Your firm’s computer network has been hacked and client data either exposed or likely exposed. What’s a law firm to do? The legal and regulatory reporting obligations are numerous, complex and are ignored at the firm’s peril, but ABA Formal Ethics Opinion No. 483 reminds lawyers that there are also independent ethical obligations triggered when a cyber-attack compromises confidential client information or incapacitates a law firm’s computers or network.

First and foremost, the duty of competence (Model Rule 1.1) “requires lawyers to understand technologies that are being used to deliver legal services to their clients … and lawyers must use and maintain those technologies in a manner that will reasonably safeguard property and information that has been entrusted to the lawyer.” (This obligation is discussed in depth in ABA Formal Ethics Opinion No. 477R (May 22, 2017) (Securing Communication of Protected Client Information).) Model Rules 5.1 and 5.3 impose an “obligation to safeguard and monitor the security of electronically stored client property and information.”

Thus, the first step in addressing a cyber-breach must be taken long before a breach ever occurs. The Opinion recommends that an “incident response plan” be designed to identify and stop a breach, mitigate any loss or theft of data, restore system security and eventually the restore firm’s system itself. Without an incident response plan, a law firm runs the significant risk of needlessly prolonging the exposure of client data to third-parties. Cyber-invincibility is not the standard. Rather, “the potential for an ethical violation occurs when a lawyer does not undertake reasonable efforts to avoid data loss or to detect cyber-intrusion, and that lack of reasonable effort is the cause of the breach.”

Once an attack has been identified and halted, the firm must make reasonable efforts to determine what data was exposed and assess the duty of disclosure. Not every cyber-event compromises material confidential client information or impairs a lawyer’s ability to render services. However, if material confidential client information is exposed or the firm’s representation of a client is impaired, then Model Rules 1.4 and 1.6, governing the duties of disclosure and preserving client confidences respectively, are implicated.

The Opinion stresses that “Rule 1.6 is not violated even if data is lost or accessed if the lawyer has made reasonable efforts to prevent the loss or access.” Thus, although couched as a recommendation, the Opinion in fact makes the preparation of an incident response plan mandatory to avoid violating Rule 1.6. The duty of preserving client confidences is also implicated in any reporting made to a governmental agency. The potential tension between the client’s right to confidentiality and any legal or regulatory reporting requirements must be promptly assessed and analyzed when involving law enforcement or reporting a cyber-breach.

The Opinion unequivocally states that Rule 1.4 creates a duty to inform a current client of a data breach that impacts their material confidential information. Former clients, however, are not so lucky under Model Rule 1.9 and the Opinion declines to find a duty to notify former clients in the absence of a black-letter rule requiring such notice.

Finally, the Opinion concludes that the nature of the notice to a current client will depend on the facts of the breach. The Opinion does state, however, that “the disclosure must be sufficient to provide enough information for the client to make an informed decision as to what to do next, if anything.”

While ethics rules vary based on jurisdiction, many states follow the ABA Model Rules. Thus, in such jurisdictions, it is very likely that firms without an incident response plan will be found to have violated Rule 1.6 where material confidential client information is compromised by a cyber-breach. In addition, the Opinion makes clear that there are mandatory reporting duties owed to current clients when material confidential client data is compromised. While law firms largely remain brick and mortar operations, their work product now primarily exists in the digital domain. ABA Opinion 483 is, therefore, mandatory reading for all law firm managers and general counsels.

David Bayne, a partner at Akerman, litigates complex, high profile commercial disputes and arbitration matters with a focus on professional liability defense, general commercial and employment litigation.