Law Firm IT Disposal and Client Confidentiality

The short version

Privileged material lives on the hardware, and the duty to safeguard it doesn't stop because the machine is obsolete.
Reasonable efforts is the standard — the ethical rules require competence and safeguards, not a specific technology.
Document what was destroyed, per drive, by serial number. That record is the evidence the efforts were made.
The copier and the scanner are the worst offenders, because they hold years of scanned client documents and are usually leased.

The duty

Why this is an ethics question, not just an IT one

A lawyer's duty of confidentiality extends to making reasonable efforts to prevent unauthorised disclosure of information relating to the representation of a client. The modern reading of competence includes understanding the risks of the technology the firm uses. Neither of those duties has a hardware exemption.

In practical terms that means a retired machine holding client files is still your responsibility, and the question a regulator or an opposing party would ask is what reasonable efforts you made. A per-drive destruction record answers it. A collection receipt from a recycler does not.

This is also increasingly a client question rather than a regulator one. Corporate clients send security questionnaires to outside counsel, and media disposal is a standard line on them. A firm that can answer it in one sentence has an easier renewal conversation than one that has to go and find out.

The devices

Where client material actually sits

The scanner and the copierEvery discovery document, every executed contract, every client ID copied at intake. Usually leased, so it leaves with the data unless you act. How to handle one.
Laptops taken home and to courtOften holding local copies of matter files that were never on the server, and frequently not on the firm's asset register at all.
Backup drives and old NAS unitsA complete copy of the document management system as it stood at some point, sitting in a cupboard.
Departed fee earners' machinesThe machines nobody reassigned. They hold matter files for clients who may have left with the fee earner.
Deposition and trial equipmentLaptops and drives used for presentations, often holding complete case files and rarely managed centrally.

What to do

A defensible process

Inventory before anything movesEvery device, every drive, by serial number. How to build it.
Consider on-site destructionFor a firm, "nothing readable left the building" is a materially easier sentence than explaining a chain of custody. The trade-off.
Keep certificates with your risk recordsNot in the office manager's inbox. You will be asked for these during a client security review, not during an IT project.
Sign an NDA with the vendorStraightforward, and it demonstrates the reasonable efforts you will later want to point at.

Questions

Law firm disposal questions

What are a law firm's obligations when disposing of computers?

The duty of confidentiality requires reasonable efforts to prevent unauthorised disclosure of information relating to the representation of a client, and the duty of competence is generally read to include understanding the risks of the technology the firm uses. Neither stops when hardware is retired. In practice that means sanitising or destroying every drive that held client material and keeping a record showing it was done, per drive, by serial number.

Should a law firm use on-site drive destruction?

Many firms do, and the reason is less about absolute risk than about how easily it can be explained. On-site destruction means no readable media leaves the building, which is a single clear sentence during a client security review or an internal risk discussion. Off-site destruction under a documented chain of custody is also defensible and costs less, so it comes down to the sensitivity of the matters involved and what your clients expect.

What about the firm's copier?

It is usually the highest-risk device in the building and the one least likely to be on anyone's list. Multifunction copiers store scanned documents on an internal drive, which in a firm means discovery material, executed agreements and client identification documents. They are also normally leased, so the device goes back to the leasing company with that content on it unless the drive is specifically dealt with before the return.

Do we need a signed agreement with the disposal vendor?

An NDA is sensible and most vendors will sign one without argument. Beyond the protection itself, having it signed is part of demonstrating the reasonable efforts the ethical rules call for. Some firms also impose their own vendor security terms, which is worth doing if the volume of material is significant.

How long should a firm keep destruction certificates?

At least as long as the firm's retention period for the matters involved, and ideally alongside the firm's risk and insurance records. These documents are almost never needed during the project itself, and are asked for years later during a client security review or after a question is raised, at which point they cannot be recreated.

Keep reading

Related guides

Your copier has a hard drive on it, and it's probably leasedMultifunction printers store every document they scan on an internal drive, and are usually leased. What that means when one leaves your office.
On-site or off-site drive destruction — which do you actually need?The real difference between destroying drives at your office and having them collected: what each costs you, what risk each removes, and when off-site is fine.
What a certificate of data destruction should contain — and what makes one worthlessA real certificate of data destruction lists every drive by serial number. Here is what to check for, what the weak ones leave out, and why it matters when an auditor asks.

Disposing of IT in a law firm without breaching confidentiality