August 2022 LEMR Article
This article is featured in Volume 3, Number 8 of the Legal Ethics and Malpractice Reporter.
On August 4, 2022, the New York State Bar Association published Opinion 1240, which provides advice on the applicability of Rule 1.6 to the protection of contact lists maintained on lawyer smartphones. The opinion highlights the New York Rule of Professional Conduct 1.6:
Rule 1.6(c) of the New York Rules of Professional Conduct (the “Rules”) requires a lawyer to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure or use of, or unauthorized access to” the confidential information of current, former and prospective clients. Rule 1.6(a), in turn, provides that confidential information “consists of information gained during or relating to the representation of a client, whatever its source, that is (a) protected by the attorney- client privilege, (b) likely to be embarrassing or detrimental to the client if disclosed, or (c) information that the client has requested be kept confidential.”
NYSBA Opinion 1240 is concerned with the security of contact lists maintained on smart phones when those contact lists contain the following information about clients:
…one or more email addresses, work or residence addresses, and phone numbers (collectively sometimes called “directory information”), but contacts often also include additional non-directory information (such as birth date or the lawyer’s relationship to the contact).
The concern arises from the fact that many social media and other phone applications request permission from smart phone owners to share contact information contained on the owner’s smart phone. Thus, by agreeing to share such information, the owner may be disclosing client confidential information.
When examining this issue, the New York State Bar Association referred to a prior opinion regarding when an attorney’s relationship to a client must be kept confidential:
In N.Y. State 1088 (2016), we addressed whether an attorney could disclose to a potential client the names of actual clients the attorney had represented in the same practice area. To answer that inquiry, we needed to determine, as a threshold matter, whether and under what circumstances the names of current or past clients could be “confidential information,” as defined in Rule 1.6(a). We stated, first, that clients’ names will be confidential information if the clients have requested keeping their names confidential. See N.Y. State 1088 ¶ 6 (2016). We then opined:
If the client has not requested that the lawyer keep the client’s name confidential, then the lawyer must determine whether the fact of representation is generally known and, if not, whether disclosing the identity of the client and the fact of representation is likely to be embarrassing or detrimental to the client. This will depend on the client and the specific facts and circumstances of the representation.
Because the determination of this issue is fact-specific and client-specific, the New York State Bar Association perceived a danger of violating Rule 1.6 if a lawyer were to share her contacts list with an “app.”
Upon identifying the potential for a Rule 1.6 violation, the New York State Bar Association offered guidance regarding an attorney’s obligations and what factors to weigh in carrying out those obligations:
Insofar as clients’ names constitute confidential information, a lawyer must make reasonable efforts to prevent the unauthorized access of others to those names, whether stored as a paper copy in a filing cabinet, on a smartphone, or in any other electronic or paper form. To that end, before an attorney grants access to the attorney’s contacts, the attorney must determine whether any contact – even one – is confidential within the meaning of Rule 1.6(a). A contact could be confidential because it reflects the existence of a client-attorney relationship which the client requested not be disclosed or which, based upon particular facts and circumstances, would be likely to be embarrassing or detrimental to the client if disclosed. N.Y. State 1088 (2016).
Some relevant factors a lawyer should consider in determining whether any contacts are confidential are: (i) whether the contact information identifies the smartphone owner as an attorney, or more specifically identifies the attorney’s area of practice (such as criminal law, bankruptcy law, debt collection law, or family law); (ii) whether people included in the contacts are identified as clients, as friends, as something else, or as nothing at all; and (iii) whether the contact information also includes email addresses, residence addresses, telephone numbers, names of family members or business associates, financial data, or other personal or non-public information that is not generally known.
If a lawyer determines that the contacts stored on his smartphone include the confidential information of any current or former client, the lawyer must not consent to give access to his contacts to an app, unless the attorney, after reasonable due diligence, including a review of the app’s policies and stated practices to protect user information and user privacy, concludes that such confidential contact information will be handled in such a manner and for such limited purposes that it will not, absent the client’s consent, be disclosed to additional third party persons, systems or entities. See N.Y. State 820 (2008).
If “contacts” on a lawyer’s smartphone include any client whose identity or other information is confidential under Rule 1.6, then the lawyer may not consent to share contacts with a smartphone app unless the lawyer concludes that no human being will view that confidential information, and that the information will not be sold or transferred to additional third parties, without the client’s consent.
The Kansas and Missouri versions of Rule 1.6 contain language that is similar to the New York version. Subsections (a) and (c) of Kansas Rule of Professional Conduct 1.6 state:
(a) A lawyer shall not reveal information relating to representation of a client unless the client consents after consultation, except for disclosures that are impliedly authorized in order to carry out the representation, and except as stated in paragraph (b).
(c) A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.
Subsections (a) and (c) of Missouri Rule of Professional Conduct 4-1.6 state:
(a) A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation, or the disclosure is permitted by Rule 4-1.6(b).
(c) A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of the client.
Although the Kansas and Missouri versions of Rule 1.6 are somewhat different from NY’s version, the underlying reasoning of NYSBA Opinion 1240 may be applied by Kansas and Missouri authorities in similar situations. Thus, it would be wise for lawyers to formulate policies about lawyer and staff use of smartphones, keeping client contact information on these phones, and using “apps” that request to share contact information so as not to violate client confidentiality under Rule 1.6 in their jurisdiction.
About Joseph, Hollander & Craft LLC
Joseph, Hollander & Craft is a premier law firm representing criminal, civil and family law clients throughout Kansas and Missouri. When your business, your freedom, your property, or your career is at stake, you want the attorney standing beside you to be skilled, prepared, and relentless. From our offices in Kansas City, Lawrence, Overland Park, Topeka and Wichita, our team of 20+ attorneys has you covered. We defend against life-changing criminal prosecutions. We protect children and property in divorce cases. We pursue relief for victims of trucking collisions and those who have suffered traumatic brain injuries due to the negligence of others. We fight allegations of professional misconduct against doctors, nurses, judges, attorneys, accountants, real estate agents and others. And we represent healthcare professionals and hospitals in civil litigation.