The Florida Bar
www.floridabar.org
The Florida Bar News
click to print this page  click to e-mail the address for this page 
October 15, 2010
Proposed ethics advisory opinions

The Professional Ethics Committee has issued Proposed Advisory Opinions 10-2 and 10-3 reprinted below. Pursuant to Rule 4(c) and (d) of The Florida Bar Procedures for Ruling on Questions of Ethics, comments from Florida Bar members are solicited on the proposed opinion. The committee will consider any comments received its next meeting. Comments must contain the proposed advisory opinion number and clearly state the issues for the committee to consider. A written argument may be included explaining why the Florida Bar member believes the committee’s opinion is either correct or incorrect and may contain citations to relevant authorities. Comments should be submitted to Elizabeth Clark Tarbert, Ethics Counsel, The Florida Bar, 651 E. Jefferson Street, Tallahassee 32399-2300, and must be postmarked no later than 30 days from the date of this publication.

PROPOSED ADVISORY OPINION 10-2
September 24, 2010
The Professional Ethics Committee has been asked by the Florida Bar Board of Governors to write an opinion addressing the ethical obligations of lawyers regarding information stored on hard drives. An increasing number of devices such as computers, printers, copiers, scanners, cellular phones, personal digital assistants (“PDA’s”), flash drives, memory sticks, facsimile machines and other electronic or digital devices (collectively, “Devices”) now contain hard drives or other data storage media1 (collectively “Hard Drives” or “Storage Media”) that can store information.2 Because many lawyers use these Devices to assist in the practice of law and in doing so intentionally and unintentionally store their clients’ information on these Devices, it is important for lawyers to recognize that the ability of the Devices to store information may present potential ethical problems for lawyers.

For example, when a lawyer copies a document using a photocopier that contains a hard drive, the document is converted into a file that is stored on the copier’s hard drive. This document usually remains on the hard drive until it is overwritten or deleted. The lawyer may choose to later sell the photocopier or return it to a leasing company. Disposal of the device without first removing the information can result in the inadvertent disclosure of confidential information.

Duty of Confidentiality

Lawyers have an ethical obligation to protect information relating to the representation of a client. Rule 4-1.6(a) of the Rules Regulating the Florida Bar addresses the duty of confidentiality and states:

(a) Consent Required to Reveal Information. A lawyer shall not reveal information relating to representation of a client except as stated in subdivisions (b), (c), and (d), unless the client gives informed consent.

The comment to the rule further states:

The confidentiality rule applies not merely to matters communicated in confidence by the client but also to all information relating to the representation, whatever its source. A lawyer may not disclose such information except as authorized or required by the Rules of Professional Conduct or by law.

A lawyer must ensure confidentiality by taking reasonable steps to protect all confidential information under the lawyer’s control. Those reasonable steps include identifying areas where confidential information could be potentially exposed. Rule 4-1.1 addresses a lawyer’s duty of competence:

Competence A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness, and preparation reasonably necessary for the representation.

The comment to the rule further elaborates:

To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, engage in continuing study and education, and comply with all continuing legal education requirements to which the lawyer is subject.

(emphasis added).

If a lawyer chooses to use these Devices that contain Storage Media, the lawyer has a duty to keep abreast of changes in technology to the extent that the lawyer can identify potential threats to maintaining confidentiality. The lawyer must learn such details as whether the Device has the ability to store confidential information, whether the information can be accessed by unauthorized parties, and who can potentially have access to the information. The lawyer must also be aware of different environments in which confidential information is exposed such as public copy centers, hotel business centers, and home offices. The lawyer should obtain enough information to know when to seek protection and what Devices must be sanitized, or cleared of all confidential information, before disposal or other disposition. Therefore, the duty of competence extends from the receipt, i.e., when the lawyer obtains control of the Device, through the Device’s life cycle, and until disposition of the Device, including after it leaves the control of the lawyer. Further, while legal matters are beyond the scope of an ethics opinion, a lawyer should be aware that depending on the nature of the information, misuse of these Devices could result in inadvertent violation of state and federal statutes governing the disclosure of sensitive personal information such as medical records, social security numbers, criminal arrest records, etc.

