ABA Formal Opinion 477R

ABA Formal Opinion 477R, titled “Securing Communication of Protected Client Information,” is an ethics opinion issued in May 2017 by the American Bar Association’s Standing Committee on Ethics and Professional Responsibility. It holds that a lawyer must use reasonable efforts to prevent unauthorized access to client information transmitted electronically, and that for sufficiently sensitive matters those efforts may require more than ordinary email.

What Changed From the Earlier Guidance

Opinion 477R updates Formal Opinion 99-413, which had concluded that unencrypted email was generally acceptable for client communication. That conclusion was reached in a different threat environment. 477R does not reverse it outright — unencrypted email remains permissible for routine matters — but it replaces a blanket answer with a duty to assess.

The “R” is for revised: the Committee issued the opinion and then reissued a corrected version later the same month, which is why the citation is usually written 477R rather than 477.

The Underlying Model Rules

The opinion is not a standalone rule. It applies existing duties to electronic communication:

• Rule 1.1 (Competence), whose Comment 8 requires lawyers to keep abreast of the benefits and risks associated with relevant technology — the technological competence duty.
• Rule 1.6(c) (Confidentiality), requiring reasonable efforts to prevent inadvertent or unauthorized disclosure of information relating to the representation.
• Rule 1.4 (Communication), which governs discussing security choices with the client.
• Rules 5.1 and 5.3 (Supervision), extending responsibility to associates, staff, and outside vendors.

The Reasonableness Factors

Because the standard is reasonable efforts rather than a fixed control, the analysis turns on factors drawn from the confidentiality rule: the sensitivity of the information, the likelihood of disclosure if additional safeguards are not used, the cost and difficulty of implementing those safeguards, and the extent to which a safeguard would impair the lawyer’s ability to represent the client.

That last factor matters more than firms expect. A control that makes it impractical for a client to send a document is not automatically the safer choice under this framework.

The Seven Points of Guidance

The opinion sets out a practical sequence:

1. Understand the nature of the threat — risk varies by practice area and client.
2. Understand how client information is transmitted and where it is stored — an inventory question, and the one most firms cannot answer.
3. Use reasonable electronic security measures.
4. Determine how electronic communications about client matters should be protected — matter by matter, not once for the firm.
5. Label client confidential information so that handling rules can attach to it.
6. Train lawyers and nonlawyer assistants in technology and information security.
7. Conduct due diligence on vendors providing communication technology.

What “Reasonable Efforts” Looks Like in Practice

For most DFW firms the gap is not encryption. It is points two, five, six and seven — knowing where matter files actually live once they have been emailed, forwarded, and saved to a laptop; having a labelling convention that survives contact with a busy practice; a training record rather than an assumption; and a vendor file for the document management system, the e-discovery platform, and the cloud host.

A firm that has a secure client portal but cannot say which vendors hold privileged material has satisfied the visible half of the opinion and missed the half an ethics complaint would examine.

Where Client Confidentiality Meets Client Diligence

Opinion 477R is increasingly enforced by the market rather than by bar counsel. Corporate clients running outside-counsel guidelines ask firms for exactly what the opinion describes: data maps, encryption standards, training evidence, breach notification terms, and subcontractor disclosure. A firm that has done the 477R work answers those questionnaires from existing documents. A firm that has not spends partner hours reconstructing them under a client deadline.

Why ABA Formal Opinion 477R Matters for Investment & Professional Firms

For DFW law firms, Opinion 477R makes cybersecurity an ethical obligation rather than an IT preference, and one measured by documented effort rather than by intent. DKBinnovative has supported compliance-intensive firms since 2004 and provides the encryption, secure communication, access controls, data inventory, training records, and vendor documentation that let firms in Frisco, Plano, Irving, and Las Colinas evidence the reasonable-efforts standard the opinion describes.

Related DKBinnovative Resources

• Managed IT for Law Firms
• Managed IT for Investment & Professional Firms
• Glossary: Legal Hold & E-Discovery
• Glossary: Multi-Factor Authentication
• Glossary: Written Information Security Program

External reference: ABA Model Rules of Professional Conduct (Cornell LII) · NIST Cybersecurity Framework