What precautions are lawyers obligated to take with digital communication security? Given that various email providers have different levels of access to email, and that it shouldn't be considered private communication unless further encrypted, what steps do lawyers need to take to protect client's confidentiality? This question is also merited for things such as text and phone conversations as those conversations could fall under the same sort of arena. Are lawyers only required to inform clients that email, text, phone is unsafe communication with risks? Or are they in some cases risking a breach of client confidentiality even if they do?
What steps do lawyers need to take to protect client's confidentiality? Reasonable steps Are lawyers only required to inform clients that email, text, phone is unsafe communication with risks? Yes. Sort of. It's not a problem that these channels are unsafe, it's just the risk part. As was stated, US mail carries risk. Or are they in some cases risking a breach of client confidentiality even if they do? If they do... what? inform clients of risks? It is up to the lawyer to inform the client of the danger of using email. Certain cases warrant more precaution than others. The lawyer will need to weigh all of this. It is also possible that a heightened level of security makes communication too cumbersome or expensive. What if the client does not want to pay for the extra time it takes you to encrypt/decrypt? What if the client cannot figure out the software? No matter how sloppy the client is, it is incumbent upon the lawyer to protect communication. It's ABA Model Rule of Professional Conduct 1.6(a) that explains this for us. A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent... continuing to paragraph (c): (c) A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. Comment 18 in part (relating to safeguarding information): unauthorized access...does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure. continuing: Factors to be considered in determining the reasonableness of the lawyer’s efforts include, but are not limited to, the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use). Comment 19 in part: *When transmitting a communication that includes information relating to the representation of a client, the lawyer must take reasonable precautions to prevent the information from coming into the hands of unintended recipients. This duty, however, does not require that the lawyer use special security measures if the method of communication affords a reasonable expectation of privacy. Special circumstances, however, may warrant special precautions. Factors to be considered in determining the reasonableness of the lawyer's expectation of confidentiality include the sensitivity of the information and the extent to which the privacy of the communication is protected by law or by a confidentiality agreement. Both instances require reasonable efforts - those an ordinary person would use. ABA Formal Opinion 1-459 tells us that A lawyer sending or receiving substantive communications with a client via e-mail or other electronic means ordinarily must warn the client about the risk of sending or receiving electronic communications using a computer or other device, or e-mail account, where there is a significant risk that a third party may gain access. This comment pertains to specific situations, like a client emailing a lawyer from the client's work-computer. It does not specifically apply to hacker-threat. And to muddy all of this up, it's not only communication and information that is at risk. Property is also at risk and the duty to protect property is higher than the duty over communication. Secret recipes, customer lists, strategic plans - these are all forms of property and lawyers have special duties to safeguard client property. Comment (1) to Rule 1.15 says that a lawyer should hold property of others with the care required of a professional fiduciary. This is higher than the reasonableness requirement for protecting information. The fiduciary duty is the highest standard of care recognized by our legal system (the California rule calls on the lawyer to protect client secrets “at every peril to himself or herself” Cal. Rules of Prof. Conduct R. 3-100(A) (2013); see also Cal. Bus. &amp; Prof. Code §6068(e)(1) (2013)).
We're missing a lot of information that we'd need to offer a full answer. Here are some of the things that will probably drive the analysis: the type of counselor we're talking about; the types of information the counselor disclosed; the reason she disclosed it; the job functions of the people to whom she disclosed it; the reason the client is bothered by the disclosure. Generally speaking, a mental-health counselor has a fiduciary duty to maintain the confidentiality of patient information, but my understanding is that in most cases, the counselor would be allowed to discuss a case with colleagues for the purposes of advancing the patient's treatment. So discussing the facts of a tough case with a supervisor is not going to be as problematic as idly gossiping about clients with custodial staff. Beyond the permitted disclosures, there are also situations in which counselors are required to disclose confidential information, including cases where the counselor suspects child or elder abuse or where the counselor believes the client poses a danger to herself or others. If the disclosure was truly not permitted, then it may be that the client has a claim for breach of fiduciary duty. In Georgia, proving that case requires evidence that: That the counselor had information relating to the client that she knew or should have known was confidential; That the counselor communicated the client’s confidential information to third parties; That the client did not give informed consent to the counselor’s conduct; That the confidential information was not a matter of general knowledge; and That the disclosure harmed the client. As you noted, the client could also file a complaint with the state licensing board. I don't know of any federal laws or regulations that would come into play in the situation you've described.