Duty to Supervise

The lawyer must regulate not only the lawyer’s own conduct but must take reasonable steps to ensure that all nonlawyers over whom the lawyer has supervisory responsibility adhere to the duty of confidentiality as well. Rule 4-5.3(b) states:

(b) Supervisory Responsibility. With respect to a nonlawyer employed or retained by or associated with a lawyer or an authorized business entity as defined elsewhere in these Rules Regulating The Florida Bar:

(1) a partner, and a lawyer who individually or together with other lawyers possesses comparable managerial authority in a law firm, shall make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that the person’s conduct is compatible with the professional obligations of the lawyer;

(2) a lawyer having direct supervisory authority over the nonlawyer shall make reasonable efforts to ensure that the person’s conduct is compatible with the professional obligations of the lawyer; and

(3) a lawyer shall be responsible for conduct of such a person that would be a violation of the Rules of Professional Conduct if engaged in by a lawyer if:

(A) the lawyer orders or, with the knowledge of the specific conduct, ratifies the conduct involved; or

(B) the lawyer is a partner or has comparable managerial authority in the law firm in which the person is employed, or has direct supervisory authority over the person, and knows of the conduct at a time when its consequences can be avoided or mitigated but fails to take reasonable remedial action.

A lawyer’s supervisory responsibility extends not only to the lawyer’s own employees but over entities outside the lawyer’s firm with whom the lawyer contracts to assist in the care and maintenance of the Devices in the lawyer’s control. If a nonlawyer will have access to confidential information, the lawyer must obtain adequate assurances from the nonlawyer that confidentiality of the information will be maintained.

Sanitization

A lawyer has a duty to obtain adequate assurances that the Device has been stripped of all confidential information before disposition of the Device. If a vendor or other service provider is involved in the sanitization of the Device, such as at the termination of a lease agreement or upon sale of the Device, it is not sufficient to merely obtain an agreement that the vendor will sanitize the Device upon sale or turn back of the Device. The lawyer has an affirmative obligation to ascertain that the sanitization has been accomplished, whether by some type of meaningful confirmation, by having the sanitization occur at the lawyer’s office, or by other similar means.

Further, a lawyer should use care when using Devices in public places such as at copy centers, hotel business centers, and outside offices where the lawyer and those under the lawyer’s supervision have little or no control. In such situations, the lawyer should inquire and determine whether use of such Devices would preserve confidentiality under these rules.

In conclusion, when a lawyer chooses to use Devices that contain Storage Media, the lawyer must take reasonable steps to ensure that client confidentiality is maintained and that the Device is sanitized before disposition. These reasonable steps include: (1) identification of the potential threat to confidentiality along with the development and implementation of policies to address the potential threat to confidentiality; (2) inventory of the Devices that contain Hard Drives or other Storage Media; (3) supervision of nonlawyers to obtain adequate assurances that confidentiality will be maintained; and (4) responsibility for sanitization of the Device by requiring meaningful assurances from the vendor at the intake of the Device and confirmation or certification of the sanitization at the disposition of the Device.
__________________________________

1As used in this opinion, Storage Media is any media that stores digital representations of documents.

2 See Brian Smithson, The IEEE 2600 Series: An Introduction to New Security Standards for Hardcopy Devices, ISSA Journal, Nov. 2009, at 28; Holly Herman, Experts Warn Copiers Can Be Fertile Ground for ID Thieves, Reading Eagle (Jun. 2, 2010, 12:28:54 P.M.), http://readingeagle.com/article.aspx?id=222523; Mark Huffman, Digital Copiers Could Be an Identity Theft Threat, ConsumerAffairs.com (May 19, 2010), http://www.consumeraffairs.com/news04/2010/05/digital_copiers.html; Armen Keteyian, Digital Photocopiers Loaded with Secrets, CBSNews.com (April 15, 2010), http://www.cbsnews.com/stories/2010/04/19/eveningnews/main6412439.shtml; Gregg Kelzer, Photocopiers: The Newest ID Theft Threat, Computerworld (March 14, 2007), http://www.computerworld.com/s/article/9013104/Photocopiers_The_newest_ID_theft_threat.

