11.03.04. Cloud Computing

Storing information in “the cloud” which are off-site servers, is becoming very common.  Services such Dropbox and Google Docs provide access to documents anywhere in the world.  In addition, clients may insist that lawyers provide the client access to documents related to their case.  It is easy to see how convenient these services are and fail to recognize the significant confidentiality issues that exist.  The first problem is that the client’s information is stored in a location that is outside of the lawyer’s control.  The lawyer may not even know where the “cloud” is located.  Furthermore, the cloud provider may have the client’s information stored in numerous locations across the world (this is known as redundancy to protect information in the event that one server goes down). 

Ethics opinions vary on the steps that a lawyer must take to ensure that client information is protected in the cloud.  All opinions, however, require the lawyer to take reasonable steps to ensure that client information is protected.  This due diligence requires the lawyer to be aware of the service provider’s security and data protection policies, the location of the information stored in the cloud, and what will happen to the information if the lawyer terminates the service.  These likely require more investigation than merely reading the terms of service when purchasing the service.