It is common for attorneys and law firms to use their online presence and social media networks to share legal news, market their services to prospective clients, communicate with current and former clients, network with other legal professionals, and offer opinions about legal topics to the public. As sectors of the legal profession have shifted to hybrid and remote working environments, some attorneys and firms have increasingly focused their marketing efforts in digital forums instead of in-person conferences and meetings.

The use of online social media platforms can present risks to attorneys, especially related to the duty to maintain client confidentiality. Here are some tips to help navigate the digital space.

Maintaining Client Confidentiality in Online Communications

The duty of confidentiality is one of the cornerstones of the legal profession. Indeed, Rule 1.6 of the California Rules of Professional Conduct incorporates California Business and Professions Code section 6068(e)(1), which requires attorneys “[t]o maintain inviolate the confidence, and at every peril to himself or herself to preserve the secrets, of his or her client.”

Most attorneys recognize that they cannot disclose communications protected by the attorney-client privilege to those outside the relationship. The duty of confidentiality, however, typically protects more than communications shielded by the attorney-client privilege. Comment [2] to California Rule 1.6 provides that attorneys must protect confidential information obtained “by virtue of the representation, whatever its source.” Such information can include client identity, business information, and other sensitive information. Generally, the attorney is prohibited from disclosing confidential information unless the client gives informed consent or an exception permits disclosure. Rule 1.6 calls on attorneys to protect clients’ confidential information even after the attorney-client relationship is terminated.

In 2018, the ABA’s Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 480, which examined the confidentiality obligations of attorneys engaged in online blogging and public commentary under Model Rule 1.6. Consistent with prior Formal Opinions issued by California’s Standing Committee on Professional Responsibility, the ABA’s opinion confirmed that attorneys must continue to adhere to the obligations imposed by the Rules of Professional Conduct when operating online. Those obligations remain regardless of the specific online medium the attorney uses, which may include social media posts, blogs or microblogs, website posts, podcasts, webinars, or other online public commentary.

Many commentators view Opinion 480 as simply reinforcing the attorney’s duty to maintain confidentiality even when communicating in a digital forum. Others, however, have been more critical of the opinion, stating that it needlessly restricts attorneys’ rights to comment on publicly available client information. Regardless of the viewpoint, the rationale underlying the opinion is rooted in the Rules of Professional Conduct, and there have been disciplinary cases around the country where attorneys have gotten into trouble for disclosing too much information online.

Information That Is Publicly Accessible

Attorneys and law firms typically take steps to protect confidential information and prevent disclosure. However, it is obviously more difficult to protect private information once it has been disclosed publicly. In other words, it is hard to “un-ring the bell.” But attorneys are generally understood to have an obligation to continue to safeguard client information, even if that information has been made public (absent client consent).

Opinion 480 also confirmed that Model Rule 1.6 requires attorneys to protect information that is otherwise “generally known” or “contained in a public record,” absent client consent or other steps. When it comes to online blogging or engaging in other public commentary, Opinion 480 observed that attorneys may not reveal information relating to a representation, including information contained in the public record, if that information is protected by Rule 1.6, unless disclosure is otherwise authorized. This view has been echoed by other entities in California. As recognized by California’s Standing Committee on Professional Responsibility and Conduct in Formal Opinion 2016-195, an attorney may have the obligation to refrain from blogging about public client information to avoid “further publiciz[ing]” it.

Accordingly, the attorney’s duty of confidentiality generally applies to information obtained by virtue of the representation, even if that information is in the public record or otherwise publicly accessible. Attorneys and law firms may therefore have obligations to refrain from online commentary, even for those client details that can be publicly confirmed from other sources, absent client consent.

Online Commentary May Not Implicate Traditional Disclosure Exceptions

Model Rule 1.6(b) provides a host of exceptions to the general prohibition on revealing confidential information. It allows attorneys to reveal confidential information to the extent necessary to prevent serious injury or death, to prevent the client from committing a crime, to defend against a claim brought by the client, or to comply with a court order. Rule 1.6(b) of the California Rules of Professional Conduct is far narrower, only recognizing an exception (absent client consent) to prevent a criminal act that the attorney believes is reasonably likely to result in death or substantial bodily harm.

Even considering Model Rule 1.6’s broader exceptions, Opinion 480 suggests that these exceptions are less likely to be at play when an attorney provides online commentary.

Hypotheticals May Present Risk

Using hypothetical situations is a common technique for attorneys posting on social media. Indeed, hypotheticals sometimes offer a way to crowdsource techniques and strategies without revealing confidential information. Attorneys, however, are not necessarily immunized by labeling commentary as a hypothetical if there is a reasonable likelihood that a third party could ascertain the identity or situation of the client from the “hypothetical” facts. Attorneys in those situations will often disguise their hypothetical well enough that a third party cannot ascertain the identity or situation of the client.

All attorneys have ethical obligations by virtue of the unique relationship between practitioners and clients. Where attorneys fail to comply with those ethical obligations or where they deviate from the standard of care, those attorneys can face bar grievances or even legal malpractice exposure.

