Vermont Bar Association Professional Responsibility Section
Digest:
“Vermont attorneys can utilize Software as a Service in connection with confidential client information, property, and communications, including for storage, processing, transmission, and calendaring of such materials, as long as they take reasonable precautions to protect the confidentiality of and to ensure access to these materials.”
From the Opinion:
“Vermont lawyers must exercise due diligence when using new technologies, including Cloud Computing. … Complying with the required level of due diligence will often involve a reasonable understanding of:
a. the vendor’s security system;
b. what practical and foreseeable limits, if any, may exist to the lawyer’s ability to ensure access to, protection of, and retrieval of the data;
c. the material terms of the user agreement;
d. the vendor’s commitment to protecting confidentially of the data;
e. the nature and sensitivity of the stored information;
f. notice provisions if a third party seeks or gains (whether inadvertently or otherwise) access to the data; and
g. other regulatory, compliance, and document retention obligations that may apply based upon the nature of the stored data and the lawyer’s practice.
In addition, the lawyer should consider:
a. giving notice to the client about the proposed method for storing client data;
b. having the vendor’s security and access systems reviewed by competent technical personnel;
c. establishing a system for periodic review of the vendor’s system to be sure the system remains current with evolving technology and legal requirements; and
d. taking reasonable measures to stay apprised of current developments regarding SaaS systems and the benefits and risks they present.”
Rules: 1.6 Confidentiality of Information; 1.1 Competence; 1.15 Safekeeping Property; 5.3 Responsibilities Regarding Nonlawyer Assistants
The full text is available at https://www.vtbar.org…