Abstract
The duty of confidentiality is among the oldest and most fundamental obligations of the legal profession. It is the foundation upon which lawyer-client privilege rests, and the condition upon which clients are willing to make the full and frank disclosure necessary for effective legal representation. Yet the technological environment in which lawyer-client communications now occur has been transformed in ways that the rules of professional conduct in most jurisdictions were not designed to address. Lawyers routinely communicate with clients through email, messaging applications, video conferencing platforms, and cloud-based document management systems, many of which were designed for consumer convenience rather than professional confidentiality. The emergence of artificial intelligence tools in legal practice, including AI-powered legal research, document review, contract analysis, and predictive analytics, introduces a further dimension of risk: client data uploaded to AI platforms may be processed, stored, or used for training purposes in ways that compromise privilege and confidentiality. This article examines the intersection of lawyer-client communications, professional conduct rules, and artificial intelligence, analysing the legal frameworks governing the duty of confidentiality in Nigeria, the European Union, the United States, and the United Kingdom. It assesses the risks that modern communication technologies and AI tools pose to lawyer-client privilege, and proposes a framework for safer communication practices that addresses encryption standards, platform selection, AI usage policies, data governance, and the modernisation of professional conduct rules to incorporate a technology competence obligation.
Keywords: lawyer-client privilege; confidentiality; professional conduct; artificial intelligence; legal technology; encryption; data protection; legal ethics; GDPR; Nigeria
1. Introduction
The duty of confidentiality owed by a lawyer to a client is a principle of universal recognition across legal systems. In common law jurisdictions, it is protected by the doctrine of legal professional privilege, which shields communications made between lawyer and client for the purpose of obtaining or giving legal advice from compulsory disclosure. In civil law jurisdictions, it is enforced through professional secrecy obligations that impose criminal sanctions on lawyers who disclose client information without authorisation. The rationale is consistent across traditions: the administration of justice requires that individuals be able to consult legal advisers in confidence, and the law must protect that confidence to ensure that clients make the full and frank disclosure necessary for effective legal representation.
The technological environment in which these communications now take place bears no resemblance to the environment in which the rules of professional conduct were drafted. In Nigeria, the Rules of Professional Conduct for Legal Practitioners 2007 were adopted before the widespread use of smartphones, cloud computing, and AI-powered legal tools. In England and Wales, the Solicitors Regulation Authority's Code of Conduct addresses confidentiality and information security in general terms but does not provide specific guidance on AI usage, platform selection, or encryption standards. In the United States, the American Bar Association's Model Rules have been amended to include a technology competence obligation, but the practical application of this obligation to AI tools remains developing.
This article examines the risks that modern communication technologies and AI tools pose to lawyer-client privilege and confidentiality, and proposes a framework for safer communication practices. Section 2 analyses the legal foundations of the duty of confidentiality. Section 3 examines the technological risks to confidential communications. Section 4 addresses the specific risks introduced by AI tools. Section 5 undertakes a comparative analysis of professional conduct frameworks. Section 6 proposes reforms. Section 7 concludes.
2. The Duty of Confidentiality: Legal Foundations
2.1 Common Law Privilege
Legal professional privilege in common law jurisdictions comprises two branches: legal advice privilege and litigation privilege. Legal advice privilege protects confidential communications between a lawyer and client made for the purpose of obtaining or giving legal advice. Litigation privilege extends protection to communications between a lawyer, client, and third parties made for the dominant purpose of contemplated or pending litigation.
The scope and rationale of legal advice privilege were examined by the House of Lords in R v Derby Magistrates' Court, ex parte B, where Lord Taylor CJ held that legal professional privilege is "a fundamental condition on which the administration of justice as a whole rests" and that "no exception should be allowed to the absolute nature of legal professional privilege, once established". The privilege belongs to the client, not the lawyer, and can be waived only by the client.
The duty of confidentiality is broader than the doctrine of privilege. While privilege operates as a rule of evidence, preventing the compulsory disclosure of protected communications, the duty of confidentiality is an ethical obligation that requires the lawyer to protect all information relating to the representation, regardless of whether the information would be privileged in the evidentiary sense.
2.2 Civil Law Professional Secrecy
In civil law jurisdictions, the duty of confidentiality is enforced through professional secrecy obligations. In France, Article 226-13 of the Code Penal criminalises the disclosure of confidential information by persons bound by professional secrecy, including lawyers. In Germany, Section 203 of the Strafgesetzbuch imposes criminal liability on lawyers who disclose client secrets without authorisation. The Council of Bars and Law Societies of Europe (CCBE) Code of Conduct for European Lawyers provides that confidentiality is "a primary and fundamental right and duty of the lawyer" and that "this obligation is not limited in time".
