Most attorneys are well aware of statutory obligations that
require private and governmental entities to notify individuals of
data breaches that involve the loss or disclosure of personally
identifiable information. An area that may be less clear, however,
is what ethical obligations attorneys have to guard against data
breaches involving client information and what steps attorneys must
take when a data breach occurs.
On October 17, 2018, the American Bar Association Standing
Committee on Ethics and Professional Responsibility issued Formal
Opinion 483. The Opinion addresses attorneys' obligations after
an electronic data breach or cyberattack, including the
applicability of the Model Rules of Professional Conduct when a
data breach is detected or suspected. The Opinion also provides
input regarding best practices in preventing and responding to data
breaches, and emphasizes the importance for attorneys to plan
ahead.
