May 06, 2020 Feature

Handling Confidences Carefully

At least in theory, lawyers who ignore warnings to a client’s detriment may be disciplined under Rule 1.6(c) for failing to take reasonable precautions.

Bruce A. Green

Download a printable PDF of this article.

Suppose that during the discovery phase of a lawsuit, you assert that the attorney-client privilege protects documents containing your communications with your client—but the court disagrees. For example, suppose the court finds that a public relations expert attending your meeting with the client, or with whom you shared confidential communications, was not needed to assist you in providing legal services. Therefore, the court concludes that the attorney-client communications were not privileged or that the privilege was waived. May the client blame you for failing to do what was necessary to establish and preserve the privilege? Might you even be at risk of professional discipline for having failed to protect the privilege?

The professional conduct rules of many U.S. jurisdictions have a provision based on Rule 1.6(c) of the ABA Model Rules of Professional Conduct, requiring lawyers to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” Even without this specific rule, the ordinary duty of competence, from which the obligation derives, would hold lawyers responsible for protecting clients’ confidential information. At least in theory, a lawyer could be disciplined if the opposing party obtains information through discovery that, but for the lawyer’s neglect, would have been protected from disclosure by the attorney-client privilege. This is one of many ways in which Rule 1.6(c), added to the ABA Model Rules in 2012, might apply.

It seems fair to say that with the advent of computer-based storage of documents and internet communications, preventing “unauthorized access” to clients’ information has become increasingly difficult. In earlier times, lawyers needed to heed only a few instructions—for example, store your documents in locked file cabinets; keep track of your briefcase; don’t talk about the case with those who aren’t working on it or in places where others might overhear; and train other lawyers and non-lawyers who staff your cases so that they are as careful as you are. But in recent years, the ethics committees of the ABA and other bar associations have published a stream of opinions instructing lawyers about their professional obligation to protect the confidentiality of their clients’ information, including privileged communications, in the internet era.

One instruction is that lawyers have an ethical duty to take reasonable steps to prevent hackers from gaining unauthorized access to their law firms’ computer systems containing confidential documents about their clients. If a law firm’s computer is hacked—as many have been—the lawyer may be subject to discipline if a client’s information was obtained because of the lawyer’s failure to take reasonable protective measures. See ABA Formal Op. 477R (2017).

Similarly, lawyers must also be careful to prevent third parties from gaining access to confidential material on their cell phones, laptops, and other electronic devices. For example, a New York City Bar opinion warns against traveling internationally with electronic devices containing more of their clients’ confidential information than necessary and to take reasonable measures to prevent border agents from reading clients’ email and other documents. See Ass’n of the Bar of the City of N.Y., Op. 2017-5 (2017). Traveling across borders might pose a similar risk of intrusion by foreign governments and might warrant a similar warning from the bar.

Lawyers must also be careful in the electronic communications they exchange with clients. It may be unreasonable to use means of communications, such as hotel computers, that are not secure. Further, lawyers have been warned that before emailing documents they have created, such as pleadings or proposed settlement agreements, to opposing counsel or other third parties, they may have to delete confidential metadata—that is, information stored in the document that discloses information about the document itself, such as what changes were made, when they were made, and by whom. See State Bar of Ariz., Op. 07-03 (2007).

It is not enough for lawyers themselves to be careful about confidential information. They also must advise their clients to be careful. For example, lawyers may be obligated to warn their clients not to communicate about confidential matters using an employer’s computer or cell phone or over an employer’s email system, because the employer may have access to the communications and reserve the right to review them. See ABA Formal Op. 11-459 (2011).

At least in theory, lawyers who ignore these warnings to a client’s detriment may be disciplined under Rule 1.6(c) for failing to take reasonable precautions. In practice, of course, disciplinary authorities have bigger fish to fry and are unlikely to pursue lawyers for occasional slipups.

The ABA has not yet cautioned lawyers about the implications of Rule 1.6(c) in cases in which clients lose privilege claims, but the day may come. Suppose that, as in the earlier example, the court finds that the privilege was waived because the lawyer shared documents with a consultant whose assistance was not necessary to the litigation. Or suppose that the lawyer’s corporate client shares privileged documents with a corporate officer, and the court later holds that the corporation waived the privilege because the particular officer was not assisting in the representation. Is the lawyer at risk under Rule 1.6(c) for acting unreasonably in failing to take precautions, or in failing to warn the client to take precautions, to preserve the privilege? One can imagine many similar scenarios.

Often the answer will be that the lawyer acted reasonably, notwithstanding the adverse judicial decision. Lawyers who lose privilege claims did not necessarily fail to “make reasonable efforts” to protect confidential communications from disclosure even if, in hindsight, they could have been more careful. After all, protecting the attorney-client privilege can be challenging, especially in complex corporate litigation. It can be hard to anticipate all the ways in which the privilege can be lost. Whole treatises are devoted to the ever-evolving doctrine and case law concerning the attorney-client privilege. Notwithstanding the Supreme Court’s observation in Upjohn v. United States, 449 U.S. 383 (1981)—that “[a]n uncertain privilege, or one which purports to be certain but results in widely varying applications by the courts, is little better than no privilege at all”—uncertainty and variation abound.

But in cases where clients lose privilege claims, it is worth considering whether their lawyers bear some responsibility. Even if disciplinary authorities are unconcerned, litigators in those cases might learn from their mistakes. Indeed, it pays to read published decisions in which other lawyers’ clients lost their privilege claims and to learn from those colleagues’ mistakes—a much less expensive lesson.

Bruce A. Green

The author is the Louis Stein Chair at Fordham University School of Law.