Law Society of BC technology and cloud guidance

Rule 3.1-2 of the Code of Professional Conduct for British Columbia (the BC Code) requires a lawyer to perform all legal services to the standard of a competent lawyer. Commentary [4.1] adds that, to maintain the required level of competence, a lawyer should develop an understanding of, and ability to use, technology relevant to the nature and area of the lawyer's practice and responsibilities, and should understand the benefits and risks of relevant technology, recognizing the duty to protect confidential information in section 3.3.

Commentary [4.2] says the required level of technological competence depends on whether the technology is necessary to the lawyer's practice and whether it is reasonably available, considering the lawyer's or firm's practice areas, the geographic locations of the practice, and the requirements of clients. Competence does not mean every lawyer must be a technologist. It does mean understanding enough to make informed choices and to supervise the people and vendors who run the systems.

The Law Society of BC publishes a Cloud computing checklist (version 4.0, updated January 2023) for lawyers considering moving data to the cloud. It is deliberately inclusive and frames due diligence as ongoing rather than one-time. Key themes:

• Read the provider's click-through agreement, service level agreement and privacy terms before anything else.
• Have an internal process that must be completed before anyone places firm data in a cloud service.
• Don't rely on vendor marketing that a product is 'compliant with law society rules'. The due diligence is yours.
• Confirm the system can meet Law Society records, accounting and audit requirements.
• Check the provider's breach history and its technological, contractual and policy safeguards for confidential and privileged information.
• Understand the governing law and dispute resolution in the agreement, and stay aware of foreign laws such as the U.S. CLOUD Act where relevant to your clients.
• Plan for Law Society access to records if needed, for example if the Law Society acts as custodian.

The checklist ties cloud decisions to the Law Society Rules. Under Rule 10-3, when required, a lawyer must promptly produce records on demand in a comprehensive printed format, on a read-only basis, or exported to an electronic format that allows access in a comprehensible form. A 'record' includes associated metadata. The checklist asks whether the system preserves creation and modification dates, keeps a complete and printable audit trail, prevents reconciliations from being overwritten, and retains records for the required periods. For accounting records it asks, for example, whether records are kept for at least 10 years from the final accounting transaction.

The Law Society does not publish a list of approved vendors, but may declare a specific entity not to be a permitted cloud storage provider under Rule 10-3(5). For trust accounting and practice management software, these records questions should be answered before you sign, not after a spot audit.

Confidentiality under section 3.3 of the BC Code, read with the technology commentary, means cyber security is a professional obligation as well as a business one. For most firms that translates into: multi-factor authentication on email, the practice management system and remote access; encrypted laptops and phones; prompt patching; endpoint detection and response; secure handling of client trust instructions to defeat payment-redirection fraud; backups kept out of reach of ransomware and tested; and staff training on phishing and wire-fraud red flags.

When a firm loses custody or control of records, professional reporting duties can follow. The cloud checklist points lawyers to Rule 10-4, including a written report to the Executive Director under Rule 10-4(2), and to reporting obligations to the Lawyers Indemnity Fund under Rule 3-39 and section 7.8 of the BC Code. The checklist also says that a firm that is the victim of a data breach should report the claim to its cyber insurer immediately. Privacy law obligations, such as those under BC PIPA or PIPEDA, run alongside these professional duties.

The Law Society's practice advisors can give guidance on these issues, and the Law Society encourages lawyers to contact them.

1. 01

   Inventory systems

   List every system holding client or trust data, who hosts it, and where.

2. 02

   Run the LSBC cloud checklist

   Complete it for each cloud service, keep the completed copy on file, and repeat when services change.

3. 03

   Test record production

   Confirm you can export records, metadata and audit trails in the forms Rule 10-3 requires.

4. 04

   Secure the basics

   MFA, encryption, patching, EDR, backups, phishing training and a verified-callback rule for trust payment instructions.

5. 05

   Write the breach procedure

   Include Rule 10-4 reporting, insurer notice, privacy-law assessment and evidence preservation.

6. 06

   Review annually

   Technology competence is ongoing; schedule a yearly review of systems, vendors and training.