Ethics Ruling Number
R4993
Area of Law
Legal practice management
Ethics Ruling Date
20/05/2021
Ethics Pub Date
1/07/2021
Ethics Background
A law firm is permitted to disclose confidential information to a practice management system supplier and/or cloud storage provider for the purpose of delivering or administering legal services. It is important to be aware that a solicitor is professionally responsible for any breach of the duty of confidentiality where utilising cloud-based practice management systems.
A sole practitioner acquired a cloud-based Practice Management System (‘PMS’). Prior to acquiring the PMS, the sole practitioner was informed by the PMS supplier that client files would be stored in Australia on a cloud-based storage provider. The sole practitioner attempted to amend the PMS suppliers’ standard contract to reflect this information but the amendment was refused. Despite an inability to amend the contract, the sole practitioner acquired the cloud-based PMS. The sole practitioner sought a ruling from the Ethics Committee on the following questions regarding the ethical use of cloud computing:
1. Does a Cloud storage provider and/or PMS supplier qualify as persons “engaged by, the solicitor’s law practice…for the purposes of delivering or administering legal service in relation to the client” and therefore fall within the exception of [ASCR] Rule 9.1.2?
2. If so, does this mean that it is not necessary to obtain a client’s, lead’s or potential client’s informed consent before using Cloud computing services in relation to their confidential information (as is required by the [New South Wales Legal Service Commissioner’s] Practice Note)?
3. If the software provider advises the solicitor in writing that the Cloud storage provider does not have access to my files, is this sufficient to overcome confidentiality issues in relation to the Cloud storage provider?
4. When I spend, say, half an hour speaking with a lead, whether from LIV Find a Lawyer or elsewhere, and may have given some basic advice, do I need to record their name and any other details in my PMS for the purpose of conflict checking?
Ruling
In the opinion of the Ethics Committee and on the information presented:
1. Yes. Pursuant to ASCR Rule 9.1.2, the law firm may disclose confidential information to the practice management system supplier and/or cloud storage provider for the purpose of delivering or administering legal services. Assuming that it is disclosed that cloud storage is used, then disclosure is also permitted under ASCR 9.2.1 on the basis of implied authorisation.
2. No, consent is not required, but disclosure of the use of cloud-based services is recommended for the reason given in paragraphs 1 and 4.
3. Ultimately, a solicitor is professionally responsible for any breach of the duty of confidentiality which may occur by the practice management supplier or cloud storage provider. Therefore, a law firm must take reasonable steps to satisfy itself that utilising a cloud practice management system will not breach client confidentiality. Reasonable steps should include conducting due diligence, reviewing the service agreement and seeking further clarity on any issues regarding the service arrangement with the practice management provider.
4. It is considered good practice for a law firm to record the names of potential clients, and any information regarding their matter that they provide in a practice management system for the purposes of conflict checking. As mentioned in paragraphs 1 and 2, where utilising a cloud based practice management system, it is advisable that a law firm discloses the use of a cloud based system to store client confidential information at the earliest opportunity – such as in an engagement letter or initial communication with a potential client.
5. The Ethics Committee has not sought to address any obligations of the practitioner under the Privacy Act.
6. The practitioner is reminded to review the ‘Cloud Computing Essentials’ Guideline published on the LIV website.