Ethics Opinion 1239

Ethics Opinion 1239

4.4.2022

By Ethics Opinions

Topic: An Attorney’s Ethical Obligation When a Court Orders Forensic Analysis of Hard Drive Containing Client Confidential Information

Digest: An attorney in receipt of a court order directing production of his hard drive containing the confidential information of clients who have not waived privilege or consented to disclosure, has the obligation to advise non-waiving clients of the existence of the court order. Absent the clients’ informed consent to waiver of the attorney-client privilege and consent to disclosure, an attorney must consult with the non-waiving clients about the reasonable steps necessary to avoid or limit production of confidential information and undertake those steps before complying with the court order.

Rules: 1.0(j), 1.4 (a)(1), 1.4(a)(3), 1.6(a), 1.6(b)(6)

FACTS:

1. The inquirer is an attorney who provided transactional services to a client who is now in litigation over the transaction. The attorney has received a trial court order directing him to turn over for a forensic analysis a hard drive in a computer that contains data of the client (who has waived the attorney-client privilege) but also contains the data of non-party clients who have not waived the attorney-client privilege or consented to the disclosure of their confidential information.

QUESTIONS:

2. When confronted with a discovery order requiring production of data stored on a lawyer’s hard drive, what steps must the lawyer take to protect the confidential information of other clients stored on that hard drive who are not parties to the litigation and who have not waived the attorney- client privilege or consented to the disclosure of the client’s confidential information?

OPINION:

3. Rule 1.6(a) of the Rules of Professional Conduct (the “Rules”) provides “A lawyer shall not knowingly reveal confidential information, as defined in this Rule, or use such information to the disadvantage of a client or for the advantage of the lawyer or a third person, unless the client gives informed consent, as defined in Rule 0(j). . .” As noted in Comment [2] to Rule 1.6, “[a] fundamental principle in the client-lawyer relationship is that, in the absence of the client’s informed consent, or except as permitted or required by these Rules, the lawyer must not knowingly reveal information gained during and related to the representation, whatever its source.”
4. An exception to this Rule may be found in Rule 6(b)(6) providing a lawyer “may reveal or use confidential information to the extent that the lawyer reasonably believes necessary…when permitted or required under these Rules or to comply with other law or court order.” Although nothing in Rule 1.6(b) mandates disclosure by the attorney, per se, other law may require that a lawyer disclose confidential information. Whether such other law supersedes the protections of Rule 1.6 is generally a question of law beyond the scope of this committee. When it appears that disclosure is required by law or court order – as here, for example, as a result of a trial court discovery ruling – the lawyer must consult with the client before making the disclosure. If the lawyer concludes that Rule 1.6 is superseded, Rule 1.6(b)(6) provides a safe harbor allowing the lawyer to make the disclosure as necessary to comply with the law or court order. See Comment [12] to Rule 1.6.
5. We have addressed the lawyer’s duty of reasonable care to avoid the disclosure of a client’s confidential information in a number of different See, e.g., N.Y. State 1020 (2014) (cloud storage); N.Y. State 940 (2012) (off-site backup tapes); N.Y. State 939 (2012) (office sharing); N.Y. State. 842 (2010) (online data storage). What is reasonable in the specific context of an already-issued court order directing the production of confidential information has been addressed in the Comments to Rule 1.6:
   A tribunal or government entity claiming authority pursuant to other law to compel disclosure may order a lawyer to reveal confidential information. Absent informed consent of the client to comply with the order, the lawyer should assert on behalf of the client nonfrivolous arguments that the order is not authorized by law, the information sought is protected against disclosure by applicable privilege or other law, or the law is invalid or defective for some other reason. In the event of an adverse ruling, the lawyer must consult with the client to the extent required by Rule 1.4 about the possibility of an appeal or further challenge, unless such consultation would be prohibited by other law. If such review is not sought or is unsuccessful, paragraph (b) (6) permits the lawyer to comply with the order.

   Comment [13] to Rule 1.6.

