What does ABA Model Rule 1.6(c) ask a lawyer to do about client information?

What does the rule say?

ABA Model Rule 1.6(c) asks a lawyer to make reasonable efforts to prevent client information from being disclosed by accident or reached by someone without authority.

The duty runs to the client, and it covers information relating to the representation of that client.

A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.

Whose actions does it cover?

The comment says the lawyer is to act competently to protect that information from access by third parties, and from disclosure by the lawyer or by people working on the matter or under the lawyer's supervision.

Paragraph (c) requires a lawyer to act competently to safeguard information relating to the representation of a client against unauthorized access by third parties and against inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client or who are subject to the lawyer's supervision.

Is a breach itself a violation?

Comment [18] says a disclosure or an access is not a violation of paragraph (c) if the lawyer made reasonable efforts to prevent it. The question the rule asks is about the efforts made, not only the outcome.

The unauthorized access to, or the inadvertent or unauthorized disclosure of, information relating to the representation of a client does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure.

What makes an effort reasonable?

The comment lists factors rather than a checklist: how sensitive the information is, how likely a disclosure is without more safeguards, what more safeguards would cost, how hard they are to put in place, and how much they would get in the way of the lawyer's work. The rule names no particular control.

Factors to be considered in determining the reasonableness of the lawyer's efforts include, but are not limited to, the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer's ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).

What about sending client information?

Comment [19] asks a lawyer who sends a communication with client information to take reasonable precautions so it does not reach the wrong people.

When transmitting a communication that includes information relating to the representation of a client, the lawyer must take reasonable precautions to prevent the information from coming into the hands of unintended recipients.

What can an outside reading show for this rule?

This rule asks for care across the whole firm. An outside reading cannot see your policies, your training, your devices, your access lists or who can sign in to what.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

That is evidence toward the duty, never proof of it. Where the text names no control, we add none for it.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.