![\"9917973](\"\/wp-content\/uploads\/sites\/2\/9917973_m.jpg\")
<\/p>\n<\/p>\n
It would be a nightmare for any lawyer to find that someone had hacked into their firm\u2019s computer network and stolen confidential client information.\u00a0 That nightmare will get even scarier beginning July 1, 2015 when revisions to the Massachusetts Rules of Professional Conduct take effect, with the potential for new rules violations.<\/p>\n
<\/p>\n
An overhaul of the Massachusetts Rules of Professional Conduct will take effect on July 1, 2015.\u00a0 The changes potentially affect all lawyers, regardless of their practice area, and regardless of whether they practice alone or in large firms.\u00a0 Most of the Rules will receive at least a minor update, and Massachusetts lawyers should pay attention lest they step into some new traps. \u00a0One of the most significant changes to the Rules will impose affirmative obligations with respect to information technology and data security.\u00a0 Lawyers who fail to take appropriate steps to secure their clients\u2019 confidential information could find themselves in violation of the Rules.<\/p>\n
For example, a new Rule, 1.6(c), states that a \u201clawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, confidential information relating to the representation of a client.\u201d\u00a0 A new comment to that Rule, comment18, clarifies that \u201c[t]he unauthorized access to, or the inadvertent or unauthorized disclosure of, confidential information relating to the representation of a client does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure.\u201d\u00a0 However, the standard for what is \u201creasonable\u201d is less than clear.\u00a0 The comment states that\u00a0 \u201c[f]actors to be considered in determining the reasonableness of the lawyer\u2019s efforts include, but are not limited to, the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer\u2019s ability to represent clients\u2026\u201d<\/p>\n
Imagine you find yourself as lead counsel in a highly publicized celebrity divorce.\u00a0 You have a computer and a smartphone stuffed with \u201csensitive information\u201d about your high-profile client, but no, or only rudimentary, encryption and security.\u00a0 It may be \u201clikely\u201d that someone (the paparazzi?) will try to hack your computer or phone and disclose your client\u2019s confidential information across the Internet.<\/p>\n
If such a hacker-driven debacle occurs, will you face discipline for having lax computer security?\u00a0 Also, even if your security measures were \u201cgood enough\u201d for lower-profile clients\u2019 information, will they pass muster when you take on a high-profile client in a case that is a matter of intense public interest?\u00a0 Even for lower-profile clients, identity thieves, fraudsters, and corporate espionage agents may be highly interested in a lawyer\u2019s confidential electronic files \u2013 and they can cause great damage.<\/p>\n
The upshot is that, even though the revised Rule does not say what constitutes \u201creasonable\u201d security, lawyers may find themselves having to defend their data security in the aftermath of a breach.\u00a0 In addition to ensuring that basic security measures are in place, namely, encrypted email systems, phones and laptops that automatically lock, policies concerning using public internet connections, and a clear social media policy that prevents the dissemination of sensitive information or the use of personal email, lawyers with access to especially sensitive data may want to discuss information security with their clients.\u00a0 Comment 18 \u00a0allows the client to \u201crequire the lawyer to implement special security measures not required by this Rule or [to] give informed consent to forgo security measures that would otherwise be required.\u201d<\/p>\n
Other changes to the Rules with respect to technology include a new comment 3 to Rule 5.3 which \u00a0obligates lawyers to at least consider a client\u2019s information security when hiring an outside technology vendor.\u00a0 Comment 3 states that when employing the assistance of \u201cnonlawyers outside the firm\u201d a lawyer \u201cmust make reasonable efforts to ensure that the services are provided in a manner that is compatible with the lawyer\u2019s professional obligations.\u201d\u00a0 A lawyer fulfills this obligation, in part, through \u201carrangements concerning the protection of client information.\u201d\u00a0 Lawyers should consider this obligation when they retain vendors, and they may want to consider requiring that their vendors agree to basic confidentiality and data security agreements, and permit the law firms to monitor compliance or at least audit their security measures.<\/p>\n
Also, as a sort of technology catchall, revised Comment 8 to Rule 1.1 (concerning competence) now states that \u201cTo maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, and engage in continuing study and education.\u201d<\/p>\n
The Supreme Judicial Court has established a web site<\/a> with useful links concerning the revised Rules. These include a redlined version showing changes to the Rules<\/a>, and a report<\/a> by the Court\u2019s Standing Advisory on the Rules of Professional Conduct summarizing additional changes.<\/p>\n","protected":false},"excerpt":{"rendered":" It would be a nightmare for any lawyer to find that someone had hacked into their firm\u2019s computer network and stolen confidential client information.\u00a0 That nightmare will get even scarier beginning July 1, 2015 when revisions to the Massachusetts Rules of Professional Conduct take effect, with the potential for new rules violations.<\/p>\n","protected":false},"author":9,"featured_media":76,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[1],"tags":[26,29,5,32],"class_list":["post-8","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-board-of-bar-overseers-bbo","tag-data-security","tag-rules-of-professional-conduct","tag-supreme-judicial-court"],"acf":[],"yoast_head":"\n