Coping With Metadata: Ten Key Steps - Steven C. Bennett and Jeremy Cloud

• Citation: Vol. 61 No. 2
• Publication year: 2010

Coping With Metadata: Ten Key Stepsby Steven C. Bennett^* and Jeremy Cloud^**

Nearly every electronic document contains "metadata," information that typically does not appear in the paper form of the document but that can be retrieved from electronic files.¹ Metadata is often harmless and irrelevant,² but in some cases, it can reveal much about the creation, alteration, and transmission of a document.³ Metadata, moreover, may contain privileged and confidential information.⁴ In some instances, electronic documents cannot be reviewed or used efficiently without metadata.⁵ Because modern businesses and law firms depend heavily on electronic communication, data management, and word processing, lawyers must learn to cope with metadata and its legal implications.⁶

This Article outlines some of the most important practical steps lawyers can take to familiarize themselves with metadata, to recognize the potential risks involved, and to implement procedures aimed at minimizing such risks.

I. EDUCATE YOURSELF

Lawyers must act competently and diligently when representing clients.⁷ Most lawyers, however, are not computer experts, and even relatively tech-savvy lawyers may not have heard of metadata until recently.⁸ Stories abound of embarrassing revelations that have occurred because of metadata.⁹ Lawyers should not fall into the "it can't happen to me" trap. It can, quite easily.

As one useful illustration, take a few documents created outside your firm—the more innocuous the better—and turn on the "track changes" feature or other document property listings, which can show much ofthe information hidden in such documents. Pay attention to just how much information may be conveyed in the metadata contained in a document, and consider whether you might be embarrassed to send out documents with similar kinds of information available to the recipient.

Now, open one of your own word processing documents; check the properties listed and note what you find. Inquire about the software tools your firm uses or may be considering for use in "scrubbing" metadata from documents. Locate and read your firm's policies regarding transmission of electronic documents. Begin to develop a more cautious approach to electronic information in metadata. This cautious approach should include awareness of the standard activities of secretaries and word-processing staff regarding creation of documents.¹⁰

II. Recognize Potential Privilege Problems in Distributing

Metadata

The American Bar Association (ABA) Model Rule of Professional Conduct 1.6¹¹ prohibits lawyers from "reveal[ing] information relating to the representation of a client," including confidential communications and client secrets.¹² Rule 1.6 requires that attorneys take affirmative steps to ensure that they do not inadvertently transmit such information to third parties without consent from their clients.¹³ The precise degree of effort at privilege protection required by Rule 1.6 may vary, depending on the importance of the matter and the instructions of the client.¹⁴ What should not vary, however, is the lawyer's attention to the issue of metadata.¹⁵ Several recent ethics opinions make clear that lawyers transmitting electronic information have a duty to use "reasonable care" to prevent the disclosure of metadata that may contain client confidences and secrets.¹⁶

Metadata may reveal privileged or confidential information in various ways. In transactions, it could compromise a negotiating position by showing client or lawyer comments on a draft proposal or deletions of proposed terms in a standard document.¹⁷ In litigation, metadata could reveal trial strategies and views of counsel regarding the viability of legal claims or the strength of evidence.¹⁸

Various techniques may help restrict the distribution of potentially embarrassing—and perhaps quite damaging—metadata:¹⁹

• The simplest method is to reduce the creation and distribution of electronically stored information. A prudent document management program, aimed at eliminating duplicative, outdated, and unnecessary materials, may help law firms and their clients reduce the possibility of distributing private information.²⁰

• Word processing features may be turned off for certain documents. Thus, for example, a document may be created without the "track changes" feature; and the comments field used creating a document may be deleted when the document is finalized.

• In sending materials to adversaries, send hard copies, transmit images of the materials via facsimile, or send Portable Document Format (PDF) images of paper copies. These steps will ensure that metadata cannot be transmitted.

