Formal Opinion No. 2012-184
California Ethics Opinions
ISSUE: May an attorney maintain a virtual law office practice (“VLO”) and still comply with her ethical obligations, if the communications with the client, and storage of and access to all information about the client’s matter, are all conducted solely through the internet using the secure computer servers of a third-party vendor (i.e., “cloud computing”)?
THE STATE BAR OF CALIFORNIA STANDING COMMITTEE ON PROFESSIONAL RESPONSIBILITY AND CONDUCT
DIGEST: As it pertains to the use of technology, the Business and Professions Code and the Rules of Professional Conduct do not impose greater or different duties upon a VLO practitioner operating in the cloud than they do upon an attorney practicing in a traditional law office. While an attorney may maintain a VLO in the cloud where communications with the client, and storage of and access to all information about the client’s matter, are conducted solely via the internet using a third-party’s secure servers, Attorney may be required to take additional steps to confirm that she is fulfilling her ethical obligations due to distinct issues raised by the hypothetical VLO and its operation. Failure of Attorney to comply with all ethical obligations relevant to these issues will preclude the operation of a VLO in the cloud as described herein.
INTERPRETED: Rules 1-100, 1-300, 1-310, 3-100, 3-110, 3-310, 3-400, 3-500, 3-700, and 4-200 of the Rules of Professional Conduct of the State Bar of California.
Business and Professions Code section 6068, subdivisions (e), (m), and (n).
Business and Professions Code sections 6125, 6126, 6127, 6147, and 6148.
California Rules of Court, Rules 3.35-3.37 and 5.70-5.71.
STATEMENT OF FACTS
Attorney, a California licensed solo practitioner with a general law practice, wishes to establish a virtual law office (VLO). Attorney’s target clients are low and moderate-income individuals who have access to the internet, looking for legal assistance in business transactions, family law, and probate law.
In her VLO, Attorney intends to communicate with her clients through a secure internet portal created on her website, and to both store, and access, all information regarding client matters through that portal. The information on the secure internet portal will be password protected and encrypted. Attorney intends to assign a separate password to each client after that client has registered and signed Attorney’s standard engagement letter so that a particular client can access information relating to his or her matter only. Attorney plans not to communicate with her clients by phone, e-mail or in person, but to limit communications solely to the internet portal through a function that allows attorney and client to send communications directly to each other within the internet portal.
Attorney asks whether her contemplated VLO practice would satisfy all applicable ethics rules.
As a result of ever increasing innovations in technology, the world has moved significantly toward internet communications – through email, chats, blogs, social networking sites, and message boards. The legal services industry has not been untouched by these innovations and the use of technology, including the internet, is becoming more common, and even necessary, in the provision of legal services. Consistent with this trend, and with the benefits of convenience, flexibility, and cost reduction, the provision of legal services via a VLO has started to emerge as an increasingly viable vehicle in which to deliver accessible and affordable legal services to the general public.
The VLO, also variously known as Digital Law, Online Law, eLawyering and Lawfirm 2.0, may take many different forms. For the purposes of this opinion, “VLO” shall refer to the delivery of, and payment for,  legal services exclusively, or nearly exclusively, through the law firm’s portal on a website, where all of the processing, communication, software utilization, and computing will be internet-based. In the hypothetical VLO discussed in this opinion, a client’s communication with the law firm, as well as his access to the legal services provided, is supplied by the firm through a secure internet portal provided by a third-party internet-based vendor, accessible by the client with a unique user name and access code specific to the client’s particular matter only. The lawyer and client may not ever physically meet or even speak on a telephone.
The Committee recognizes that although VLOs exist and operate only through the use of relatively new technology, the use of such technology itself is not unique to this VLO; rather, many lawyers operating in traditional non-VLOs utilize some or many aspects of this same technology. The California Business and Professions Code and the Rules of Professional Conduct do not impose greater or different duties upon a VLO practitioner than they do upon a traditional non-VLO practitioner as it pertains to the use of technology. This opinion focuses on issues that the Committee believes are particularly implicated by the VLO’s cloud-based nature described herein, although many of the same issues may arise in any law practice. For a fuller discussion on the analysis that the Committee believes an attorney should undertake when considering use of a particular form of technology, we refer the reader to California State Bar Formal Opinion No. 2010-179.
1. Attorney’s Duty of Confidentiality in Our Hypothetical VLO Is the Same as That of an Attorney in a Traditional Non-VLO, But Requires Some Specific Due Diligence.
A lawyer has a duty to “maintain inviolate the confidence, and at every peril to himself or herself, preserve the secrets of his or her client.” (Bus. & Prof. Code, § 6068(e)(1)). With certain limited exceptions, the client’s confidential information may not be revealed absent the informed written consent of the client. (Rule 3-100(A); Cal. State Bar Formal Opn. No. 2010-179.)
In California State Bar Formal Opinion No. 2010-179, this Committee discussed the ethical confidentiality and competency concerns of a practitioner using technology in providing legal services, and the considerations an attorney should take into account when determining what reasonable steps would be necessary to comply with those obligations. While those obligations are the same for attorneys using technology both in a VLO and a traditional non-VLO,  due to the wholly outsourced internet-based nature of our hypothetical VLO, special considerations are implicated which require specific due diligence on the part of our VLO practitioner.
This is because even though...