Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 11 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Silicon Valley

Washington, D.C.

<img style="max-width: 100%;height: auto;max-width: 100%;height: auto" loading="lazy" class="alignright size-medium wp-image-4120" src="https://www.thelawforlawyerstoday.com/wp-content/uploads/sites/754/2018/10/Computer-secrecy-300x200.jpg" alt="" width="300" height="200">Some answers are so obvious that you are left wondering why the question needed to be asked in the first place. Like &ldquo;should a client pay a fee it agreed to in advance?&rdquo;&nbsp; Or, &ldquo;should an attorney try his or her best to prevail?&rdquo;
And now this:&nbsp; the ABA&rsquo;s Standing Committee on Ethics and Professional Responsibility issued an <a href="http://filehost.thompsonhine.com/uploads/aba_formal_op_483_1c56.pdf">advisory opinion</a> earlier this month instructing lawyers who suffer a data breach that exposes &ldquo;material client information&rdquo; to notify clients of the breach and take additional measures to protect the confidentiality of the compromised information.&nbsp;&nbsp;Obvious?&nbsp; We think so.
When we advise clients about their data protection obligations, we often suggest that compliance is strengthened when data security strategies align with an organization&rsquo;s culture. For law firms, this should be relatively easy:&nbsp; lawyers learn (we hope in law school) that they have an ethical obligation under <a href="https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/">Model Rule 1.6</a> to preserve the confidentiality of their clients&rsquo; information.&nbsp; In today&rsquo;s world, that surely means that the lawyer and her firm should take appropriate measures to protect the information from cyber thieves and other threats to the security and confidentiality of a client&rsquo;s confidential information.
Likewise, our duty of communication (<a href="https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_4_communications/">Model Rule 1.4</a>), coupled with our confidentiality obligations, should make it a no-brainer that when a breach occurs, the affected clients should be told.
Nevertheless, in its Formal Opinion 483 the Committee devotes 16 pages to state and support this conclusion. (Interestingly, the Committee primarily relies on rules dealing with <a href="https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/">competent representation</a> and <a href="https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/comment_on_rule_1_1/">technological aptitude</a>, and only secondarily refers to the duty of confidentiality.)&nbsp; The opinion does contain instruction that, while hardly novel or visionary, provides sound advice:
<ul>
<li>A firm should implement technological and other measures to detect intrusions into its data systems;</li>
<li>A firm should develop, implement and test a data incident response plan. As we&rsquo;re fond of saying, the time for a pilot to learn how to deal with catastrophic engine failure is not when the plane is hurtling to the ground from 30,000 feet.</li>
<li>The firm should promptly take measures to restore the affected systems and close the breach. (Don&rsquo;t just stand by and do nothing!)</li>
<li>The firm should, alone or in concert with skilled cyber forensics professionals, determine how and why the breach occurred. (Again, don&rsquo;t just scratch your head.)</li>
<li>The firm should notify current clients whose data are compromised. Oddly, the Committee stated that it is &ldquo;unwilling&rdquo; to impose that obligation with regard to former clients.</li>
<li>The opinion provides guidance on what the client notification should contain. Importantly, the opinion reminds lawyers that they may have additional notification obligations under federal and state data breach notification laws that apply, yes, even to lawyers.</li>
</ul>
&nbsp;
Opinion 483 provides useful, if obvious, direction on our duties in response to a data breach. It hardly lays out a truly comprehensive set of best practices for safeguarding client information, but it does point in the right direction.

Well d’uh: ABA advises lawyers to notify clients of a data breach

Services