Legal Research

Computing in the Cloud: A Warning for Lawyers

By James Kosa

Cloud computing is a new and fascinating set of technologies that is changing the way the world does business. Is the legal profession ready for it?  

Cloud computing is the generic term used to describe a variety of technologies that transfers the responsibility for a computing activity (storage or processing) from a local computer to a network of remote computers. The remote computers are generally operated by one or more third parties. The principal benefit of cloud computing is cost. By using the cloud, a business can reduce the amount of money it spends on procuring and maintaining its own IT infrastructure, and instead pay usage fees to the cloud provider based on the business’s usage of computing resources. 

Cloud computing is an increasingly successful technology model, and will become quite prevalent in the coming years. Merrill Lynch sees the cloud business reaching $160 billion by 2011 (which is perhaps a bit optimistic, given the recent market troubles caused by the European credit crisis), and Gartner predicts $150 billion by 2013. Given that the cloud business was worth $50 billion in 2009, these numbers represent significant growth worldwide. Whether we are aware of it or not, much of our daily computing (email, banking, etc.) may move from dedicated servers to a cloud environment over the next few years. Google Docs, including Gmail email accounts, which are used by millions of businesses and people worldwide, are already hosted in Google’s cloud. 

Lawyers could use cloud computing in a number of different ways, the simplest example being for document storage. Documents stored in the cloud could be accessible by lawyers and clients from anywhere, and could be selectively shared with other parties to facilitate negotiations or litigation. 

However, cloud computing has its drawbacks. The two biggest concerns are privacy and security, both of which warrant particular attention of lawyers. Using a cloud computing service entails in almost every instance a disclosure of personal or confidential information to a third party. The disclosure itself may be prohibited by privacy laws and the rules of professional conduct applicable in a lawyer’s jurisdiction. 

A lawyer may only disclose a client’s information to a third party under very limited circumstances. The standards for privacy and client confidentiality are different. Under federal privacy laws, a lawyer may disclose personal information of an individual to a third party so long as the lawyer obtains the individual’s consent, and the third party is contractually bound to at least the minimum privacy standards as those promised by the lawyer to the individual, which are strict in the first place. 

The standard governing client confidentiality is similarly strict under the Rules of Professional Conduct that govern Ontario lawyers. The lawyer must keep information in strict confidence and not disclose it without the express or implied consent of the client. Implied consent may be presumed in some limited circumstances. For example, if a client communicates confidential information with a lawyer by email, the lawyer can reasonably infer that the client has consented to the lawyer responding in the same manner, even though the transmission of an email is demonstrably not secure. 

A lawyer cannot presume consent with cloud computing. Cloud computing is a new technology, the uses and vulnerabilities of which are still being explored. It would be completely unreasonable for a lawyer to infer consent for the use of document storage in a cloud, for example, unless the client had an extraordinary background in cloud computing. Even then, a lawyer may still be in breach of his or her obligation to keep a client’s information in strict confidence because most cloud computing technologies cannot yet be considered secure. A lawyer should tread carefully here. 

The cloud computing community is well aware of the drawbacks of this emerging technology, and is working hard to address them. Before long, there will be ways to make the cloud secure enough for our client’s confidential information. When that time is upon us, the cloud will be ready for the legal profession. 

Some resources on the topic:

Gellman, Robert. “Privacy in the Clouds: Risks to Privacy and Confidentiality from Cloud Computing“  World Privacy Forum

Cohen, Reuven. “The Cloud Computing Opportunity by the Numbers” from the blog ElasticVapor

Full post as published by Slaw.ca on June 14, 2010 (boomark / email).