What do the Law Society of Ontario's rules say about technology and client information?

What does the competence rule say?

Rule 3.1-2 asks a lawyer to perform legal services to the standard of a competent lawyer. The technology passages sit in the commentary to this rule.

A lawyer shall perform any legal services undertaken on a client's behalf to the standard of a competent lawyer.

What does the commentary say about technology?

Commentary [4A] says a lawyer should develop an understanding of, and ability to use, the technology relevant to their practice.

The Law Society of Ontario's commentary on competence says a lawyer should understand the benefits and risks of the technology relevant to their practice. It links this to the duty to protect confidential information in section 3.3.

To maintain the required level of competence, a lawyer should develop an understanding of, and ability to use, technology relevant to the nature and area of the lawyer's practice and responsibilities.

A lawyer should understand the benefits and risks associated with relevant technology, recognizing the lawyer's duty to protect confidential information set out in section 3.3.

How much technology competence does it expect?

Commentary [4B] says it depends on the practice. It names three factors for whether a technology is reasonably available: the practice areas, where the practice is, and what clients ask for. The commentary names no particular control.

In determining whether technology is reasonably available, consideration should be given to factors including: (a) The lawyer's or law firm's practice areas; (b) The geographic locations of the lawyer's or firm's practice; and (c) The requirements of clients.

What does the confidentiality rule say?

Rule 3.3-1 asks a lawyer to hold in strict confidence all information about the client's business and affairs learned in the professional relationship. The duty runs to the client.

A lawyer at all times shall hold in strict confidence all information concerning the business and affairs of the client acquired in the course of the professional relationship

What can an outside reading show for this rule?

This rule asks for care across the whole firm. An outside reading cannot see your policies, your training, your devices, your access lists or who can sign in to what.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

That is evidence toward the duty, never proof of it. Where the text names no control, we add none for it.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.