Personal information has
been in the news a great deal recently. Things that we all expect to be private
sometimes are not. The victims have included a major
retailer, another major retailer, a telephone company, another phone company, the federal government, and more.
What responsibilities do
attorneys have in this regard? Well, it is fairly clear that lawyers need
to be aware of the data they possess and transmit. Protecting the best interest
of the client is a touchstone of the attorney function. The Rules of
Professional Conduct mention the client's best interests in various places. See
for example the Comment to Rule 4-1.4 ("consistent with the duty to act in
the client’s best interests")
An excellent ABA article Safeguarding Confidential Data was published
in 2010. It relates various cautions and advice. The author notes that
confidentiality of a client's data and information is clearly an obligation of
ethical legal representation. He notes that the ABA Model
rule "requires reasonable precautions to safeguard and preserve
confidential information." While his thesis is protection of attorney
computers/networks, the caution is the same. And, it is a great reminder of the obligations of keeping your computer (including flashdrives, discs, etc.) safe from disclosure or invasion.
This all came to mind
recently when Montana published a memo about electronic filing. There was
also a story on WorkCompCentral about the privacy issue. The
Montana Workers' Compensation Court memo alerted attorneys and the public that
documents filed there are public records. This is also true in Florida;
everything you file is a public record subject to disclosure. The Florida
Office of Judges of Compensation Claims (OJCC) makes every effort to safeguard
the documents entrusted to us. It has become a very significant part of our
function.
Montana reminds its
practitioners that its Court, like Florida's OJCC, does not review each
incoming document. The Florida OJCC counts on the practitioner to assure that
filed documents do not include confidential information. The exception to this
is Petitions for Benefits (PFB). These documents should have the social
security number included. While that is not a legal requirement, it does
expedite the OJCC processing.
Other than this, it
would be helpful if counsel would appreciate the importance
of "full birth dates, social security and tax
identification numbers, financial account numbers, and all information that is
not to be accessible to the public under state or federal law in all
filings." These items are called "personally identifiable information
(PII)."
There is a good list
of sensitive information found in the Florida Rules of Judicial
Administration, Rule 2.425. Those rules do not apply to the OJCC specifically,
but it is still a great list and provides sound guidance. Of course, there may
be a good reason for filing any of these personal details in a particular
situation, and discretion is advised. However, these are all items which might
be PII and which might be unnecessary. Attorneys should reflect on
whether such information is in filings. Then, ask if that information is
essential for the end that you seek to accomplish. The list includes:
(B) Bank account number,
(C) Credit card account number,
(D) Charge account number, or
(E) Debit account number;
(F) Taxpayer identification number (TIN),
(G) Employee identification number,
(H) Driver’s license number,
(I) passport number,
(J) Telephone number,
(K) Financial account number
(L) Brokerage account number,
(M) Insurance policy account number,
(N) Loan account number,
(O) Customer account number, or
(P) Patient or health care number;
(Q) Computer user name,
(R) Password, or
(S) Personal identification number (PIN)
What if sensitive
information is inadvertently submitted? It is best to make someone aware of the
nature of those documents. These are potentially difficult questions for any
attorney. For alerting someone or seeking relief, a motion may be the best method,
Rule 60Q6.115(1). Practitioners should remember that in appropriate
circumstances, the assigned judge may order that the Clerk "place a
document under seal and render it thereby viewable only upon further
order." Rule 60Q6.108(1)(i).
What if sensitive information
must be submitted? That is, a knowing analysis has been conducted, and
despite the obligations of protecting the client, some PII must be submitted
for the judge's consideration. That information should remain confidential and
be protected against further disclosure. It is a good idea to label that
document with a cover page that simply says "contains private information
that should not be disseminated. If such document is later reviewed in
conjunction with responding to a public records request, this will alert the
clerks' office, and that private information can be redacted.
The bottom line is this:
redact thyself, remove PII from documents before filing with us. If you
inadvertently file something that should not have been filed, alert the
assigned judge by filing a prompt and thorough motion. And, if PII must be
filed, label the document with an explanatory cover page to alert the judge and
others that this document bears special consideration regarding safeguarding of
PII.
It is a burden, but the
burden has existed all along. When we all filed paper documents, the
responsibility was the same. The electronic filing system has allowed us to
move documents more rapidly, but it has not enhanced responsivity regarding the
filing of PII. So, be aware and remember the ethical obligations. It is
important to people that their information be respected.