What does the Law Society of British Columbia say about technology and client records?

What does the Code say about technology?

Commentary [4.1] to the competence rule says a lawyer should develop an understanding of, and ability to use, the technology relevant to their practice.

The Law Society of British Columbia's Code says a lawyer should understand the benefits and risks of the technology relevant to their practice. It links this to the duty of confidentiality in section 3.3. The commentary says "should" and names no particular control.

To maintain the required level of competence, a lawyer should develop an understanding of, and ability to use, technology relevant to the nature and area of the lawyer's practice and responsibilities.

A lawyer should understand the benefits and risks associated with relevant technology, recognizing the lawyer's duty to protect confidential information set out in section 3.3 (Confidentiality).

What do the Rules say about keeping records secure?

Rule 10-4(1) asks a lawyer to protect all practice records, and the information in them, by making reasonable security arrangements against loss, destruction and unauthorized access, use or disclosure.

A lawyer must protect all records related to the lawyer's practice and the information contained in them by making reasonable security arrangements against all risks of loss, destruction and unauthorized access, use or disclosure.

Who must be told if records are lost or accessed?

Rule 10-4(2) says a lawyer must immediately notify the Executive Director in writing if the lawyer has reason to believe records were lost or improperly accessed or copied. The notice goes to the Law Society's Executive Director, with all the relevant circumstances.

A lawyer must immediately notify the Executive Director in writing of all the relevant circumstances if the lawyer has reason to believe that (a) the lawyer has lost custody or control of any records related to the lawyer's practice for any reason, (b) anyone has improperly accessed or copied any of the lawyer's records,

What if records are kept with an outside provider?

Rule 10-3(4) lets a lawyer keep records, electronic ones included, with a storage provider only on conditions. The first two are that the lawyer keeps custody and control of the records, and that ownership does not pass to anyone else.

A lawyer must not maintain records, including electronic records, with a storage provider unless the lawyer (a) retains custody and control of the records, (b) ensures that ownership of the records does not pass to another party,

What does the cloud computing checklist say?

The Law Society's cloud computing checklist says that placing your data, and your clients' data, with a third party raises questions of security, privacy, compliance and risk. It is a checklist of questions to consider, not a rule.

Since you are placing your data, and your clients' data, in the hands of third parties, it also raises issues of security and privacy, regulatory compliance and risk management, amongst others.

What can an outside reading show for this rule?

This rule asks for care across the whole firm. An outside reading cannot see your policies, your training, your devices, your access lists or who can sign in to what.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

That is evidence toward the duty, never proof of it. Where the text names no control, we add none for it.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.