The Pennsylvania Bar Association (PBA) has issued new guidance to attorneys on working from home during the COVID-19 pandemic. Formal Opinion 2020-300 addresses a host of issues relating to remote practice, including an attorney’s duty of technological competence when handling sensitive client information in a home environment. ABA Section of Litigation leaders observe that although the opinion was prompted by the current shelter-in-place orders, its guidance reaches well beyond the present circumstances, and will continue to apply as attorneys increasingly depart from the traditional brick-and-mortar office model in favor of “virtual” law firms and other arrangements.
On April 1, 2020, Pennsylvania’s governor, Tom Wolf, ordered all “non-essential businesses” in Pennsylvania, including law firms, to close. Because an extended work-from-home period was new to many attorneys, the PBA Committee on Legal Ethics and Professional Responsibility issued Formal Opinion 2020-300 to address issues of legal ethics relating to remote practice. Finding that “no Pennsylvania Rule of Professional Conduct specifically addresses the ethical obligations of attorneys working remotely,” the PBA drew upon its previous opinions on cloud computing and virtual offices for guidance on an attorney’s “duty of technological competence.” As the opinion observes, this duty “requires attorneys to understand the general risks and benefits of technology, including the electronic transmission of confidential and sensitive data, and cybersecurity, and to take reasonable precautions to comply with this duty.”
A portion of the opinion concerned the PBA’s recommended “best practices” for using new technology, many of which were of general application rather than unique to remote work. These included “using firewalls, anti-virus and anti-malware software,” and “requiring the use of encryption” to protect emails containing client confidences. “They wanted to say some things about technology that they previously may not have had an opportunity to say,” says John M. Barkett, cochair of the Section of Litigation’s Ethics & Professionalism Committee. “Data breaches are more of a concern now, regardless of remote work, and the committee used the current situation as an opportunity to get into areas they saw a need to address,” observes Barkett.
One of the PBA’s recommendations was hiring an outside expert for attorneys not proficient in cybersecurity. “For lawyers who do not practice in the cybersecurity field, or who may not be IT mavens, they may not know what the ‘reasonable practices’ are,” notes Sandy Bilus, cochair of the Section’s Privacy & Data Security Committee. “The best practices are explained in plain language by the PBA, but the PBA also says, ‘Look, if you just don’t understand this stuff, you have to hire someone who does.’ That’s how important this is,” adds Bilus.
The opinion also covers “smart devices” which listen for and record human speech, recommending that attorneys “[p]rohibit[] the use of smart devices such as those offered by Amazon Alexa and Google voice assistants in locations where client-related conversations may occur.” “People may have gotten one as a gift and set it up without thinking about it, and it’s potentially recording everything they say,” says Bilus. “The opinion is a helpful reminder that this is a form of technology that is particularly invasive, and you need to think twice before you have one in a location where you’re going to be working on client matters,” he continues.
“Smart devices have been in the news a lot lately,” adds Barkett. “But what is the opinion saying here? Are they suggesting that if an Amazon or Google device records a client conversation, that means that you’ve blown the privilege? That’s a little scary. The opinion doesn’t actually come out and say that, but it does suggest that you may not be taking a reasonable precaution if you’re not mindful of where these things are,” he observes.
Although working from home may be a new experience with its own technological challenges, Section leaders do not believe that the PBA’s guidance will come as a surprise. “The overall message is that your world may have changed, but the ethics rules remain the same,” says Bilus. “Lawyers have always been aware that you shouldn’t be talking about client information when you’re out in public. They have also understood that when you’re at home, you shouldn’t discuss client matters with visitors or family members. So this opinion is much more a reminder than a ground-breaker,” notes Bilus, further adding that “one solution is find a dedicated space that’s cut off from other outside interaction and conduct business there.”
Barkett concurs: “Whether it’s Amazon Alexa, people in the elevator, or your children in the next room, you have to be sure no one’s listening when you’re discussing client information. That’s not new.”
