As if a lawyer’s job were not tough enough, we now need to understand technology in addition to the law. ABA Model Rules of Professional Conduct 1.6 outlines a lawyer’s obligation in securing client data: “(c) A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” Moreover, the lawyer’s duty of competence starts with legal knowledge, skill, thoroughness and preparation, but as outlined in Comment 8, Model Rule 1.1, amended in 2012, extends to “the benefits and risks associated with relevant technology.” Finally, in accordance with Model Rules 5.2 and 5.3, the lawyer supervising a matter must ensure that subordinate lawyers and nonlawyers associated with the matter, including consultants and vendors, act with technical competence.
Therefore, data breaches have ethical implications as well as the risk of loss to the client and damage to the firm’s reputation. Cybersecurity begins with a top-down strategy, but the culture of security must include each and every person in the firm and its consultants and vendors. Indeed, the need for firmwide cultural alignment around data security is no different from the climate within the corporate clients that we represent. Lawyers must be cybersecurity leaders if we are to change the evolving dynamic of the ever-increasing number and scale of incidents.
