Ethics Opinion 939

Ethics Opinion 939

10.16.2012

By Committee on Professional Ethics

New York State Bar Association

Shared office space

Committee on Professional Ethics

Opinion 939 (10/16/12)
Topic: Maintaining confidentiality of client information as between independent lawyers sharing office space and computer
Digest: Independent lawyers sharing office space may share computer for client-related information if they exercise reasonable care to assure that confidential information is not disclosed
Rules: 1.6(a) & (c)FACTS

1.                   Two private lawyers share space, but are not partners or otherwise practicing as one firm.  They share one computer, as to which they have separate administrative passwords not known to each other.  They maintain separate paper files.

QUESTION

2.                   May private lawyers who share space also share a computer for confidential, client-related information where they have separate administrative passwords to the computer that are not known to each other?

OPINION

3.                   Rule 1.6(a) of the Rules of Professional Conduct states:  “A lawyer shall not knowingly reveal confidential information,” with exceptions not relevant to the issue presented.  Rule 1.6(c) provides, also subject to an exception not relevant here:  “A lawyer shall exercise reasonable care to prevent the lawyer’s employees, associates, and others whose services are utilized by the lawyer from disclosing or using confidential information of a client ….”

4.                   A lawyer’s duty of reasonable care is not limited to overseeing the conduct of others.  The lawyer must also take reasonable care to avoid improper disclosure by the lawyer himself or herself.[1]  In addition to whatever support for that broader duty may be found in the text of Rule 1.6, support from other sources has been cited by some ethics opinions.  See A.B.A. 11-459 (citing Rule 1.1(a), which calls for a lawyer to provide competent representation to a client, and stating that “a lawyer must act competently to protect the confidentiality of clients’ information”); N.Y. City 1994-11 (stating that a duty to preserve client confidences and secrets “inheres in the fiduciary relationship between lawyer and client”).

5.                   When a lawyer uses a particular technology to store or transmit confidential information, the degree of care that is required may depend on factors such as the security of that technology and the sensitivity of the information.  If the technology, taking into account legal as well as technological safeguards, does not provide a reasonable expectation that confidentiality will be protected; if circumstances put the lawyer on notice of a heightened risk that confidentiality may be compromised; or if the information is extraordinarily sensitive, then further security measures may be required.  See Rule 1.6 Cmt. [17]; N.Y. State 842; N.Y. State 709; A.B.A. 11-459.  The lawyer, upon considering such factors, must take reasonable precautions to ensure privacy.

6.                   The facts provided by the inquirer are insufficient to resolve whether the proposed shared computer can be used for client-related information without violating the duty of reasonable care to protect confidentiality.  The fact that the lawyers have separate computer passwords is certainly an appropriate precaution.  Whether it is sufficient would depend on further factors.  Some password systems may be more resistant to unauthorized access than others.  Protection of the password is also important; for example, a password kept on a piece of paper stuck to the computer and readily visible to any user does not provide much protection.  On the other hand, if a robust password system provides a degree of protection similar to that of locked file cabinets, then its proper and consistent use may well constitute reasonable care.  Admittedly there could be some risk of extraordinary efforts to hack into even a well-secured computer, or to steal it from the premises for more leisurely hacking, just as there could be a risk that file cabinets could be broken into or removed.  The lawyer’s obligation, however, is not to guarantee preservation of confidentiality at all costs; it is to protect confidentiality by taking reasonable care.

CONCLUSION

7.                   Lawyers practicing as sole practitioners but sharing space may share a computer to store and process client confidential information, but only if, under the actual circumstances relating to the computer, including its software and passwords and their use, the lawyers take reasonable precautions to ensure that the privacy of the confidential information is protected.

(50-12)