Files on stolen laptop not protected

Published on 30 August 2019

A barrister who failed to place file protection on her work laptop, which was then stolen, has been censured and fined $1,500 by a lawyers standards committee.

The barrister, Norfolk, had a separate office on her residential property, which was broken into and her work laptop taken.

A complaint was subsequently received by the Lawyers Complaints Service. As part of that complaint, it was advised that:

the laptop contained legal aid files dating back 10 years and the login details to Norfolk’s Resolution Management System account;
Norfolk had no password or encryption set up to prevent unauthorised access to the information stored on her laptop;
no remote wipe software was installed on the laptop;
Norfolk’s IT provider could remotely access the laptop provided it was connected to the internet (which had not been detected); and
before the burglary, Norfolk’s family had access to the laptop and therefore her client files.

The committee noted that Norfolk had been personally devastated by the burglary and had taken all responsible steps once the break-in was discovered, including working with the Police and the Ministry of Justice.

However, Norfolk was responsible for protecting the confidential information of her clients, the committee said.

“In light of the quantity of confidential information stored on [Norfolk]’s laptop, the committee considers that as a minimum, clients would expect that that information would be protected by way of password or some form of encryption.”

“Norfolk’s failure to have any password or encryption set up on her laptop (on which 10 years of client files were stored) amounts to a breach of Rules 8 and 11 of the Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008.

Rule 8 provides: “A lawyer has a duty to protect and to hold in strict confidence all information concerning a client, the retainer, and the client’s business and affairs acquired in the course of the professional relationship.”

Rule 11 provides: “A lawyer’s practice must be administered in a manner that ensures that the duties to the court and existing, prospective, and former clients are adhered to, and that the reputation of the legal profession is preserved.”

The breach of these two rules was unsatisfactory conduct, the committee found.

“Clients are entitled to expect that information provided to a lawyer will remain confidential,” the committee said.

“Such an expectation is essential to the administration of justice as it encourages clients to disclose all relevant matters to their lawyer and thereby allows that lawyer to give advice on the basis of full information.”

As well as imposing the censure and fine, the committee ordered Norfolk to pay $500 costs.