Cloud computing raises numerous ethical issues that can confound and confuse even the most sophisticated lawyer. A new report by the Small Firm Committee of the New York City Bar Association discusses the practical, economic and ethical implications of using the cloud. A section of the report contains a round-up of the various ethics issues that lawyers should consider before using the cloud. The main thrust of the report is that lawyers must take reasonable steps when using cloud services to ensure that they comply with their ethical obligations, including the duties of confidentiality, competence, supervision, communication, and record-keeping. In addition, the report contains a number of suggested guidelines, including:
- Use reliable and established cloud providers
- Perform your own due diligence on cloud providers
- Review provider contracts
- Focus on key contractual terms, such as ownership of data, back-up practices, data storage, locations, access to data, security, breach notifications, subpoena notices, and more
- Get client consent, where appropriate
- Understand the technology to the extent reasonable
- Ensure that data stored in the the cloud is encrypted
- Establish data management policies and procedures
The ultimate conclusion is that cloud computing is ethically permissible, but lawyers must exercise reasonable care when using the cloud.