2.3 Nigerian Law
In Nigeria, the duty of confidentiality is governed by Rule 19 of the Rules of Professional Conduct for Legal Practitioners 2007, which provides that a lawyer shall not knowingly reveal a confidence or secret of a client, and shall not use a confidence or secret of a client to the disadvantage of the client or for the advantage of the lawyer or a third person, unless the client consents after full disclosure. The rule defines "confidence" as information protected by the lawyer-client privilege, and "secret" as other information gained in the professional relationship that the client has requested be held inviolate or the disclosure of which would be embarrassing or detrimental to the client.
The Evidence Act 2011 provides the statutory basis for legal professional privilege in Nigeria, Section 192 protecting communications made between a lawyer and client for the purpose of obtaining or giving legal advice from compulsory disclosure.
2.4 The GDPR Dimension
Where lawyer-client communications involve the processing of personal data, the General Data Protection Regulation imposes additional obligations on the lawyer as a data controller. Article 5(1)(f) of the GDPR requires that personal data be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage. Article 32 requires the implementation of appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the pseudonymisation and encryption of personal data. A lawyer who transmits client personal data through an insecure communication channel may breach both the duty of confidentiality and the GDPR's data security requirements.
3. Technological Risks to Confidential Communications
3.1 Email
Email remains the primary communication channel between lawyers and clients, yet it is inherently insecure. Standard email (SMTP) transmits messages in plaintext, making them vulnerable to interception in transit. Even where transport layer security (TLS) encrypts the connection between email servers, the messages may be stored in plaintext on the servers themselves, and may be accessible to the email service provider, to law enforcement pursuant to lawful access orders, or to malicious actors who compromise the email server.
The ABA's Formal Opinion 477R concluded that unencrypted email is not inherently incompatible with the duty of confidentiality, but that lawyers must assess the sensitivity of the information being communicated and apply reasonable security measures accordingly. Where the information is highly sensitive, commercially valuable, or subject to heightened confidentiality requirements, the use of encryption is advisable and may be required.
3.2 Messaging Applications
The widespread use of consumer messaging applications, particularly WhatsApp, for lawyer-client communications creates risks that many practitioners do not appreciate. While WhatsApp implements end-to-end encryption by default, the application's terms of service permit the sharing of metadata (sender, recipient, timestamps, frequency of communication) with Meta's family of companies. The application's cloud backup feature, if enabled, may store message content in unencrypted form on Google Drive or iCloud, effectively circumventing the end-to-end encryption. Furthermore, where a client's phone is compromised by malware or physical access, the entire message history may be exposed.
Signal, by contrast, implements end-to-end encryption with minimal metadata retention and includes disappearing message functionality. However, Signal is a consumer application not designed for enterprise use, and its use for lawyer-client communications raises questions about record-keeping obligations and professional duty to maintain files.
3.3 Video Conferencing
The COVID-19 pandemic accelerated the adoption of video conferencing for lawyer-client consultations. Platforms such as Zoom, Microsoft Teams, and Google Meet vary in their encryption implementations, data retention policies, and jurisdictional data storage arrangements. The "Zoombombing" incidents of early 2020 highlighted the security vulnerabilities of widely used video conferencing platforms and the risk of unauthorised access to confidential meetings.
3.4 Cloud Storage
Lawyers increasingly use cloud-based document management and storage systems to maintain client files. The security of these systems depends on the encryption standards implemented by the cloud provider, the access controls configured by the law firm, and the jurisdictional location of the data centres in which the files are stored. The use of consumer cloud storage services (Google Drive, Dropbox, iCloud) for client files creates risks of data leakage, particularly where files are shared through publicly accessible links or where the lawyer's personal cloud account lacks adequate access controls.
4. Artificial Intelligence and the Duty of Confidentiality
4.1 AI in Legal Practice
Artificial intelligence tools have become increasingly prevalent in legal practice. AI-powered platforms are used for legal research, document review, contract analysis, due diligence, predictive analytics, and the drafting of legal documents. Large language models, including those offered by commercial providers, are used by lawyers for research, summarisation, and drafting assistance. The efficiency gains offered by these tools are substantial, but they introduce a category of risk to client confidentiality that the rules of professional conduct were not designed to address.
