state.

How does metadata relate to a virtual law practice?

With a web-based virtual law practice, the attorney may be transmitting documents to clients and other attorneys in digital format by uploading documents for review or in allowing uploads to the virtual law office from another attorney or client.  Depending on the file format being transferred online and the circumstances, metadata may be embedded in those files.

Accordingly, the virtual law practitioner should use metadata removal programs on their applications immediately before uploading them to the VLO.  Microsoft and even Open Office have metadata removal programs and techniques available for  their software suites.  Another option is to convert the files, such as Word, Excel, OpenOffice, and PowerPoint, to PDF before uploading them to the VLO.  However, some online clients may not be able to edit the application on their computers as a PDF.  So if the purpose of the transfer is to allow your clients to add anything to the document, then conversion to PDF may not be the best method of avoiding metadata.  Another free option would be to convert the document to Rich Text Format (RTF) but this would most likely create layout and formatting problems and not be worth it.

There are metadata removal applications from a number of companies, including Workshare, Payne Consulting Group, Esquire Innovations, Inc. or iScrub.  Depending on the virtual practice, an attorney may want to invest in an annual license for these programs just to avoid any malpractice risks.  Given the availability of these programs and methods, it is clearly the responsibility of the attorney to ensure that he or she has removed any metadata from a file before uploading it to the VLO and sharing it with clients and other attorneys.

How a virtual law practice may help prevent malpractice risks from metadata

If an attorney is required to use reasonable care to protect their client’s confidential, then should attorneys be using unencrypted email to communicate with clients and to transfer documents as attachments?  The risks involved in using email are well-known and the attachments sent through email may contain metadata if not carefully cleaned.

Even more of a security risk are the use of public email accounts, such as those provided by gmail, hotmail and yahoo.  If there is a safer option that is easily available to transfer information securely, then doesn’t this proposed NC State Bar ethics opinion and others like it require that the attorney use “reasonable care” to seek out a safer method?

With a virtual law practice, the attorney can tell their client that the attorney is acting in the best interest of the client by refusing to communicate and transfer legal documents via email.  The attorney can explain that using the web-based VLO is the safer way for the client to interact with the attorney and that even more communication tools are available to the parties through this method.

I have done this with my online clients and once they understand that the technology is no more complicated than email, and safer to protect their confidential legal matters, they are excited to have 24/7 access to their own homepage and legal case files.  Rather than emailing me their private legal issues on unsecure email or attaching documents for me to review, they are able to post on the discussion thread to me their legal issues and all of it is contained in their case file for future reference.  Likewise, if I’m working with another attorney on a case file, he or she may send me a private note using the same method which will show up on the case file rather than being sent through unencrypted email.

The risks of malpractice from metadata embedded in documents may be limited by the use the secure online communication inside a VLO.  The attorney and client may conduct all of their legal work securely online.  Rather than having multiple folders containing draft documents in email attachments, the client’s online case file after drafts have been completed may be limited to the single legal document controlled by the attorney who may then use a method of removing metadata when transferring it back and forth to the client or another attorney for review.

While a VLO may not remove all of the malpractice risks associated with metadata, it can help legal professionals comply with ethics opinions requiring “reasonable care” and to help them protect their client’s confidential information when using electronic communication.