• If a document must be sent in electronic form, consider the use of PDF or rich text format (RTF). Note, however, that PDF and RTF image conversion from an electronic file will retain and transmit at least some minimum bits of metadata.²¹

• "scrubbing" software is available for routine transmissions of information.²² Such software often can be programmed to restrict transmission of specific fields of information.²³ Similarly, "tracing" software may help ensure that confidential information is not distributed beyond its intended recipients.²⁴

None of these steps are foolproof. Most significantly, even the lawyer who is well-attuned to metadata privilege problems may encounter co-counsel or staff who lack such awareness. Thus, it becomes essential to implement a regular system to train lawyers and staff and confirm the use of good document management practices within a lawyer's office.²⁵ In some instances, even outside of litigation, counsel may wish to enter into "unintended disclosure agreements" with adversaries, which confirm arrangements for return or deletion of confidential information that is unintentionally sent outside the firm.²⁶

III. BE PREPARED FOR INADVERTENT TRANSMISSION

Even if a lawyer's own state ethics rule interpretations prohibit the receiving lawyer from examining confidential information in metadata, it is entirely possible that the recipient of the information operates under the professional responsibility regime ofanother state, which may permit such examination.²⁷ Further, the recipient lawyer may not realize, until after examining the document, that it contains privileged information. In that event, the producing lawyer cannot "unring the bell" and take the privileged information out of the receiving lawyer's mind.²⁸

In addition to using techniques to reduce the risks of inadvertent transmission outlined above,²⁹ lawyers should consider steps to reduce damage from inadvertent transmission of private information when it occurs. Such steps may include:

• Lawyers may use a notice statement in the text of e-mail transmissions, which says that the transmission may contain confidential information and that such information, if sent in error, should not be reviewed. The notice may request that the recipient notify the sender and return or destroy all copies of the information.

• In litigation, parties may enter into a "claw-back" agreement or order, providing that inadvertently disclosed information will be returned or destroyed, and not used.

• When inadvertent disclosure of privileged information occurs, counsel should notify opposing counsel promptly and demand reasonable steps to remedy the disclosure. Such steps may include return or destruction ofthe information and a promise not to use the information for any purpose.

IV. Recognize Potential Ethical Problems in Receiving

Metadata

For the lawyer who receives a document containing arguably private metadata, the ethical practice rules are more complicated. Model Rule of Professional Conduct 8.4(c)³⁰ provides, "It is professional misconduct for a lawyer to . . . engage in conduct involving dishonesty, fraud, deceit or misrepresentation."³¹ Model Rule of Professional Conduct 4.4(b)³² more specifically provides that a "lawyer who receives a document relating to the representation of the lawyer's client and knows or reasonably should know that the document was inadvertently sent shall promptly notify the sender."³³ Rule 4.4(b) does not suggest a means by which a lawyer "reasonably should know" that a document was inadvertently sent; nor does it state whether the lawyer must do (or refrain from doing) anything with the document after notifying the adversary.³⁴ Instead, the comments to Rule 4.4 state that it is "a matter of professional judgment" whether lawyers may read such documents once they know the documents were inadvertently sent.³⁵

In a 2006 formal opinion, the ABA Committee on Ethics and Professional Responsibility determined that, because Rule 4.4(b) specifies that the only ethical obligation ofthe receiving lawyer is to notify the sending lawyer that private information might have been inadvertently sent, the Model Rules do not preclude receiving lawyers from reading such information and exploiting it for any lawful purpose.³⁶ However, a number of contrary state ethics opinions have been issued.³⁷

With an absence of clear controlling authority or a majority rule, a lawyer who receives potentially confidential metadata should proceed with caution. Because a lawyer's reputation for ethical and professional conduct is key to professional success, when in doubt about whether confidential information has been inadvertently produced, and whether the lawyer has an ethical obligation to refrain from exploiting the information, the better practice is to provide notice to opposing counsel and seek a dialogue on how best to handle the situation. In the context of litigation under the newly revised Federal Rules of Civil Procedure, that practice is suggested but not specifically required.³⁸

V. Recognize the Potential Value of Metadata as Evidence

Much metadata may be entirely innocuous, such as formatting instructions that determine margins, type size, line spacing, and other features in a document. Yet, in some cases, metadata can provide crucial evidence, not...