All lawyers understand that they have an ethical obligation to protect client confidential information from prying eyes, whether in a locked file cabinet, on a cloud storage device, or passing through the networks of third-party vendors that make up the modern legal services supply chain.

At Esquire Deposition Solutions, we’re part of that supply chain, and we take seriously our mission-critical role in helping lawyers safeguard their client’s confidential information. On this blog, we’ve written frequently (here, here, and here) on the lawyer’s ethical obligation to carefully review the data security practices of all third parties that handle client confidential information.

Very recently, the Pennsylvania Bar Association issued an important ethics opinion clarifying — in Pennsylvania, at least — the measures a lawyer must take to ethically outsource legal tasks that involve handling a client’s confidential information. The state bar’s legal ethics committee explained that, although it is not necessary for lawyers to obtain a written statement from the vendor vouching that its data security practices meet the lawyer’s ethical obligations to protect client data, it is imperative that lawyers ascertain that the vendor has in place reasonable procedures to protect the confidentiality of the client’s information and that the vendor understands those obligations.

The state bar’s legal ethics committee explained that, although it is not necessary for lawyers to obtain a written statement from the vendor vouching that its data security practices meet the lawyer’s ethical obligations to protect client data, it is imperative that lawyers ascertain that the vendor has in place reasonable procedures to protect the confidentiality of the client’s information and that the vendor understands those obligations.

The opinion clears up uncertainty that was lingering in the wake of a 1995 American Bar Association ethics opinion that strongly suggested a written statement from the vendor was ethically required.

In Formal Opinion 95-398 (1995): Access of Nonlawyers to a Lawyer’s Data Base, the American Bar Association advised that lawyers give third-party vendors access to client information “must make reasonable efforts to ensure that the company has in place, or will establish, reasonable procedures to protect the confidentiality of client information.” This statement seems reasonable, but the ABA went on to say: “In connection with this inquiry, a lawyer might be well-advised to secure from the service provider in writing, along with or apart from any written contract for services that might exist, a written statement of the service provider’s assurance of confidentiality.”

The Pennsylvania ethics committee decided that no such written statement from the vendor is necessary. Instead, a lawyer’s ethical obligation to secure the client’s information can be met by verifying that the vendor:

• has terms of service assuring the confidentiality of any information it receives
• will not make unauthorized disclosures of client information,
• has in place reasonable procedures to protect the confidentiality of client information and fully understands its data security obligations, or
• provides written assurance that it will conduct its business consistent with the lawyer’s ethical obligations, including the obligation to safeguard client confidential information.

The Pennsylvania ethics committee’s opinion should bring welcome clarity for lawyers working to meet their data security obligations to clients in what is a very challenging and dynamic technological environment.