Under 45 CFR 164.402 a "breach" is the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. Disclosing PHI to random people is not permitted under subpart E. Then then allow that it can be deemed to not be a breach if they can "demonstrate[] that there is a low probability that the protected health information has been compromised based on a risk assessment of certain factors – there isn't any clear yes/no rule as to how you could say that disclosing PHI is not a breach. If they discover a breach, they must notify the affected individual. One ploy would be for them to stick their heads in the sand and be careful to not discover: but §164.404(2) says A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity So if, for example, they had been told that person X has moved, a reasonably diligent person would know that sending PHI to the old address will result in a breach. The Sec'y of HHS must also be notified of the breach, though this can go in the annual report if the breach involves fewer than 500 people. The affected individual can also file a complaint with HHS.
Based solely on what you've described, what the lawyer did is inappropriate if, in fact, it occurred without any prior permissions. However, since you are not the actual client, it may be that you lack pertinent info, because this would be exceedingly rare behavior. Lawyers are allowed to make procedural and "expert"/professional decisions about your case without your consent, and do so all the time. As a general rule: we decide who to depose, what expert(s) are necessary to prove your claim, what questions to ask in discovery, what to say and when to say it when attempting to settle, and what witnesses to call vs. not to call at panel or trial. All of that is in the purview of the attorney's general discretion and work product. However, attorneys cannot diminish, amend, or settle your claim without your permission, unless you've signed a limited representation agreement and/or a prior authorization to do these things with a waiver of consultation on issues relating to settlement. (It is not uncommon for a client to say, "My bottom line is X; hence, you have my permission to settle the case for anything over that amount.") A client may also, subsequently, give verbal consent, saying things like "just do your best and get what you can". Contingency and Total Award Strategies Since you aren't the one having entered into the contract, you may not be privy to the existence of these types of contingencies. Agreements like this are very common when an attorney takes a weaker med mal claim. It may be that the lawyer will only take the case to the extent that they will try to settle, and may even file the case, with the understanding that they will never try the case. It is a way to try to get you as much as possible when all facts come to light, without agreeing to the expense of a trial. This happens a lot. In these situations, when you are trying to settle a claim that ends up being much less valuable than the attorney thought when he took the case, the insurance carrier will often say, "We will pay X on the claim if Doctor Doe is dismissed out," or something like that. Often lawyers intentionally over-file, in hopes there are two carriers (the more insurance the more money to make you go away) that they can try to settle with. When it turns out both docs are covered under one insurance carrier, then the weaker claim will often get dismissed out. It is a strategic decision to add them, and to dismiss them &ndash; and this is very common. Proving malpractice against one doctor is hard enough; trying to prove that you are the victim of double malpractice, back to back, is nearly impossible. All of that said, even if a client has entered into these types of limited or decisional authority-granting agreements, the lawyer still has a duty to keep the client apprised of what's going on. The client may decide later they don't like how little the attorney is stating the claim is worth (despite being forewarned this may happen, it happens all the time that when it actually occurs the client is not happy). In that case, they have the right to find a new lawyer, but that will be very difficult to do for a few reasons: (1) the original attorney is entitled to get paid for the work done under a theory known as “quantum meruit,” so other attorneys will be hesitant to get involved; (2) they will put a lien on any recovery for the amount of time and expenses, to be paid from any settlements or awards (and they get paid first, before the client or the new lawyer); (3) if a client gets angry and says they want to just drop the case rather than have the lawyer make more than the client, even after a year or more of work, all of the costs will still be owed by the client; (4) the potential new attorney will call the one who has the case and ask about whether the client has unreasonable expectations, if their case has any value, etc. Keep mind, if an attorney is doing the things you've described, they probably would suffer no love loss if the case went away. Malpractice in Context It very often happens, especially in medical malpractice cases, that a client will come in and describe the case one way, and then when the medical records arrive and the attorney and/or the paralegal/nurse-para review them, and all the facts get flushed out, it turns out things occurred a bit (or a lot) differently than the client described or recalled in the first place. This is typically not a matter, 99% of the time, of the client lying to the attorney, but rather it is merely the phenomenon of memories being based on their perception of the