The Florida Bar News
July 1, 2017
Thinking of storing information in the cloud?
PRI knows the questions you should ask
The Bar’s Technology Committee — in partnership with the Practice Resource Institute — pulled together the information lawyers should consider when selecting a cloud service provider.
“Two things are happening more than ever right now: Lawyers are using the cloud to store sensitive information; and lawyers are under attack from cyber criminals looking to steal sensitive information,” said Tech Committee Chair Al Saikali, who also chairs the Privacy and Data Security Practice area at Shook, Hardy & Bacon. “It was therefore important to develop a document that teaches lawyers about the cybersecurity and legal issues associated with the storage of cloud service providers.”
The “Quick Start Guide on Cloud Computing” answers basic questions, such as what cloud computing means and where information is stored, and it suggests questions to ask of a potential provider. It may be found at pri.floridabar.org.
The committee also annotated a longer, more detailed, list of standards for cloud computing in its “Due Diligence Considerations for Lawyers Evaluating Cloud Computing Service Providers,” incorporating information from the Legal Cloud Computing Association. Areas of concern for lawyers include whether the information is encrypted, if the information will be shared, how data breaches can be prevented, whether that data can later be moved to a different provider and whether the provider is in compliance with security and privacy legal frameworks.
It may also be found on the PRI website at pri.floridabar.org.
“This guide is really going to be of huge benefit to our solo and small firm practitioners to help them understand the benefits and risks associated with the cloud and how to properly vet a possible cloud services provider,” said John M. Stewart, chair of The Florida Bar Board of Governors’ Technology Committee.
Saikali said the documents are not meant to be a panacea, but a starting place to get lawyers thinking about the risks and safeguards associated with storing client information in the cloud.
He said the cloud is usually more cost-effective and allows smaller firms to take advantage of the more sophisticated security safeguards that it might not otherwise be able to purchase and implement.
“The rules of ethics require that lawyers understand these security concerns and think about them proactively,” he said. “This document is designed to flag the most important security and legal issues associated with storing client information in the cloud. Lawyers can vet these issues with potential cloud service providers and comparison shop before engaging them.”
Lawyers who are considering adopting cloud computing are encouraged to review Florida Bar Ethics Opinions 06-1 and 12-3, which address the electronic storage of documents and maintaining the confidentiality of client information.
The Bar also emphasizes that the LCCA standards might not define a lawyer’s ethical or legal obligations, and lawyers considering the use of the cloud should consult an information security and cloud computing expert.
To speak with a PRI practice management advisor, call 866-730-2020 or email [email protected] or visit pri.floridabar.org to initiate a chat session.