A new ABA ethics opinion addressed the duty of confidentiality when sending emails to clients. Lawyers using email to communicate with their clients definitely need to read the opinion.
In summary the opinion states:
A lawyer sending or receiving substantive communications with a client via email or other electronic means ordinarily must warn the client about the risk of sending or receiving electronic communications using a computer or other device, or email account, where there is a significant risk that a third party may gain access. In the context of representing an employee, this obligation arises, at the very least, when the lawyer knows or reasonably should know that the client is likely to send or receive substantive client-lawyer communications via email or other electronic means, using a business device or system under circumstances where there is a significant risk that the communications will be read by the employer or another third party.
An insightful blog post on the subject is written by Stephanie Kimbro on her Virtual Law Practice Blog. Stephanie advocates the use of encrypted email or using a system that allows the client to login to a secure encrypted area to communicate, such as a virtual law office portal. She makes valid points. Other virtual law advocates and companies like MyCase also believe its time to bail on email.
But is it really time to abandon unencrypted email completely? A comment to Stephanie’s post by Carolyn Elefant likely represents the sentiments of most lawyers on the email topic. Caroyln points out that there is a big difference in using encrypted email when there is a known threat and using encrypted email all the time. Carolyn appropriately asks whether we really need more barriers to communicate with our clients?
A degree of common sense must be exercised. If a client is suing their employer (like in the opinion’s fact pattern), it only makes sense that the lawyer should warn the client about the risks of accessing emails or other messages (whether encrypted, unencrypted, or messages in a virtual law portal), while using the employer’s computer equipment or mobile devices. There is a risk of disclosure if a message was accessed on the employer’s computer or mobile device regardless of how a message is sent. The same is true if the message was sent to gmail or other personal email account and accessed by the client at the workplace. Most corporate employer technology policies will state that the employer owns the equipment, that monitoring may occur and that there is no expectation of privacy using the employer’s equipment. As the ethics opinion states, a much better solution in these instances is that the lawyer would advise the client not to communicate with the lawyer using the employer’s computer devices at all.
Protective measures would include the lawyer refraining from sending emails to the client’s workplace, as distinct from personal email address, and cautioning the client against using a business email account or using a personal email account on a workplace computer or device at least for substantive emails with counsel.
And, in footnote 7 of the opinion, lawyers are cautioned that if the lawyer becomes aware that a client is receiving personal email on a workplace computer or other device owned or controlled by the employer, then a duty arises to caution the client not to do so, and if that caution is not heeded, to cease sending messages even to personal email addresses.
Some lawyers like legal technology blogger Nicole Black question whether the opinion is a step forward or a step back. Black wonders whether opinions like this will hold lawyers back from using emerging technologies like cloud computing. I agree that the opinion may have some broad implications, especially concerning the access by third parties in public settings, but at the end of the day perhaps we’re making this a little more complicated than it needs to be. After all, where would you send a snail mail letter to your client regarding their case against the employer: a) to the employer’s address and place of business? or b) to the client’s home?