Lawyers have obligations under both the Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008 and the Privacy Act 1993 to protect clients’ personal information. More information about this is available in the Practice Briefing “Protecting Clients’ Personal Information”.
Lawyers may also have some obligations in relation to a third party’s personal information. This Practice Briefing looks at these and offers some practical steps for managing those obligations.
A Legal Complaints Review Officer decision (BO v DE LCRO 297/2012) reflects the inherent risks lawyers may face when communicating sensitive personal information to third parties, particularly by email.
In the LCRO case a lawyer communicated with a client’s ex-partner via a work email address. The communication contained sensitive personal information. The ex-partner was very upset that this communication may have been accessible to her employer. She complained to the Lawyers Complaints Service and the case was reviewed by the LCRO.
The LCRO declined to make any disciplinary findings. However, the decision highlights that lawyers not only owe obligations of privacy and confidentiality to clients but may also owe these duties to third parties.
The decision did not specifically refer to the Privacy Act 1993. However, an individual lawyer or law firm is an “agency” for the purposes of that legislation. As a result, the provisions of the Privacy Act and the Information Privacy Principles apply and outline how a lawyer must treat personal information, relating not only to clients, but to any other person.
Certain rules of professional conduct may also apply under the Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008 (RCCC) when communicating with third parties.
For example, communications with a represented person must be through that person’s lawyer except in limited circumstances (see r10.2 RCCC). A lawyer has a duty to conduct dealing with others, including self -represented individuals, with integrity, respect and courtesy. Rule 8.8 also provides for a duty of confidentiality which may arise outside of a lawyer-client relationship.
Any lawyer who needs to communicate with or about any person must take care to ensure that they are familiar with their obligations under the Privacy Act and the RCCC. This applies equally to clients and third parties alike.
In practical terms this includes: