eLawyering Blog

North Carolina Bar Regulates Legal Cloud Computing

Legal Cloud ComputingA  proposed Ethics Opinion of the North Carolina Bar  that provides guidelines for attorneys using cloud computing services, commonly known as SaaS (Software as a Service),  contains language that is troubling because of its potential impact on solos and small law firm practitioners who are creating virtual law practices. The Bar is soliciting comments prior to making the Opinion final. Here are some comments for consideration.

The Opinion states that to comply with the attorney's duty to keep client data confidential there should be:

"a separate agreement that states that the employees at the vendor’s data center are agents of the law firm and have a fiduciary responsibility to protect confidential client information and client property."


DirectLaw is a SaaS vendor that hosts law firm data at a Tier IV Data Center that implements the security controls that a bank or major financial institution uses.  The idea that our data center would enter into an agreement that would make its employees agents of a law firm is not realistic. There is not sufficient consideration to expose the Data Center to this kind of liability, and there is no way that they would modify their terms and conditions to meet the needs of a single SaaS vendor. I doubt that counsel for the Data Center would ever approve such language. The Data Center would just tell us to take our business elsewhere. Amending the contract terms just for SaaS vendors that service the legal industry is not likely to happen.

There are other approaches to providing assurance to law firms that client confidential data is secure and less burdensome.

I think a better guideline would be to suggest or require that SaaS vendors host their data at a data center that is a Tier IV Data Center.  A Tier 4  Data Center is one which has the most stringent level requirements and one which is designed to host mission critical computer systems, with fully redundant subsystems and compartmentalized security zones controlled by biometric access controls methods. The Data Center should also be SAS 70 certified. The Data Center should also have PCI DSS certification if credit card data is stored within the Data Center. With these safeguards in place,  a law firm should be  considered to have undertaken reasonable due diligence to satisfy the obligation to insure that client data will remain confidential.

There are other problems with the North Carolina opinion. Another guideline:

"requires the attorney to undertake a financial investigation of the SaaS vendor: to determine its financial stability."

What does that mean? I am not about to divulge our private financial statements to just any lawyer who inquires. How is it relevant? If there are provisions for data capture and downloading data that is stored in the cloud, and the law firm has access to that data, what difference does it make if the SaaS actually goes out of business?

It would make more sense to simply require that a SaaS vendor carry Internet liability insurance for the benefit of its law firm clients. Law firms will have problems securing Internet Liability Insurance to cover data loss. Data loss as a result of a Data Center outage is not normally covered under a law firm's malpractice policy. For solos and small law firm's securing this kind of coverage would be a burden and cost prohibitive. It makes more sense to require the SaaS vendor to secure such coverage and make its law firm subscribers a beneficiary of the coverage.

Another guideline states that:

"The law firm, or a security professional, has reviewed copies of the SaaS vendor’s security audits and found them satisfactory."

How much does such an audit cost? Can solo practitioners afford such an audit? Who qualifies as a security professional? I think this requirement will act as deterrent to solos and small law firms who are seeking cloud-based solutions that they can use in their practice. I think that a less costly and more effective solution would be for an independent organization to issue a Certificate of Compliance to the SaaS vendor indicating that the SaaS vendors has satisfied or complied with well recognized standards. Like the Truste Certificate in the privacy area, this would give solos and small law firms this would provide stamp of approval that minimum standards have been satisfied. This would move the cost burden of undertaking due diligence to the SaaS vendor, rather than to the solo or small law firm practitioner.

Another guideline states:

"Clients with access to shared documents are aware of the confidentiality risks of showing the information to others. See 2008 FEO 5."

This guideline should be clarified because it is not clear what "shared documents" means. This kind of statement is likely to scare clients into thinking that a law firm that stores client data on the the Internet is putting the client's data at more risk than storing the data in a file cabinet in the lawyer's office.

As the American Bar American,  through its Ethics 20/20 Commission, and state bar associations adapt ethical rules to deal with the delivery of legal services over the Internet, it is important to consider that the burden of compliance may have a different impact on solos and small law firms, than on large law firms. The rules should not act as a barrier to solos and small law firms exploring new ways of delivering legal services online which are cost effective for both the law firms and their clients.

For a similar point of view see Stephanie Kimbro's blog post on the same topic.

Disclosure: DirectLaw is a SaaS vendor that provides a virtual law firm platform to solos and small law firms.

Trackbacks (0) Links to blogs that reference this article Trackback URL
Comments (3) Read through and enter the discussion with the form at the end
Roger Glovsky - June 6, 2011 11:29 PM

It does not make sense that cloud vendors should be subject to special rules for attorney-client information. This issue should be addressed by the data privacy laws in general. Is protection of credit cards bank information different from attorney-client information? The states are already dealing with data privacy issues, which the cloud vendors will have to adhere to in the future. Massachusetts is one state that recently enacted data privacy laws that address third party SaaS providers in a more reason way.

Jeramie Fortenberry - June 7, 2011 5:28 PM

I posted on my blog this morning about how Florida is struggling to squeeze modern law practice into an outmoded paradigm. This is yet another example of the profound failure of state bar associations to recognize how fundamentally technology has changed(and will change) the practice of law.

So much of this sort of thing springs from ignorance and myopia. My hope is that the ABA 20/20 Commission will take a clear-eyed approach and re-think these unnecessary restrictions from the ground up. If solid, realistic solutions can be proposed, the state bar associations may follow suit.

frank rivera CEO HoudiniESQ - September 2, 2011 10:20 AM

I find this article and the many blogs pertaining to the NC Bar's opinion in Cloud computing to be misleading and very attorney biased.

As the largest legal SaaS vendor in the industry bar none I can tell you that the NC Bar's opinion is right on the money. If you as an attorney DO NOT know where you are storing your client's data at any given moment then you are being irresponsible.

As a client this is my opinion. If you decide to use a SaaS service in your law firm you better verify that my data is in secure hands and that my data will not be leaked or destroyed. You better know where exactly my data is at all times and if I want it removed from the cloud service you better have a way to do it, otherwise as "my attorney" you and I will have a serious problem.

I trust that none of you want to be the "SaaS & Bad Ethics" poster child when your client files a dozen ethics complaints against you because you stored their data on a cloud service that you had virtually no idea how it handles stored data.

You need to all STOP looking at this from the point of view of what is convenient for you but what is ethically the right thing to do when your client entrust you with there information. All good Cloud vendors provide a way to state where exactly (geographically) data will be stored. IF they don't then find another vendor. It is as simple as that.

Frank Rivera CEO HoudiniESQ

Published by Richard S. Granat
Sponsored by DirectLaw, Inc.
6231 PGA Blvd | Suite 104-170 | Palm Beach Gardens, FL 33418
Phone: 561-622-9971 | 888 - 592- 9907 | Email: rich [ a ] granat.com