Sometimes, more junior attorneys, like new associates joining a law firm after graduating from law school, may assume that their inexperience will insulate them from accountability for misconduct. They may believe that it’s the more senior lawyer’s job to make sure that ethical rules are being followed. But associates owe professional duties to their clients that are independent of their believed lack of seniority.

Although associates are mentored or supervised by more senior attorneys and are often trained on the job, they face risks—for themselves and the firm—if they fail to meet their ethical obligations under the professional rules. Here are some tips for law firm associates and other junior attorneys on how to conduct themselves in accordance with the applicable rules and avoid common areas of risk.

Being Supervised

Under California Rule of Professional Conduct 5.2(a), a subordinate attorney has an independent duty to comply with the rules, even when the lawyer “acts at the direction of another lawyer or other person.” The excuse that “a supervising attorney ordered me to do it” typically does not, standing alone, excuse the subordinate attorney’s failure to follow the Rules of Professional Conduct—unless, as per Rule 5.2(b), the subordinate attorney is acting “in accordance with a supervisory lawyer’s reasonable resolution of an arguable question of professional duty.” Attorneys, regardless of experience, are still responsible for their own conduct.

That said, law firm associates and other junior attorneys generally have resources if they are unsure of what to do in a particular situation. For example, if they question whether their conduct runs contrary to the rules, they can discuss their concerns with a mentor or the firm’s legal risk official (such as the general counsel).

Supervising Nonlawyer Staff

There are often opportunities for associates to delegate work to law firm staff and other business professional staff, such as secretaries, legal assistants, or paralegals. Delegating work to nonlawyer assistants gives rise to corresponding duties of oversight and supervision under the rules. Specifically, under California Rule of Professional Conduct 5.3(b), attorneys must “make reasonable efforts to ensure that the person’s conduct is compatible with the professional obligations” of the attorney.

Associates managing nonlawyer staff and other business professionals should be mindful to avoid instructing such staff to do any tasks that the associates themselves are ethically prohibited from doing. Associates supervising nonlawyer staff could be held responsible for the conduct of those they supervise even though business professional staff are not subject to professional discipline by the bar. After all, the associate is the one who holds the license to practice law.

The Risks of Social Media

The use of social media has become common for most attorneys, who typically are aware that they should not engage in harassing conduct online or volunteer their legal advice to the masses. But the risks of social media use can also be more nuanced. Indeed, an associate’s seemingly innocuous posting about their personal opinion on a trending news story could potentially create a rift with a client who holds a contrary view. Under certain circumstances, such a posting could even create a business conflict within the associate’s firm. Posting client information online also risks breaching the duty of confidentiality.

In addition, social media posts about an attorney’s own representations of clients could qualify as a legal advertisement, subject to the restrictions of the Rules of Professional Conduct.

Unauthorized Practice and Side Hustles

While the rules vary by jurisdiction, most states require non-admitted attorneys who have sat for the bar (or whose admission status is pending) to be supervised by an attorney admitted in the jurisdiction. Choosing instead to go it alone during that time can create risk.

In addition, some law firms—particularly since the pandemic—have migrated their practices online. For associates, there can be a risk if they work from home in a different jurisdiction than the one in which they are admitted. Typically, any risk can be cleared up by including disclaimers or by confirming that the associate’s “office” address is the firm’s office address in the jurisdiction where the associate is admitted. If an associate incorrectly suggests to the public that they are admitted to practice in the state where they reside, it could create confusion and potentially lead to discipline.

For some law firm associates, the risk may come from a side hustle. Such a practice, known as moonlighting, can create complications, especially if the attorney does so with another legal services job. There is nothing per se unethical about moonlighting in most jurisdictions; nevertheless, it can create uncertainty for law firm associates, particularly for confidentiality issues and conflicts of interest.

The practice also creates insurance coverage risks. Because a law firm’s insurance policy typically only covers legal services provided for law firm matters and clients, a moonlighting associate could be left without coverage for alleged legal malpractice.

Obligation To Report Misconduct

California Rule of Professional Conduct 8.3(a) encourages all attorneys, regardless of their experience, to inform the bar when they become aware that another attorney has engaged in conduct involving, among other things, dishonesty, fraud, or deceit which raises a “substantial question as to that lawyer’s honesty, trustworthiness, or fitness” to practice law. Under most circumstances, an associate concerned about another attorney’s conduct will initially raise the issue with an internal risk manager at the firm (like the general counsel). Not only does the associate have the benefit of receiving guidance on how to navigate the situation, but it also ensures that any such discussions are privileged.

Law firms can also work to develop a culture that encourages disclosures so its members do not fear reprisals and solidifies the firm’s expectations that attorneys hold themselves to a high standard of ethics. Reporting the misconduct of a fellow attorney is always a sensitive subject and often difficult. When it becomes necessary and appropriate to do so, associates can take steps to protect their clients, their firm, and their own reputations.