6. To be sure, the facts before us are complicated by the client’s waiver of the client-lawyer privilege and consent to the disclosure of confidential information as it pertains to that client’s communications. That waiver, however, does not impact the lawyer’s obligation to take reasonable steps to safeguard the duty of confidentiality owed to the non-party clients whose interests were not represented when the court issued its order or to notify the non-party clients of the existence of the court order.
7. The involvement of the confidential information of non-waiving clients imposes upon the lawyer an obligation to notify the affected clients of what has In the event of an adverse ruling on the disclosure of confidential communication – as is the case here – Comment [13] to Rule 1.6 requires the attorney to “consult with the client to the extent required by Rule 1.4 about the possibility of an appeal or further challenge….” Given the general communication obligations under Rule 1.4, the attorney must notify the affected clients of the extent to which their confidential information may be subject to unauthorized review. In addition to requiring an attorney to keep the client reasonably informed about the status of the matter (see Rule 1.4(a)(3)), Rule 1.4 also requires an attorney to promptly inform the client of any circumstance with respect to which the client’s informed consent is required and any material developments in the matter. See Rule 1.4(a)(1)(i) and (iii).
8. In N.Y. City 2017-5, the New York City Bar Association applied Rule 1.4 to explain an attorney’s obligation to advise a client when an electronic device containing confidential information is reviewed or seized upon a border crossing. Comparing the unauthorized access (even if sanctioned by law) to an attorney’s obligation to divulge the loss of a client’s file (N.Y. City 2015-6) and the obligation to advise a client of a significant error or omission by the attorney in the rendition of legal services (N.Y. State 1992 (2016)), that committee held:
   Disclosure will provide the client an opportunity to determine whether to file a legal challenge, assuming one is available, or to undertake any other available responses.
9. The facts present by the inquiring attorney are not materially different. The non-waiving clients must be consulted about the reasonable efforts the attorney will undertake to preserve the confidentiality of their confidential information stored on the lawyer’s hard drive.
10. If a non-waiving non-party client is provided sufficient information so as to meet the Rule 1.0(j) definition of informed consent, the that client may waive the intrusion upon his or her confidential information. If not, the attorney must take reasonable steps to preserve the non- waiving non-party clients’ confidential information. Depending upon the facts presented, the legitimate interests of the waiving party client and the counterparty in the litigation may be satisfied by less intrusive means than mirroring the entire hard drive containing the confidential information of the non-waiving non-party clients.
11. Reasonable steps that the inquirer may take in furtherance of his mandatory obligation to minimize or eliminate any impact on non-party non-waiving clients’ confidential information include (a) seeking to establish agreed search terms or other protocols that a mutually acceptable ESI vendor could implement; (b) in the event the waiving client’s electronic file has been stored in a fashion that allows for segregated duplication, securing an agreement to produce only that portion of the file that concerns the waiving client; (c) negotiating a confidentiality order limiting production for “attorney eyes only”; (d) seeking the appointment of a special master to review the privilege issues; (e) seeking in camera review of the confidential information by the court (see N.Y. State 1057 (2015)); (f) in the absence of agreement, moving to reargue the motion leading to the court’s decision outlining less intrusive means by which the legitimate goals of the litigation may be advanced; (g) in the absence of a court order revisiting the terms of the order, moving to stay enforcement pending appeal; and (h) appealing.
12. In N.Y. State 1198 (2020), this committee addressed the obligations of a former government attorney receiving a subpoena or court order and reached essentially the same conclusions we reach here regarding consultation with the client, reasonable efforts, and the safe harbor of Rule 1.6(b)(6). Reviewing a prior American Bar Association opinion, we stated:
    In 2016, the American Bar Association Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 473, which detailed a lawyer’s obligation upon receiving a subpoena relating to the lawyer’s representation of a client. The ABA Committee opined that “a lawyer must obey a court order, subject to any right to move the court to withdraw or modify the order or to appeal the order. But a lawyer facing a court order requiring the disclosure of client confidential information still is faced with complex, critical and fact-intensive questions on how to respond – e.g., what challenges should be considered, what specific information should be disclosed, and what protective measures should be sought. In making these judgments the lawyer must balance obligations inherent in the lawyer’s dual role as an advocate for the client and an officer of the court.” Initially, if the client is available, the lawyer must consult the client. If instructed by the client or if the client is unavailable, the lawyer must assert all reasonable claims against disclosure and seek to limit the subpoena or other demand on any reasonable ground. ABA Formal Opinion 473 (2016). We agree.

    N.Y. State 1198 ¶12.

13. Accordingly, pursuant to the safe harbor provision of Rule 6(b)(6), after consulting with the non-waiving non-party clients and taking reasonable, albeit unsuccessful, steps to protect their confidential information, the inquirer here is not ethically required to be held in contempt of court to protect confidential information stored on his hard drive and may comply with the court directing the production of his hard drive for forensic analysis.
14. Although N.Y. State 528 (1981) suggested that where the order is “subject to a good faith challenge, the lawyer should be free to postpone” compliance with the court order directing production of confidential information “pending timely exhaustion of available further review,” we believe the better course would be to seek a stay of enforcement from the trial or appellate court. We also observe that the expense associated with opposing disclosure of the non-waiving non-party client’s confidential information in these circumstances appears to fall on the attorney. As Comment [8a] to Rule 16 states “… lawyers are ordinarily better suited than clients to foresee and provide for the burdens of representation.”

CONCLUSION:

15. An attorney has the obligation to advise non-waiving clients of a court order directing duplication and production of their confidential Absent the clients’ informed consent to waiver of the attorney-client privilege and consent to disclosure, an attorney must consult with the clients about the reasonable steps necessary to avoid or limit production of confidential information and undertake those steps before complying with the court order.

(31-21)