{"id":11144,"date":"2019-09-19T14:44:40","date_gmt":"2019-09-19T18:44:40","guid":{"rendered":"https:\/\/abovethelaw.com\/?p=604499"},"modified":"2019-09-19T14:44:40","modified_gmt":"2019-09-19T18:44:40","slug":"lawyers-cybersecurity-and-data-breaches-your-ethical-obligations","status":"publish","type":"post","link":"https:\/\/abovethelaw.com\/legal-innovation-center\/2019\/09\/19\/lawyers-cybersecurity-and-data-breaches-your-ethical-obligations\/","title":{"rendered":"Lawyers, Cybersecurity, And Data Breaches: Your Ethical Obligations"},"content":{"rendered":"

\"\"I’m teaching a class at Syracuse University Law School this week as part of a partnership between the law school and the New York State Bar Association<\/a>. My colleague, Kevin Ryan<\/a>, the Executive Director of the Monroe County Bar Association, is teaching the class with me, and we’ll be talking to the students about lawyers and cybersecurity. As a result, I’ve got cybersecurity on my mind.<\/p>\n

And I’m not the only one. Cybersecurity is an issue that has become of paramount importance in recent years in the wake of large scale breaches, like the Equifax and Capitol One data breaches.<\/p>\n

No doubt your firm has already taken steps to protect your its data. If so, your firm isn’t alone. Most firms already have some cybersecurity measures in place, as I discussed in this post<\/a> from last April. But no matter what steps your firm has taken, most experts opine that a breach will nevertheless occur at some point; the question isn’t whether a it will occur, but when<\/a>.<\/p>\n

When that happens, is your firm prepared? Does your firm have breach protocols in place that comport with the latest ethical guidance? If not, here’s what you need to know about your ethical obligations after a breach or cyberattack.<\/p>\n

There are two ethics opinions that were issued within the past year that provide a helpful roadmap for firms to follow in the event of a breach: ABA Formal Opinion 483<\/a> and Maine Opinion No. 220<\/a>.<\/p>\n

These opinions provide very similar guidance with one exception that I’ll discuss momentarily but for the purposes of this post, I’ll focus on the recommendations found in ABA opinion. Notably, the opinions only address lawyers’ ethical obligations after a data breach of information relating to representation of a client. Other post-breach notification obligations required by privacy laws and other statutory requirements — such as those imposed by the GDPR<\/a>, or those that will be imposed by California Consumer Privacy Act<\/a> or the New York SHIELD Act<\/a>\u00a0— are not addressed in the opinion.<\/p>\n

Technology competence<\/h5>\n

At the outset, the importance of technology competence was emphasized by the ABA Standing Committee on Ethics and Professional Responsibility. The ABA Committee explained that\u00a0lawyers must “understand technologies that are being used to deliver legal services to their clients … [and] must use and maintain those technologies in a manner that will reasonably safeguard property and information that has been entrusted to the lawyer.” Notably, the ABA Committee explained that lawyers may outsource this requirement and that it “may be satisfied either through the lawyer\u2019s own study and investigation or by employing or retaining qualified lawyer and nonlawyer assistants.”<\/p>\n

How to prepare for a breach<\/h5>\n

Next, the ABA Committee addressed lawyers’ continuing ethical obligations prior to a breach occurring. The ABA Committee advised that\u00a0“lawyers must make reasonable efforts to monitor their technology resources to detect
\na breach … [and] should consider proactively developing an incident response plan with specific plans and procedures for responding to a data breach.”<\/p>\n

Importantly, the ABA Committee explained that a failure to immediately detect a breach is not a violation of ethical duties as long as a law firm has reasonably effective monitoring procedures in place: [T]he potential for an ethical violation occurs when a lawyer does not undertake reasonable efforts to avoid data loss or to detect cyber-intrusion, and that lack of reasonable effort is the cause of the breach.”<\/p>\n

Post-breach obligations<\/h5>\n

According to the ABA Committee, once a breach occurs, lawyers have an ethical obligation to:<\/p>\n