PROPOSED ADVISORY OPINION 10-3
September 24, 2010
The Professional Ethics Committee has been requested by the Florida Bar Board of Governors to render an advisory opinion on the issue of the ethical obligations of a lawyer when the personal representative, beneficiaries or heirs-at-law of a decedent’s estate, or their counsel request confidential information regarding a decedent. The analysis of the issue is the same for each person who may request such information, although the answer for each will depend on the individual facts and circumstances of the particular situation and may differ, depending on who is requesting the information and why.

Although a lawyer’s ethical obligation of confidentiality and the evidentiary matter of attorney-client privilege are related, the two issues are distinct. Confidentiality is much broader than privilege. According to Rule 4-1.6, Rules of Professional Conduct, all information relating to a client’s representation is confidential and may not be voluntarily disclosed by the lawyer without either the client’s consent or the application of a relevant exception to the confidentiality rule. The comment to Rule 4-1.6 provides further guidance, in stating: “[t]he confidentiality rule applies not merely to matters communicated in confidence by the client but also to all information relating to the representation, whatever its source.” On the other hand, privilege is much narrower as an evidentiary matter set forth in Florida Statutes § 90.502, which provides generally that a lawyer cannot be compelled to disclose communications between a lawyer and client that were made for the purpose of seeking and/or receiving legal advice over the client’s objection. Questions of confidentiality arise any time a lawyer is asked to disclose information relating to a client’s representation. The question of privilege only arises when a lawyer is compelled by a court, i.e. via subpoena, to disclose confidential communications made for the purpose of obtaining legal advice. Regarding privilege, the comment to Rule 4-1.6 provides as follows:

If a lawyer is called as a witness to give testimony concerning a client, absent waiver by the client, rule 4-1.6(a) requires the lawyer to invoke the privilege when it is applicable. The lawyer must comply with the final orders of a court or other tribunal of competent jurisdiction requiring the lawyer to give information about the client.

Rule 4-1.6 provides as follows:

(a) Consent Required to Reveal Information. A lawyer shall not reveal information relating to representation of a client except as stated in subdivisions (b), (c), and (d), unless the client gives informed consent.

(b) When Lawyer Must Reveal Information. A lawyer shall reveal such information to the extent the lawyer reasonably believes necessary:

(1) to prevent a client from committing a crime; or

(2) to prevent a death or substantial bodily harm to another.

(c) When Lawyer May Reveal Information. A lawyer may reveal such information to the extent the lawyer reasonably believes necessary:

(1) to serve the client’s interest unless it is information the client specifically requires not to be disclosed;

(2) to establish a claim or defense on behalf of the lawyer in a controversy between the lawyer and client;

(3) to establish a defense to a criminal charge or civil claim against the lawyer based upon conduct in which the client was involved;

(4) to respond to allegations in any proceeding concerning the lawyer’s representation of the client; or

(5) to comply with the Rules of Professional Conduct.

(d) Exhaustion of Appellate Remedies. When required by a tribunal to reveal such information, a lawyer may first exhaust all appellate remedies.

(e) Limitation on Amount of Disclosure. When disclosure is mandated or permitted, the lawyer shall disclose no more information than is required to meet the requirements or accomplish the purposes of this rule.

The comment to the rule states that “[t]he duty of confidentiality continues after the client-lawyer relationship has terminated.”

A request for information from a personal representative, beneficiaries or heirs-at-law of a decedent’s estate, or their counsel will generally involve information “relating to the representation of a client,” and a lawyer ordinarily should not voluntarily disclose such information without the client’s informed consent. See Florida Ethics Opinion 92-5. There are exceptions to the confidentiality rule that either require or permit a lawyer to disclose confidential information. The Committee cannot envision every instance in which a personal representative, beneficiaries or heirs-at-law of a decedent’s estate, or their counsel may request information from a decedent’s lawyer, but will provide several examples in an effort to illustrate the appropriate analysis.

