Massachusetts Bar Association Ethics Opinion 12-03
[Approved by the Massachusetts Bar Association’s House of Delegates on May 17, 2012]
Topics: Cloud Computing; Google docs
Summary of the opinion:
“A lawyer generally may store and synchronize electronic work files containing confidential client information across different platforms and devices using an Internet based storage solution, such as ‘Google docs,’ so long as the lawyer undertakes reasonable efforts to ensure that the provider’s terms of use and data privacy policies, practices and procedures are compatible with the lawyer’s professional obligations, including the obligation to protect confidential client information reflected in Rule 1.6(a). A lawyer remains bound, however, to follow an express instruction from his or her client that the client’s confidential information not be stored or transmitted by means of the Internet, and all lawyers should refrain from storing or transmitting particularly sensitive client information by means of the Internet without first obtaining the client’s express consent to do so.”
On “Google docs” in particular:
“Applying its conclusions to Google docs, … the Committee observes that Google has adopted written terms of service and a privacy policy for users of Google docs (see generally http://www.google.com/google-d-s/terms.html) that reference and incorporate various other Google policies. Among other things, Google represents that data stored on Google docs is ‘private’ and ‘password protected,’ but can be voluntarily shared by the user with others or published to the World Wide Web. The Committee further observes that Google docs and other Internet based storage solutions, like many, if not most, remotely accessible software systems and computer networks, are not immune from attack by unauthorized persons or other forms of security breaches. See, e.g., ‘How Safe Are Your Google Docs’, found at http://www.odesk.com/blog/2010/05/how-safe-are-your-google-docs; and ‘Can You Trust Your Data To Amazon, Other Storage Cloud Providers?’, found at http://www.networkworld.com/supp/2008/ndc3/051908-cloud-storage.html.
…Ultimately, the question of whether the use of Google docs, or any other Internet based data storage service provider, is compatible with Lawyer’s ethical obligation to protect his clients’ confidential information is one that Lawyer must answer for himself based on the criteria set forth in this opinion, the information that he is reasonably able to obtain regarding the relative security of the various alternatives that are available, and his own sound professional judgment.”
Rules: Massachusetts Rule of Professional Conduct 1.6(a)
The full text is available at http://www.massbar.org…