events/their care, rather than verifiable fact and established medical standards. (This is why eye-witness testimony is so notably unreliable: 10 people can witness the same event and there will inevitably be 10 different descriptions.) One thing all clients should be told by their lawyer (and you should only hire an experienced medical malpractice lawyer for these cases) is that bad outcomes do not equal negligence. Lay people often think that if something bad occurred while under the care of a doctor, this is the case, but it is not the measure of malpractice. Sometimes, even when the doctor does everything according to their specialty/industry standard, bad outcomes happen. Malpractice/negligence only occurs when they have deviated from this standard of care - outcome notwithstanding. The inverse is also true, when it comes to a bad outcome. The doctor may have breached the standard of care, but this cannot be determined by the patient - the law requires expert testimony to establish this. Sometimes bad outcomes are just the risk of the procedure. This is why patients sign (but rarely read) the informed consent forms, that describe in detail, and state the patient is aware, of all the potential bad outcomes that may occur during the procedure. Negligence, or a "breach of the standard of care" occurs when the typical physician (not the best expert in the world, just the normal, typical doctor in that field) would have found the actions to be unreasonable and never acceptable given the totality of the circumstances. Once you prove that, you then still need to prove that is what caused your damages (not the disease, or the ailment itself). Unfortunately, even with the best physicians, bad outcomes happen all the time. It is very common, to the point of being almost predictable, that a medical malpractice claim's value will depart from the original ballpark estimate of value that an attorney tries to "best guess" at the outset. When your attorney tries to value a case, they roughly estimate your "special damages", which consists of medical bills, lost income, lost earning capacity, and other quantifiable sums. Then, they must try to assess the market rate award for pain and suffering for the type injury you've sustained. This is only guesswork, based on jury verdict reports, reported settlements, and the jurisdictional leanings toward large or small verdicts (comparatively). As the case evolves, as facts come to lights, as experts are consulted - this is when these estimates can largely deviate from the original guesstimate based on very limited information. Risks of Contingency Representation At any rate, when a lawyer takes a case on contingency (when they agreed to get paid only if they recover, and not until they recover, aside from out of pocket expenses), they do this because they've relied on the client's account of what happened, as well as their initial assessment of the records, usually prior to hiring an expert (if they even intended to hire one because they agreed to take the case all the way through trial). You must understand that attorneys don't like when a case loses value any more than the client; in fact, probably less as they are the ones who've invested often hundreds of hours in the case at that point. This is how they make their money. Thirty-three percent of a small amount is not the same as that of a large amount. And many, many hours go into these cases. An attorney can make far more than their hourly rate on a great case, but this is balanced by making far, far less on cases whose values plummet as facts come to light. When a case appears to lost much of it's initially estimated value, the attorney will still try to maximize recovery; however, it may not seem that way to the client because after they take their third, and then recoup their expenses (which is on top of the third and is the responsibility of the client win-or-lose), clients can end up with almost nothing. This is because the expense of these cases is enormous and it is the problem with that area of law and the system in general. It is not uncommon for a medical malpractice case to cost, out of pocket, $200,000 or more! This is why so few people are able to get a lawyer to take these cases, and often when they do, it's on the very limited basis I described. Med Malpractice Primer Med Mal cases are some of the hardest cases to win and they are by far some of the most expensive cases to try. This in not accidental. Depending on the state you live in, tort reform (a legislative effort to limit the amount of medical malpractice claims filed and tried overall, as well as limiting their total recovery) can range from limits on damages, to very short windows for statute of limitations, to the requirements (like where I practice) where you must literally try the case twice &ndash; once before a med mal screening panel, who hears all your witnesses just as a jury does, and then decides whether the case should (and in some cases can) go forward. In some states (I happen to practice in one) the findings are admissible in court (not the evidence but the finding). So, if the MMPT screening panel finds the doctor was not negligent, or was, but the damages were within the standard disclosed potential outcomes, so there was no causation, or myriad other things, if you decide (or in some states, if you even still get to go to court) the defense gets to say to the jury that the legislatively enacted Med Mal Pre-trial screening panel found X (no negligence, causation, or damages &ndash; or all three). These panels are usually comprised of a lawyer (75% defense lawyers) or a judge, and