For many lawyers, a typical day includes sending and receiving e-mails from both their office computers and wirelessly, carrying confidential documents on "memory keys" or on laptops, exchanging documents in electronic form with opposing parties and using law firm websites for both advertising their firms and inbound communications with prospective clients. These electronic tools allow us to be more efficient and to be more responsive to our clients. At the same time, they also present new and evolving concerns for law firm risk management. These concerns are not solely regulatory in terms of potential bar discipline. Particularly as they relate to our fiduciary duties of competence, client confidentiality and loyalty, they also present the specter of civil liability claims with attendant fee forfeiture and other damages if client confidences are compromised or conflicts arise.

This column looks at three areas of "electronic" risk management: 1) electronic communications; 2) electronic document storage and exchange and 3) using websites for both advertising and inbound communications from potential clients.

Electronic Communications
In 1999, the American Bar Association issued a comprehensive ethics opinion on the use of e-mail and cell phones for confidential communications with clients. ABA Formal Ethics Opinion 99-413 generally approved both the use of unencrypted e-mail and cell phones for client communications because federal law makes the unauthorized interception of those communications illegal, and, therefore, a reasonable expectation of privacy attaches to communications in those forms. The federal statutory protections, most of which fall under the Electronic Communications Privacy Act and apply broadly to "any wire, oral, or electronic communication,"¹ should extend to newer variants of both e-mail and voice technologies such as wireless e-mail devices and Internet telephones. At the same time, 99-413 emphasized that lawyers need to weigh the sensitivity of the information with the means used to communicate.

Since 99-413 was issued, the ABA updated its influential Model Rules of Professional Conduct in 2002 and 2003. Those updates included two comments relevant to electronic communications. The first, Comment 16 to Model Rule 1.6 on confidentiality, stresses that a central element in the duty of competent representation is safeguarding client confidentiality. The second, Comment 17 to Model Rule 1.6, reinforces the preceding point by observing that lawyers must take reasonable precautions to avoid confidential information being transmitted to unintended recipients. Comment 17 notes, however, that lawyers do not normally need to use "special security measures if the method of communication affords a reasonable expectation of privacy." The reference to the "reasonable expectation of privacy" echoes the logic of 99-413 and its focus on the federal statutes making the unauthorized interception of electronic communications illegal. But, Comment 17 cautions, again like 99-413, that level of security must be commensurate with sensitivity of the information and also notes that clients may require lawyers to take special measures beyond what is otherwise required by the RPCs.

Both 99-413 and the comments to Model Rule 1.6 are available on the ABA Center for Professional Responsibility’s website at www.abanet.org/cpr. The versions of RPC 1.1 on competent representation and 1.6 on confidentiality that Oregon adopted in 2005 closely parallel their ABA Model Rule counterparts in this regard. Oregon does not have an ethics opinion analogous to 99-413 nor did it adopt comments to its RPCs. Nonetheless, the ABA opinion and comments offer useful guidance on both the duties involved and the means lawyers can reasonably use to communicate confidentially with their clients.²

Electronic Document Storage and Exchange
Electronic document storage and exchange present discrete issues, but, like electronic communications, both revolve around lawyers’ duties of competence and confidentiality.

Document Storage. Just as with paper files, lawyers have an obligation to take reasonable safeguards to protect the confidentiality of electronic files. Unlike paper files, the potential for significant file loss has become much greater as lawyers have moved more of their data to electronic media. For example, although a lawyer might absent-mindedly leave a single paper file at a restaurant following lunch with a client, leaving a "memory key" or laptop loaded with the electronic equivalent of the lawyer’s "file room" presents potential consequences on a much broader scale. The comments to ABA Model Rule 1.6 that we looked at for electronic communications offer equally appropriate guidance for portable electronic storage. Although encryption or password-protection may not be necessary if otherwise reasonable care is taken to ensure the physical security of a storage device, the measures employed must be balanced against the sensitivity of the information.

Just as paper file storage is sometimes handled by outside contractors, so, too, with electronic storage. Use of outside vendors for either paper or electronic storage is generally permitted just as outside recycling services and computer maintenance services are allowed under, respectively, OSB Formal Ethics Opinion 2005-141 and ABA Formal Ethics Opinion 95-398. With either paper or electronic storage, however, the lawyer or law firm involved remains charged under RPC 5.3(a) with making "reasonable efforts to ensure that the person’s conduct is compatible with the professional obligations of the lawyer[.]" In other words, a lawyer or law firm cannot "contract out" its responsibility for properly acquainting a vendor with a lawyer’s duty of confidentiality and receiving reasonable assurance that the vendor chosen has safeguards in place that run consistent with that duty.

