Sunday, July 3, 2016

Redact Thyself

Personal information has been in the news a great deal recently. Things that we all expect to be private sometimes are not. The victims have included a major retailer, another major retailer, a telephone company, another phone company, the federal governmentand more

What responsibilities do attorneys have in this regard? Well, it is fairly clear that lawyers need to be aware of the data they possess and transmit. Protecting the best interest of the client is a touchstone of the attorney function. The Rules of Professional Conduct mention the client's best interests in various places. See for example the Comment to Rule 4-1.4 ("consistent with the duty to act in the client’s best interests")

An excellent ABA article Safeguarding Confidential Data was published in 2010. It relates various cautions and advice. The author notes that confidentiality of a client's data and information is clearly an obligation of ethical legal representation. He notes that the ABA Model rule "requires reasonable precautions to safeguard and preserve confidential information." While his thesis is protection of attorney computers/networks, the caution is the same. And, it is a great reminder of the obligations of keeping your computer (including flashdrives, discs, etc.) safe from disclosure or invasion.  

This all came to mind recently when Montana published a memo about electronic filing. There was also a story on WorkCompCentral about the privacy issue. The Montana Workers' Compensation Court memo alerted attorneys and the public that documents filed there are public records. This is also true in Florida; everything you file is a public record subject to disclosure. The Florida Office of Judges of Compensation Claims (OJCC) makes every effort to safeguard the documents entrusted to us. It has become a very significant part of our function. 

Montana reminds its practitioners that its Court, like Florida's OJCC, does not review each incoming document. The Florida OJCC counts on the practitioner to assure that filed documents do not include confidential information. The exception to this is Petitions for Benefits (PFB). These documents should have the social security number included. While that is not a legal requirement, it does expedite the OJCC processing. 

Other than this, it would be helpful if counsel would appreciate the importance of "full birth dates, social security and tax identification numbers, financial account numbers, and all information that is not to be accessible to the public under state or federal law in all filings." These items are called "personally identifiable information (PII)." 

There is a good list of sensitive information found in the Florida Rules of Judicial Administration, Rule 2.425. Those rules do not apply to the OJCC specifically, but it is still a great list and provides sound guidance. Of course, there may be a good reason for filing any of these personal details in a particular situation, and discretion is advised. However, these are all items which might be PII and which might be unnecessary. Attorneys should reflect on whether such information is in filings. Then, ask if that information is essential for the end that you seek to accomplish. The list includes:

(A) Social security number,
(B) Bank account number,
(C) Credit card account number,
(D) Charge account number, or
(E) Debit account number;
(F) Taxpayer identification number (TIN),
(G) Employee identification number,
(H) Driver’s license number,
(I) passport number,
(J) Telephone number,
(K) Financial account number
(L) Brokerage account number,
(M) Insurance policy account number,
(N) Loan account number,
(O) Customer account number, or
(P) Patient or health care number;
(Q) Computer user name,
(R) Password, or
(S) Personal identification number (PIN)

What if sensitive information is inadvertently submitted? It is best to make someone aware of the nature of those documents. These are potentially difficult questions for any attorney. For alerting someone or seeking relief, a motion may be the best method, Rule 60Q6.115(1). Practitioners should remember that in appropriate circumstances, the assigned judge may order that the Clerk "place a document under seal and render it thereby viewable only upon further order." Rule 60Q6.108(1)(i).

What if sensitive information must be submitted? That is, a knowing analysis has been conducted, and despite the obligations of protecting the client, some PII must be submitted for the judge's consideration. That information should remain confidential and be protected against further disclosure. It is a good idea to label that document with a cover page that simply says "contains private information that should not be disseminated. If such document is later reviewed in conjunction with responding to a public records request, this will alert the clerks' office, and that private information can be redacted. 

The bottom line is this: redact thyself, remove PII from documents before filing with us. If you inadvertently file something that should not have been filed, alert the assigned judge by filing a prompt and thorough motion. And, if PII must be filed, label the document with an explanatory cover page to alert the judge and others that this document bears special consideration regarding safeguarding of PII. 

It is a burden, but the burden has existed all along. When we all filed paper documents, the responsibility was the same. The electronic filing system has allowed us to move documents more rapidly, but it has not enhanced responsivity regarding the filing of PII. So, be aware and remember the ethical obligations. It is important to people that their information be respected. 

No comments:

Post a Comment