4.2 Data Processing and Training Risks
The central confidentiality risk of AI tools is that client data uploaded to or entered into an AI platform may be processed, stored, or used for the training of AI models in ways that compromise privilege and confidentiality. Where a lawyer uploads a client's contract to an AI platform for analysis, the platform may retain the document, process its contents, and incorporate the information into its training data, potentially making elements of the client's confidential information accessible to other users of the platform or to the platform provider's employees.
The terms of service of AI platforms vary significantly in their treatment of user-submitted data. Some platforms expressly provide that user inputs will be used for model training unless the user opts out. Others provide enterprise tiers that contractually prohibit the use of user data for training purposes. The lawyer's duty of confidentiality requires a careful assessment of these terms before any client data is submitted to an AI platform.
4.3 The Prompt Injection and Data Leakage Risk
AI tools are vulnerable to prompt injection attacks, in which malicious instructions embedded in documents processed by the AI tool cause the tool to disclose information from other documents or sessions. While this risk is primarily a cybersecurity concern, it has direct implications for lawyer-client confidentiality: if a lawyer processes multiple clients' documents through the same AI tool, a prompt injection vulnerability could result in the disclosure of one client's information to another.
4.4 Cross-Border Data Transfers
Many AI platforms are operated by companies based in the United States, and the data submitted to these platforms may be processed and stored on servers located outside the jurisdiction in which the lawyer practises. Where the lawyer is subject to the GDPR or the Nigeria Data Protection Act 2023, the cross-border transfer of client personal data to an AI platform may breach data protection requirements unless appropriate safeguards (standard contractual clauses, adequacy decisions, or binding corporate rules) are in place.
4.5 Hallucination and Professional Liability
AI-generated legal analysis may contain fabricated citations, incorrect legal propositions, or hallucinated case law. The reliance on such outputs without independent verification exposes the lawyer to professional liability and may result in harm to the client's interests. The cases of Mata v Avianca Inc in the United States, where lawyers submitted AI-generated briefs containing fabricated case citations, illustrate the professional conduct risks of unverified AI reliance.
5. Comparative Analysis of Professional Conduct Frameworks
5.1 United States
The American Bar Association's Model Rules of Professional Conduct were amended in 2012 to include a technology competence obligation within the duty of competence (Rule 1.1, Comment 8), requiring lawyers to maintain a reasonable understanding of the benefits and risks associated with relevant technology. Thirty-nine US states have adopted this technology competence standard. Rule 1.6 (Confidentiality of Information) requires lawyers to make reasonable efforts to prevent the inadvertent or unauthorised disclosure of, or unauthorised access to, information relating to the representation of a client.
ABA Formal Opinion 477R (2017) addresses the duty of confidentiality in the context of electronic communications, providing that lawyers must assess the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost and difficulty of implementing additional safeguards, and the extent to which the safeguards adversely affect the lawyer's ability to represent the client.
ABA Formal Opinion 512 (2024) specifically addresses the use of generative AI tools, advising lawyers to review the terms of service of AI platforms, to avoid uploading confidential client information to AI tools that may use the data for training purposes, and to supervise AI-generated outputs for accuracy and completeness.
5.2 England and Wales
The Solicitors Regulation Authority's Code of Conduct requires solicitors to keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents. The SRA's guidance on technology use emphasises the need for appropriate information security measures but does not prescribe specific encryption standards or platform selection criteria. The Law Society has issued practice notes on cybersecurity and cloud computing, but comprehensive guidance on AI usage in legal practice remains in development.
5.3 The European Framework
The CCBE has adopted a series of recommendations on the use of information technology in legal practice, including guidance on cloud computing and data protection. The CCBE's 2024 guidance on AI in legal practice advises lawyers to ensure that the use of AI tools complies with professional secrecy obligations, that client data is not used for AI model training, and that AI-generated outputs are verified for accuracy.
5.4 Nigeria
Rule 19 of the Nigerian Rules of Professional Conduct 2007 imposes a duty of confidentiality but does not address electronic communications, technology competence, or AI usage. The Rule was drafted before the widespread adoption of smartphones, cloud computing, and AI tools in Nigerian legal practice. The Nigerian Bar Association has not issued formal guidance on technology competence, electronic communication security, or the use of AI in legal practice.
