How to Protect Attorney-Client Privilege When Using Technology

The Technology Competence Duty

In 2012, the ABA amended Comment 8 to Model Rule 1.1 to include technology competence: lawyers must "keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology." Over 40 states have adopted this language. You have an ethical duty to understand the tools you use.

How Cloud Tools Create Privilege Risk

When you dictate client notes using a cloud-based service, your audio is transmitted to third-party servers for processing. This creates several privilege concerns:

• Third-party access. The cloud provider's employees may access your data for quality assurance, training, or debugging.
• Subpoena vulnerability. Data on third-party servers can be subpoenaed — and the provider may not even notify you.
• Breach exposure. Cloud services are high-value targets. A breach at your dictation provider exposes every client's data you've ever dictated.
• Metadata leakage. Even encrypted audio reveals when and how long you dictated — which can disclose the existence of a representation.

State Bar Ethics Opinions on Cloud Computing

Multiple state bars have issued ethics opinions on cloud-based legal tools. The consensus: lawyers may use cloud tools, but must exercise due diligence — understand the provider's security, data handling, and breach notification practices. Many opinions specifically note that the safest approach is tools that don't transmit client data at all.

Best Practices for Technology and Privilege

1. Prefer on-device processing. If a tool can work locally, choose that over cloud processing for client matters. VoicePrivate — Legal Edition processes 100% on-device.
2. Review vendor security practices. If you must use cloud tools, review their SOC 2 compliance, encryption, and data retention policies.
3. Use strong encryption. Ensure data is encrypted in transit and at rest. AES-256 is the current standard.
4. Minimize data exposure. Don't dictate client names or case numbers into tools that upload to the cloud. Use reference numbers instead.
5. Document your diligence. Keep records of your technology review process to demonstrate compliance with the competence duty.