Minnesota Lawyers Professional Responsibility Board Drafts Opinion on Metadata: Law Firms Need to Prepare
March 01, 2010

In states across the U.S., including Minnesota, governing bodies are drafting and issuing opinions regarding an attorney’s professional responsibility regarding metadata. Historically, opinions on whether there is a significant risk with metadata and if so what must be done to address that risk have varied between attorneys, IT departments, management, bar associations and other governing entities. With increasing opinions specifically addressing an attorney’s ethical obligations regarding metadata, law firms must now address their management of metadata and develop specific policies or update existing policies to ensure they are in accordance.

On January 26, 2010, Minnesota’s Lawyers Professional Responsibility Board released Proposed Opinion No. 22 that deals with a lawyer’s ethical obligations regarding metadata, as follows:

“A lawyer has a duty under Rule 1.6, Minnesota Rules of Professional Conduct (MRPC), not to knowingly reveal information relating to the representation of a client, except as otherwise provided by the Rules. The lawyer’s duty not to knowingly reveal such information extends to and includes metadata in electronic documents.  Accordingly, a lawyer is ethically required to take reasonable care to avoid improper disclosure of confidential information in metadata in electronic documents. If a lawyer receives a document which the lawyer knows or reasonably should know contains inadvertently sent metadata, the lawyer shall promptly notify the document’s sender as required by Rule 4.4, MRPC.”

For the full draft of the opinion including the applicable rule and other published opinions on metadata, visit http://www.mncourts.gov/lprb/Opinion22.pd

What is Metatdata?
Succinctly defined, metadata is “data about data.”

Microsoft Word, Excel and PowerPoint include automated features to aid in document production and collaboration. These features embed electronic information (metadata) in a file which can reveal the identity of those who edited the
document (revision authors); track the time, date, and frequency of edits (track changes and revisions); reveal inserted comments and the document template; and other data employed to control the document’s text and format. It is the commonly held opinion that this information should be removed before a file is shared outside the firm’s electronic walls to avoid violating attorney client privilege, disclosing sensitive information to third parties and so on.

Many people think of tracked changes when they think of metadata. There have been numerous high profile cases where tracked changes inadvertently left in a document have had embarrassing, not to mention legal and ethical consequences. This mistake can be easily made.  An attorney switches on the Track Changes function to make edits to a document. After collaborating with his assistant and associates, he is satisfied with the changes. He decides to send it to the client for review by changing the document to “Final” in the “Tracking” section. 

The tracked changes disappear from the document. He assumes they are no longer there, clicks on Send via e-mail and sends the document to his client. The client opens the document to see all of the tracked changes displayed. This happened because the attorney did not accept all of the changes in the document, he merely hid them from view. When the client opened the document her “Display for Review” settings were set by default to “Final Showing Markup”, thus revealing all of the changes in the document. If the firm had a metadata policy in place that detailed when documents are “cleaned” before being sent externally, this situation would have been avoided.

A rule of thumb when understanding metadata is that every time a document is opened, edited and saved metadata is added by the application, the operating system or the user. While track changes may provide an obvious example, there are many other scenarios when metadata can cause a law firm problems.

For example, an attorney is creating a contract for a new client. The contract requires some standard language. Since she has prepared similar contracts before, the attorney opens up a contract created previously for another client in Microsoft Word, when she worked at a different firm.

Using “Save As” she saves the document under a new name, makes edits as needed and e-mails it to her client.  Upon receipt the client opens the document and, since they have heard about metadata, opens file properties to view any data. (File properties can be accessed in Office 2007 by clicking on the “Office Button | Prepare | Document Properties | Advanced Properties”). By viewing the “Statistics” tab the client sees a “Created” date of one year before they were a client and a “Modified” date of the date the attorney emailed the document. Even more puzzling in the “Summary” tab they see a different firm listed in the “Company” field. The client now has access to a history that reveals information the attorney should have not revealed. That history will stay with the document until it is “cleaned” using a metadata management tool.

Metadata of this type can be useful when searching for documents created in a specified time frame, or to gain quick access to documents from, for example, My Recent Documents. But a firm may not want to reveal this type of information to a client being billed time for creating the document. Metadata also exists in Excel files. Examples include: formulas left in cells; hyperlinks to other workbooks; and hidden rows, columns or worksheets. All can reveal information not intended for general distribution.

In PowerPoint you may not want to share presentation notes or comments attached to a presentation.  You can also embed hyperlinks to graphs or excel workbooks in a presentation which, if left will link back to the original document. Again, information you may not want to share.

There are three key components to developing a metadata policy - Establish, Enforce and Educate.

Establish a Metadata Policy

• Educate yourself about metadata and review the Minnesota proposed opinion (and other states and entities, as needed) regarding metadata.
• Review firm documents (on internal networks and published on external networks). Is your firm inadvertently sharing confidential information?
• Involve attorneys and your IT department and establish a firm approach based on your
  findings.?
• If necessary, bring in a consultant to advise your firm on a metadata policy.
• Moving forward, review your policy on a routine basis to address any new rulings on
  metadata.

Enforce the Policy
Consider purchasing metadata management software. The software you choose should be flexible enough to execute firm policy, automated enough to enforce firm policy and easy enough for users to understand and utilize.

The latest Microsoft Office program includes a metadata tool called “Document Inspector.” Since Microsoft applications add metadata to files, it presents a somewhat contradictory position for Microsoft to provide a tool for removing that metadata. Firms who already practice a metadata policy have found the main weakness with  Document Inspector is the lack of automation.  The onus is on individual users to "inspect" documents and then decide the metadata to remove, proving to be ineffective in enforcing a metadata policy throughout an organization. 

Metadata management software, on the other hand, removes metadata more thoroughly and is designed to help firms automate and therefore, enforce metadata policies. The most popular products available for metadata management can be found by searching for “metadata management software” in Google. 

Educate
The success of any policy hinges on the execution. A firm’s metadata policy will be more successful if staff can grasp what metadata is, when it can be useful, when it can be harmful and how to manage the metadata in documents.  Consider bringing in outside trainers to help educate your firm with hands on training.

The Minnesota Lawyers Professional Responsibility Board is requesting public comment about Proposed Opinion No. 22.  Comments should be submitted in writing by March 10, 2010 to Siama Y. Chaudhary, 1500 Landmark Towers, 345 St. Peter Street, St. Paul,
MN 55102. 

Randall Farrar is the president and co-founder of Esquire Innovations, Inc. (esqinc.com), a software company that develops Microsoft Office integrated applications for the legal market, located in Temecula, CA. Esquire’s products include iScrub 7, a metadata management application for Microsoft Office; iCreate 7, its popular document production and formatting software; iRedline 7, enhanced Word document comparison; and iDocID, software for adding a document ID to a Word or Excel document. Together, the four products are available as the combined package iOffice 7. Mr. Farrar can be reached at randall.farrar@esqinc.com.