Document Exchange. Increasingly, lawyers share documents in electronic form with their opponents in both transactional and litigation contexts. A ready example is a draft contract that goes back and forth as parties negotiate toward a final agreement. In this situation, the concerns do not focus on the text exchanged (assuming the lawyer did not inadvertently forward confidential information), but, rather, on the "metadata" embedded in the document if it is exchanged in an original word-processing format like Microsoft Word. The metadata can often reveal, for example, when, who and what changes were made at particular times or can include editors’ comments. There is no direct guidance in Oregon in the form of an OSB ethics opinion or RPC on metadata use. Other states that have examined the issue have come to varying conclusions. The ABA, however, issued an ethics opinion last year on the review and use of metadata. The opinion, Formal Ethics Opinion 06-442, offers a useful summary of the law and the issues in this area. It, too, is available on the ABA Center for Professional Responsibility’s website and looks at the questions involved from the perspective of both the sender and the receiver.

From the sender’s perspective, 06-442 draws a distinction between documents produced in the course of formal discovery and those simply exchanged during negotiations. On the former, it notes that a producing party may have a duty to produce metadata if relevant and requested or to assert any appropriate privilege because ABA Model Rule 3.4(a) (like its Oregon equivalent) prohibits lawyers from obstructing another’s access to evidence or unlawfully altering or concealing documents. The new federal electronic discovery rules that went into effect this past December sharpen that point in federal litigation.³ On the latter, it notes that a lawyer’s duty of competent representation generally includes an obligation to protect a client’s confidential information under Model Rules 1.1 (competence) and 1.6 (confidentiality) (which are also similar to their Oregon equivalents). Although 06-442 carefully sidesteps the issue of whether a lawyer who allows confidential information to slip through to the other side in the form of metadata has violated the standard of care in either a liability or a regulatory sense, it counsels sending documents that might otherwise contain such information in an "imaged" or "hard copy" format (such as fax, "pdf" or simply paper), "scrubbing" such information (using software designed for this function) from the document before sharing it with the other side or executing a "claw back" agreement with the other side (allowing each party to "claw back" privileged documents that were inadvertently produced). Beyond confidential information, 06-442 notes that virtually all electronic documents that are in their original word processing format (such as Word or WordPerfect) contain a variety of metadata that is not confidential and, therefore, may be shared with the other side.

From the receiver’s perspective, 06-442 predicates its comments with the assumption that the lawyer recipient has obtained the document lawfully and, therefore, is not in breach of Model Rule 4.4(a) (which prohibits gathering evidence in a way that violates the rights of a third party and which is similar to its Oregon equivalent). In either a discovery or negotiating context, 06-442 counsels that a lawyer on the receiving end is not prohibited in the first instance from looking at metadata in a document that the lawyer receives from the other side. If, however, the metadata contains what appears to be inadvertently produced privileged information, then Model Rule 4.4(b) (which is substantively identical in both the ABA and Oregon versions) directs that the lawyer notify his or her counterpart on the other side. At that point, both the ABA and Oregon versions of RPC 4.4(b) characterize whether privilege has been waived as a question of substantive evidence law rather than a matter of professional ethics. Oregon State Bar Formal Ethics Opinion 2005-150 discusses inadvertent production of privileged materials from the ethics perspective and Goldsborough v. Eagle Crest Partners, 314 Or 336, 838 P2d 1069 (1992), and In re Sause Brothers Ocean Towing, 144 FRD 111 (D Or 1991), are the leading cases in Oregon’s state and federal courts on privilege waiver from an evidentiary perspective.⁴ Opinion 2005-150 also discusses the potential disqualification risk for a recipient of simply using an opponent’s privileged information without first obtaining a court’s ruling that privilege has been waived. It is available on the OSB’s website at www.osbar.org.

Websites
For present purposes, it is useful to think of a law firm website as a window: it looks out in the sense of projecting your firm to outsiders and with many websites it looks in by letting outsiders contact firm lawyers directly. Each view involves different risk management issues.

Looking Out. RPC 7.2, which governs lawyer advertising generally, embraces electronic marketing as long as it complies with corresponding rules requiring content accuracy and limiting direct contact with prospective clients. Comment 3 to ABA Model Rule 7.2 (which differs from its Oregon counterpart in that it is shorter and more general) notes that "electronic media, such as the Internet, can be an important source of information about legal services, and lawful communication by electronic mail is permitted by this Rule." An important consideration for both multi-state firms and single-office firms whose lawyers practice in multiple jurisdictions is that the firm needs to comply with the marketing rules of all of its practice jurisdictions.

