♫ It’s coming down, it’s coming down, it’s coming down
These clouds could never hope to save us…♫
Lyrics, music and recorded by Thrice.
On Nov. 17, 2014 Jack Newton posted on Slaw: “Did the LSBC Just Kill Cloud Computing for Lawyers in BC?”
To set the record straight, the death of cloud computing for BC lawyers has been greatly exaggerated. In fact, quite the opposite is true. Cloud computing for BC lawyers is alive and well. What the Benchers have recently done is adopt rule changes based on the report and recommendations of the Cloud Computing Working Group.
The amendments address three areas:
- the requirements for electronic data storage and processing;
- producing records in a complaint investigation or forensic audit; and
- third-party storage providers and security.
While these rule changes (principally 10-4 and 10-5 of the Law Society Rules ) permit the Executive Committee, by resolution to declare that a specific entity is not a ‘permitted storage provider’ for the purposes of compliance with this rule, no such entity has been so declared.
Accordingly, I would like to deal with the following questions and issues that have been raised concerning the use of cloud computing resources by BC lawyers:
Q: Is the Law Society of BC against the use of Cloud Computing by Lawyers?
A: The Law Society of BC Benchers have just recently adopted rule changes that were created to give effect to the recommendations in the Cloud Computing Working Group Report (January 2012). To the writer’s understanding, this Report represents one of the leading examinations of the use of cloud computing resources by lawyers by any regulator. Lawyers in BC who wish to use cloud computing resources are referred to the Cloud Computing Checklist for specific guidance of the issues that should be considered before moving data to the cloud. To the writer’s knowledge this Checklist is a leading document and represents one of the first comprehensive overviews of the issues for a lawyer to consider before moving client data into the Cloud. The Report, Recommendations and Checklist highlight that The Law Society of BC has and continues to provide thoughtful leadership to the lawyers of BC on the adoption of new technologies.
Q: What guidance is there for BC lawyers looking to use Cloud Computing?
A: The Cloud Computing Report supports the idea that the Law Society regulates lawyers, not technology. It is up to the lawyer to determine whether it is appropriate to use any particular technology in the circumstances, recognizing that the professional responsibilities of a lawyer will continue. This places cloud computing on an equal basis with regard to a lawyer’s use of services such as: bookkeeping, accounting software, IT consultants or any other provider of services to a lawyer or law firm. As such, the Law Society expects lawyers to engage in due diligence when using any service provider that handles, stores or processes client records, whether those records are in paper form or electronic. The Cloud Computing Checklist is designed to provide a list of considerations for a lawyer contemplating moving data to the cloud. Lastly the Practice Advice Department at the Law Society is available to discuss a lawyer’s use of cloud computing.
Q: Are BC Lawyers prohibited from using US-based Cloud Computing Providers?
A: There is no prohibition against using services in which servers are located outside Canada. However, the lawyer must ensure use of the service complies with any legal limitations on where the records can be stored. Consider, for example, s. 30.1 of the Freedom of Information and Protection of Privacy Act, RSBC 1996, Chapter 165. If the lawyer acts for clients who are prevented from storing data outside of Canada, this will be a very important consideration when thinking about the law firm’s use of cloud resources. The Checklist and the report highlight that lawyers’ obligations to preserve and protect privilege and confidentiality do not disappear; accordingly the checklist provides questions to consider when choosing a service so the lawyer can be satisfied the client’s information is protected. A lawyer should disclose to their clients that they use cloud computing resources and that the client’s data may be stored outside of Canada, preferably by incorporating this into the law firm’s retainer agreement. In the writer’s view, informed client consent is an integral part of responsibly using cloud computing resources by a law firm.
Q: Does the Law Society prohibit the use of non-BC based cloud computing providers such as Google or Dropbox by lawyers?
A: The Law Society neither endorses nor rejects the use of specific products. However, if the Law Society discovers during the course of exercising its regulatory function that lawyers who use certain services are unable to comply with the rules for disclosing records, either because the service provider refuses to assist with the regulatory disclosure or is incapable of providing the records, the Law Society can disapprove the use of that service for lawyers. But at this time, no cloud provider is so prohibited by the Law Society.
Q: What has changed in BC regarding cloud-based computing?
A: In my view, the changes that the Benchers have made to the Law Society Rules are in respect to the regulatory work that the Law Society is mandated to perform on behalf of acting in the public interest and how storing data in the cloud may impact that work.
For example, a lawyer who is required under Rule 3-5 [Investigation of complaints] or 4-43 [Investigation of books and accounts] to produce and permit the copying of files, documents and other records, provide information or attend an interview and answer questions and who fails or refuses to do so is suspended until he or she has complied with the requirement to the satisfaction of the Executive Director (See more at: http://www.lawsociety.bc.ca/page.cfm?cid=982&t=Law-Society-Rules-Part-3-Protection-of-the-Public#3-5-01).
The Law Society must have access to the files, documents and other records of a lawyer under investigation. If those files, documents and other records are stored, either in paper form or electronically, in a way that prevents the Law Society from gaining access to those files, then the rules envision a process by which lawyers who are unable to provide such requested records can be suspended until able to do so.
In particular, Rule 10-4 (4) contains provisions that a lawyer needs to consider when using any cloud provider. They are:
(4) A lawyer must not maintain records, including electronic records, with a storage provider unless the lawyer
(a) retains custody and control of the records,
(b) ensures that ownership of the records does not pass to another party,
(c) is capable of complying with a demand under the Act or these Rules to produce the records and provide access to them,
(d) ensures that the storage provider maintains the records securely without
(i) accessing or copying them except as is necessary to provide the service obtained by the lawyer,
(ii) allowing unauthorized access to or copying or acquisition of the records, or
(iii) failing to destroy the records completely and permanently on instructions from the lawyer, and
(e) enters into a written agreement with the storage provider that is consistent with the lawyer’s obligations under the Act and these Rules.
These are new provisions but the concepts are not new. No lawyer would store records – paper or electronic – with a provider that accessed them or copied them except as necessary to provide the service to the lawyer. No provider would be permitted to gain unauthorized access to the lawyer’s records whether they are in paper or electronic form. Furthermore, when a lawyer destroys records he or she needs to know that these records have been completely and permanently destroyed – regardless if these records are in paper form or electronic. What the Benchers have done is made it clear that these responsibilities apply when records are stored with a cloud provider and that the lawyer must comply with them.
The Law Society has simply updated their Rules to incorporate the potential use of cloud computing by lawyers and the requirement for the Law Society to have access to the records of the lawyer should the need arise, no matter where those records may be stored. Furthermore, the Law Society has confirmed that a lawyer’s responsibilities apply equally no matter how a lawyer chooses to store their records, whether in paper or electronic form.
The LSBC’s cloud computing checklist is designed to ensure lawyers turn their minds to the ability to comply with audits and investigations by the Law Society, while using technology.
Any questions on the use of cloud computing resources by BC lawyers can be directed to the writer at the Practice Advice Department at the Law Society.
With respect, the writer submits that BC lawyers’ use of cloud computing resources has not in fact come down and that indeed, these clouds can in fact save us a great deal of time, energy and resources.
(The writer gratefully acknowledges the assistance of Doug Munro, staff lawyer at the Law Society of British Columbia who, along with the writer, are the authors of BC’s Cloud Computing Checklist, based on the ground-breaking work of the Bencher’s Cloud Computing Working Group.)