two doctors who are biased against these types of cases in the first place). Also, if your expert gets torn apart on an issue during panel phase, anything they admit can be used against them in the trial. I say all this to help you understand that these cases are made, by the legislature, to be very hard to even find a lawyer to take, very hard to win, and exceedingly expensive to litigate. This is based on the (fallacious) theory that medical malpractice claims should be limited to the most serious claims because this litigation is so costly, and so impactful on the rates all citizens pay for insurance, that the legislature has seen fit to make them very difficult to prosecute, thereby weeding out weak claims. Bottom Line If the client truly feels their lawyer did something they did not have permission (either explicitly in writing, or verbally) to do, they need to talk to the attorney, explain their discomfort with the situation, and figure out why it occurred and if it was truly in the best interest of the case and the client. If the lawyer cannot adequately answer those questions, they should get a second opinion. The client can demand that anything the attorney did be undone, if it was the type of thing that is in the client's control. One would need to see the engagement letter and retention agreement, and also be privy to the conversations. It is, unfortunately, not uncommon for a client to say they understand what the lawyer is proposing when they don't. If you find that's the case, you may have them ask that all determinations be put in writing, with an explanation as to why.
This very much depends on where you are. Different jurisdictions have wildly different laws about this. Some places are very permissive. You can record a conversation that you aren't even a party to so long as nobody has any reasonable expectation of privacy. In others, affirmative consent is required from every party to a conversation before it's legal to record it. The laws run the entire spectrum. Some places allow you to record anything you're a party to without permission, but you can't record others' conversations. Some places require you to disclose, but not obtain explicit permission. Some allow you to record but restrict who you can disclose it to. Some allow you to record or ban recording only under certain circumstances. It's a really wide gamut of laws. Since you don't say where you are, who you're recording, or why, there's no way to really answer the question. Here's a good rundown on the United States. This Wikipedia article covers lots of different countries, but only with regard to phone calls.
You're misreading the law. You need to keep reading the section you referenced (emphasis added): The disclosure...shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with the business Thus, the option to have the disclosure sent by mail only applies to consumers who do not have an account with the business. Since presumably a large number of sites only maintain personal information for users with accounts, such sites need not provide a mail option. Further, it doesn't say there needs to be a button: you just need the ability to say you'd like it mailed to you in the request somehow, and then they need to comply when you do.
In the U.S. there is no law that requires you to ever say a word to a law enforcement officer, and lawyers generally encourage you to minimize what you communicate to them anyway. I can't think of any situation where a request for information could not be demanded in writing. As a practical matter, in some situations you will probably be subject to some extra scrutiny and inconvenience: E.g., in a stop-and-identify situation, you could hand the officer a note saying, "Please make any requests for information from me in writing." The officer may infer that you have some disability, but if he does not (or discovers you don't) he may get irritated enough to subject you to harassment for "contempt of cop". Of course, if you can understand him, you are still required to obey an officer's lawful orders no matter how they are communicated. But "speak" is not a lawful order.
GDPR does not require consent. It requires a legal basis. Consent is only one legal basis among many. Some other legal bases are: legitimate interest (implying an opt out solution) necessity for performance of a contract If your customers pay you to deliver email updates, that contract is the legal basis for sending email updates. The only wrinkle is that as you describe your service, the emails aren't an essential part of the service. Alternatively, you might assert that there's a legitimate interest to deliver updates via email so that updates aren't missed. In that case you must allow the users to object, e.g. via ab unsubscribe link in the email and via their account settings. Because a prior business relationship exists, there's a strong case for legitimate interest – even if this were marketing emails (!). Legitimate interest requires you to balance the legitimate interest with the data subject's rights and freedoms though. Your updates are most likely not marketing, so any advice you might read relating to marketing emailings is irrelevant. GDPR applies because you are established in the EU. The regulation applies in relation to all your users, not just EU users. If and when Brexit happens you will still be covered by the Data Protection Act, which transcribes the GDPR's requirements into UK law. However, processing data from EU users will then count as an international transfer which requires extra compliance work, at least until the EU issues an adequacy decision for the UK.