The Nigeria Data Protection Act 2023 imposes data security obligations on data controllers, including lawyers who process client personal data, but it does not specifically address the use of AI tools or the risks to legal professional privilege.
6. Proposals for Reform
6.1 Technology Competence Obligation
Professional conduct rules in all jurisdictions should incorporate an explicit technology competence obligation, requiring lawyers to maintain a reasonable understanding of the benefits and risks of the technologies they use in legal practice, including communication platforms, cloud storage services, and AI tools. The Nigerian Bar Association should amend Rule 19 of the Rules of Professional Conduct to incorporate this obligation, following the model of the ABA's 2012 amendment.
6.2 Encryption Standards
Bar associations and regulatory bodies should issue guidance specifying minimum encryption standards for lawyer-client communications. For email communications involving sensitive client information, end-to-end encryption should be required. For messaging applications, only platforms that implement end-to-end encryption by default, that do not use message content for advertising or training purposes, and that provide adequate access controls should be approved for use in lawyer-client communications.
6.3 AI Usage Policies
Law firms and legal practitioners should adopt written AI usage policies that address: the categories of client data that may be submitted to AI platforms; the requirement to review and approve the terms of service of any AI platform before use; the prohibition on submitting client data to AI platforms that use user inputs for model training without appropriate contractual safeguards; the obligation to verify all AI-generated outputs for accuracy and completeness; and the requirement to inform clients about the use of AI tools in the provision of legal services.
6.4 Platform Selection Criteria
Regulatory bodies should develop platform selection criteria for lawyer-client communications, specifying minimum requirements for: encryption (in transit and at rest); data residency (jurisdiction of data storage); access controls (multi-factor authentication, role-based access); data retention and deletion policies; compliance with applicable data protection legislation; and audit and certification standards (SOC 2, ISO 27001).
6.5 Client Disclosure and Consent
Lawyers should be required to disclose to clients the communication platforms and AI tools used in the provision of legal services, and to obtain informed consent to the use of those platforms and tools. This disclosure should include information about the security measures implemented, the jurisdictional location of data storage, and any risks to confidentiality that the use of the platforms or tools may create.
6.6 Incident Response
Lawyers and law firms should implement incident response procedures for breaches of client confidentiality, including: immediate containment of the breach; assessment of the scope and impact of the breach; notification of affected clients; notification of the relevant bar association or regulatory body where required; notification of the data protection authority where the breach involves personal data; and documentation of the breach and remedial actions taken.
7. Conclusion
The duty of confidentiality is a foundational obligation of the legal profession, but the technological environment in which lawyer-client communications now occur creates risks that existing professional conduct frameworks do not adequately address. The use of unencrypted email, consumer messaging applications, insecure video conferencing platforms, and consumer cloud storage for client communications exposes confidential information to interception, unauthorised access, and data leakage. The emergence of AI tools in legal practice introduces additional risks: client data submitted to AI platforms may be processed, stored, or used for model training in ways that compromise privilege and confidentiality, and AI-generated outputs may contain fabricated citations or incorrect legal analysis.
The reforms proposed in this article, the incorporation of a technology competence obligation in professional conduct rules, the specification of minimum encryption standards, the adoption of AI usage policies, the development of platform selection criteria, the requirement for client disclosure and consent, and the implementation of incident response procedures, would provide a comprehensive framework for the protection of lawyer-client confidentiality in the digital age. The Nigerian Bar Association, in particular, should modernise Rule 19 of the Rules of Professional Conduct to address the realities of contemporary legal practice and to ensure that the duty of confidentiality is not undermined by the technologies through which it is now exercised.
Bibliography
American Bar Association, Formal Opinion 477R (2017)
American Bar Association, Formal Opinion 512 (2024)
Boon A, The Ethics and Conduct of Lawyers in England and Wales (3rd edn, Hart 2014)
Council of Bars and Law Societies of Europe, Code of Conduct for European Lawyers (2019)
Garfinkel S, 'Email Security in the Age of Surveillance' (2014) 57 Communications of the ACM 46
Greshake K and others, 'Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection' (2023) arXiv:2302.12173
Katz DM, 'Quantitative Legal Prediction' (2013) 62 Emory Law Journal 909
Lettieri N and others, 'AI Ethics and the Legal Profession: A Critical Assessment' (2023) 41 Computer Law and Security Review 105875
Solicitors Regulation Authority, Protecting Your Firm from a Cyber Attack (SRA Risk Report, 2022)
Back to contents ↑ 
