Must a lawyer scrub metadata before sending a document, and can the receiving lawyer mine it or use special software to uncover it?

Plain-English summary

Lawyer A emails Lawyer B a draft agreement, and Lawyer B can use a standard word-processing feature to reveal the tracked changes (metadata), including revisions Lawyer A made and deleted. The opinion considers variations: Lawyer A later asks Lawyer B to delete the document unread because the metadata was left in by mistake, and Lawyer B has software designed to defeat metadata-removal tools. The opinion asks whether the sender must remove or protect metadata (see discussion), whether the recipient may use readily accessible metadata (yes, qualified), whether the recipient must tell the sender about it (no), whether the recipient must honor a delete-unread request (no, qualified), and whether the recipient may use special software to reveal the metadata (no).

On the sender's duty, the opinion applies Oregon RPC 1.1 (competence) and Oregon RPC 1.6(a) and (c) (confidentiality and reasonable care against inadvertent disclosure). It concludes that metadata may be information relating to the representation, so a lawyer using electronic communication must maintain at least a basic understanding of the technology or obtain adequate support, and must use reasonable care to prevent inadvertent metadata disclosure, for example by converting documents to PDF or scrubbing them; what counts as reasonable care changes as technology evolves. Using a paper analogy, a lawyer would have to take care not to send marked-up drafts or revision notes that could prejudice the client.

On the recipient's use, the opinion concludes that under Oregon RPC 4.4(b) a lawyer who receives a document and knows or should know it was inadvertently sent must notify the sender. Because the sender has a duty to use reasonable care with metadata, the recipient could reasonably conclude metadata left in a shared redline was intentional, so there is no duty to notify about readily accessible metadata. If the recipient does know or should know the metadata was inadvertently included, Oregon RPC 4.4(b) requires only notice, not return, and the recipient need not honor a request to delete the document unread; but the recipient should consult the client about whether to return or to retain and read it under Oregon RPC 1.2(a). Finally, using special software to thwart a sender's reasonable removal efforts may be analogous to surreptitiously entering the other lawyer's office and may violate Oregon RPC 8.4(a)(3).

In practice

This opinion (revised 2015) interprets the current Oregon Rules of Professional Conduct, but it is more than five years old, so readers should verify the current rule text before relying on specifics. The opinion holds that competence now includes understanding metadata risks and using reasonable care, such as converting to PDF or scrubbing, to keep confidential metadata out of documents sent to others. Per the opinion, the recipient's position turns on what is readily accessible: metadata visible with standard software may be used, with no duty to notify, but actively defeating a sender's reasonable removal measures with special software may be barred as dishonest under Oregon RPC 8.4(a)(3). The opinion holds that an inadvertent transmission triggers only a notice duty under Oregon RPC 4.4(b), and that the recipient should consult the client before deciding whether to return the document.

Common questions

Q: Does a lawyer have to remove metadata before sending a document?

A: The opinion concludes a lawyer must use reasonable care under the competence and confidentiality rules to avoid disclosing confidential metadata, which may include converting documents to PDF or scrubbing them, with reasonableness measured by current technology.

Q: Can the receiving lawyer look at metadata that shows up with normal software?

A: Yes, qualified. The opinion concludes the recipient may use metadata readily accessible with standard word-processing software and, given the sender's duty of care, need not notify the sender that it is present.

Q: If metadata was clearly left in by mistake, must the recipient delete the document unread?

A: No, qualified. The opinion concludes Oregon RPC 4.4(b) requires only notice to the sender, not return; the recipient need not honor a delete-unread request but should consult the client about whether to return or retain the document.

Q: Can a lawyer use special software to dig out metadata the sender tried to remove?

A: No. The opinion concludes that using software to defeat a sender's reasonable metadata-removal efforts may be like surreptitiously entering the other lawyer's office and may violate Oregon RPC 8.4(a)(3).

Background and rules framework

The opinion interprets Oregon RPC 1.1 (competence), Oregon RPC 1.6(a) and (c) (confidentiality and reasonable care), Oregon RPC 4.4(b) (receipt of inadvertently sent documents), Oregon RPC 1.2(a) (consulting the client on means), and Oregon RPC 8.4(a)(3) (dishonesty), corresponding to Model Rules 1.1, 1.6, 4.4, 1.2, and 8.4. It notes Oregon RPC 3.4(a) on not altering or concealing documents with evidentiary value.

Citations and references

Rules of Professional Conduct:

• Oregon RPC 1.1 / Model Rule 1.1 (competence)
• Oregon RPC 1.6(a), (c) / Model Rule 1.6 (confidentiality; reasonable care)
• Oregon RPC 4.4(b) / Model Rule 4.4 (receipt of inadvertently sent documents)
• Oregon RPC 8.4(a)(3) / Model Rule 8.4 (dishonesty, fraud, deceit, or misrepresentation)

Cases:

• Goldsborough v. Eagle Crest Partners, Ltd., 314 Or 336, 838 P2d 1069 (1992), voluntary production of privileged material

Other opinions cited:

• ABA Formal Ethics Op. No. 06-442 (review and use of metadata); Arizona Ethics Op. No. 07-03
• OSB Formal Ethics Op. No. 2005-150 (rev 2015) (inadvertently sent documents)

See also

• ABA Formal Op. 06-442: Review and Use of Metadata
• OSB Ethics Op. 2005-150: Inadvertent Disclosure of Privileged Information
• Alabama Ethics Op. 2007-02: Mining Metadata

Source

• Landing page: https://www.osbar.org/ethics/toc.html
• Original PDF: https://www.osbar.org/_docs/ethics/2011-187.pdf