Looking In. Inbound communications from prospective clients through law firm websites can trigger duties of confidentiality to those prospective clients even if they never become firm clients. RPC 1.18 outlines the duties involved:

(a) A person who discusses with a lawyer the possibility of forming a client-lawyer relationship with respect to a matter is a prospective client.

(b) Even when no client-lawyer relationship ensues, a lawyer who has had discussions with a prospective client shall not use or reveal information learned in the consultation, except as Rule 1.9 would permit with respect to information of a former client.

Firms can insulate themselves from these duties if they adequately advise prospective clients not to provide them with information the prospective clients regard as confidential until the firm has run a conflict check and determined that further conversations can take place. Many law firms also include a disclaimer to the effect that no attorney-client relationship will be formed simply by communicating or supplying information to the firm via its website. The practical importance of both kinds of disclaimers was illustrated in Barton v. U.S. District Court for the Central District of California, 410 F3d 1104 (9th Cir 2005). In Barton, a plaintiffs’ personal injury firm invited prospective clients to complete an online questionnaire about a prescription drug involved in litigation the firm was handling. The questionnaire included a disclaimer that no attorney-client relationship was formed by completing the questionnaire but did not include a disclaimer on confidentiality. The 9th Circuit held that absent a clear disclaimer, the firm would still have a duty of confidentiality under California law (analogous to Oregon RPC 1.18) to those who submitted the questionnaires. The California State Bar in Formal Ethics Opinion 2005-168 later emphasized that such disclaimers of confidentiality need to be in sufficiently plain terms to be understood by prospective clients.⁵

It is important to note that prospective clients cannot generally establish an attorney-client relationship by unilaterally sending an electronic communication to a lawyer.⁶ Therefore, a prospective client who simply obtains a lawyer’s e-mail address from a law firm website and then sends the lawyer an e-mail should not be considered to have unilaterally created an attorney-client relationship. However, if a law firm website invites inbound communication and supplies prospective clients with the technical means to do so via its website, then the law firm should take reasonable steps to inform those submitting the information about the conditions under which an attorney-client relationship will be formed and whether the information will be treated as confidential. If not, then (at minimum) RPC 1.18 will supply the "default" result.

Summing Up
The duties of competence, confidentiality and loyalty were bedrock principles for lawyers when paper reigned supreme. Today’s technology puts an even greater premium on remaining true to these duties because it allows us to practice at a pace, in places and in ways that are dramatically different than in years past.

Endnotes
1. See 18 USC §§ 2510-2522. The Stored Communications Act, 18 USC §§2701-2712, also applies to some categories of stored electronic communications, such as e-mail stored with an Internet service provider. See Theofel v. Farey-Jones, 359 F3d 1066 (9th Cir 2004).

2. A separate issue on the client side of the attorney-client relationship is whether the client has maintained the confidentiality of the communications involved, especially if the client used a third party’s computer to send or receive otherwise confidential communications. See generally In re Asia Global Crossing, Ltd., 322 BR 247 (Bankr SDNY 2005) (discussing this aspect of the attorney-client privilege); see also Thygeson v. U.S. Bancorp, 2004 Westlaw 2066746 (D Or Sept 14, 2004) (discussing the use of workplace computers for private purposes).

3. See Advisory Committee Notes to 2006 Amendments to FRCP 26(b)(5)(B) (discussing information falling within the attorney-client privilege or work product protection).

4. As this is written, a proposed new Federal Rule of Evidence 502 would impose similar standards in federal proceedings. The proposed new rule and the accompanying advisory committee report are available at www.uscourts.gov/rules.

5. California State Bar Formal Ethics Opinion 2005-168 is available on the California State Bar’s website at www.calbar.org.

6. In Oregon, for an attorney-client relationship to be formed, the client must subjectively believe that it exists and that subjective belief must be objectively reasonable under the circumstances. See In re Weidner, 310 Or 757, 770, 801 P2d 828 (1990).

ABOUT THE AUTHOR
Mark J. Fucile of Fucile & Reising handles professional responsibility, regulatory and attorney-client privilege matters and law firm related litigation for lawyers, law firms and legal departments throughout the Northwest. He is a past member of the OSB Legal Ethics Committee, is a past chair of the Washington State Bar Rules of Professional Conduct Committee, is a member of the Idaho State Bar Professionalism & Ethics Section and is a co-editor of the OSB’s Ethical Oregon Lawyer and the WSBA’s Legal Ethics Deskbook. He can be reached at (503) 224-4895 and Mark@frllp.com.

© 2007 Mark J. Fucile

— return to top
— return to Table of Contents