The exception to the confidentiality rule that is most likely to apply in such requests is set forth in subdivision (c)(1): “to serve the client’s interest unless it is information the client specifically requires not to be disclosed.” Thus, if a personal representative asks for confidential information relating to a decedent’s estate plan and the decedent’s lawyer determines that disclosure of the information would aid in the proper distribution of the decedent’s estate according to the decedent’s wishes, the lawyer may properly disclose the information to the personal representative, unless the decedent specifically required that the information be kept confidential. For example, in Florida Ethics Opinion 72-40, a client instructed the inquiring lawyer who was hired to assist the client with estate planning to “forget” that the client had a “large amount of bearer bonds, registered jointly with his wife.” The opinion concludes that the lawyer may not disclose the existence of these assets to the bank which was to be the sole executor of the client’s estate unless the client gave consent to the disclosure or unless ordered to do so by a court, whether the inquiry was made before or after the client’s death. The opinion states that “the duty to preserve a client’s confidences survives his death. . . .” Thus, a lawyer must undertake the appropriate analysis under the confidentiality rule, even if it is the personal representative who requests information of the decedent from a lawyer who assisted in the decedent’s estate planning and the information sought relates specifically to that estate plan.

Similarly, if a beneficiary or heir-at-law asks for specific information and the decedent’s lawyer determines that voluntary disclosure of the information would serve the decedent’s interests, the lawyer may disclose that specific information. For example, a lawyer might provide a copy of the decedent’s will or disclose information relating to the execution of a will to a beneficiary or heir-at-law if the lawyer reasonably believes that disclosure of the information would forestall litigation by the beneficiary or heir-at-law, thereby conserving assets of the estate in the exercise of the lawyer’s professional discretion. However, information that the decedent specifically required the lawyer not to disclose to others may not be disclosed by the lawyer to the beneficiary or heir-at-law, regardless of whether the information is privileged. For example, a deceased client may have specifically instructed the lawyer not to disclose information to anyone about an illegitimate child or an extra-marital relationship.

Under Florida Statutes §90.502(3)(c), the personal representative may claim the privilege on behalf of the decedent. It would be difficult for the personal representative to claim or waive privilege on behalf of the decedent without knowing the content of the information which is subject to the privilege. Therefore, a lawyer who represented the decedent in estate planning matters may disclose information from the file to the personal representative, unless the decedent specifically required that the information not be disclosed. Disclosure of such information is impliedly authorized, to the extent the decedent did not specifically require that its confidentiality be maintained, to carry out the decedent’s wishes involving the estate.

On the other hand, a lawyer who represented the decedent on matters other than estate planning would have no such implied authorization to disclose information to the personal representative. For example, a lawyer who represented a client in a criminal defense matter would not have implied authorization to disclose information to the personal representative, but instead should decline to voluntarily provide information to the personal representative or other third parties unless a different exception to the confidentiality rule clearly applies.

Similarly, beneficiaries or heirs-at-law may attempt to compel the decedent’s lawyer to provide information that the lawyer has determined within the lawyer’s professional discretion not to provide voluntarily, because it either would not serve the decedent’s interests or the decedent previously indicated must not be disclosed. When under compulsion of a subpoena, the lawyer acts ethically by complying with the subpoena as to any information sought that is not privileged. However, the lawyer should raise the appropriate privilege on behalf of the decedent regarding any information for which there is a good faith basis to raise privilege and request that the court make a determination as to disclosure of the information. This may be particularly true of privileged information that may be embarrassing to the decedent. As above, the lawyer should not make any disclosure of information for which the lawyer has raised privilege in good faith until the court orders disclosure of the information. If the court finds that the information is not privileged or that an exception to privilege applies, the lawyer may either comply with the order by disclosing the information or “first exhaust all appellate remedies.” See Rule 4-1.6(d) and Florida Ethics Opinions 65-7, 70-40, and 71-29.

Doubts about whether information should be voluntarily disclosed should be resolved in favor of nondisclosure.

[Revised: 10-30-2014]