Confidentiality, Privilege, and Technology in Legal Practice: Navigating Ethical Duties in the Digital Age
By
Chidi Ezenwafor, MCArb, FIMC, CMS (Dist.)
Past Secretary, NBA Abuja Branch (Unity Bar)
 
Introduction
The legal profession has always rested on one indispensable foundation: TRUST. A client discloses sensitive facts, sometimes deeply personal, commercially valuable, or legally incriminating, in the confidence that their lawyer will protect that information with utmost fidelity.

Without that assurance, candid communication between lawyer and client would be impaired, and the administration of justice itself weakened.

Before now, the person-to-person conversation with clients and the use of secure filing cabinets and other physical security measures for keeping documents made it easier for this duty of confidentiality to be upheld.

However, legal practice has changed dramatically. Client instructions are now received by email, WhatsApp, Zoom, cloud-based document systems, and increasingly through artificial intelligence-enabled tools.

Conversations that once stayed within the knowledge of the lawyer and files that once sat securely in locked cabinets now exist in digital repositories vulnerable to hacking, accidental disclosure, device theft, and technological misuse.

This reality presents an unavoidable question: Can traditional duties of confidentiality and privilege survive the pressures of modern technology?

The answer is yes—but only if legal practitioners understand both the ethical principles and the technological risks that now define modern practice.

Understanding Confidentiality and Privilege

Though often used interchangeably, confidentiality and privilege are not the same.

Confidentiality is the lawyer’s ethical and professional duty to protect all information relating to the representation of a client, regardless of its source. This obligation is broad. It extends beyond courtroom matters and survives the termination of the lawyer-client relationship.

Privilege on the other hand, particularly legal professional privilege (or attorney-client privilege), is narrower. It is a legal protection that shields certain communications between a lawyer and a client from compelled disclosure, particularly in litigation or investigations.

Put simply:
Confidentiality is an ethical duty; privilege is an evidentiary protection.

A lawyer may owe confidentiality over information that is not legally privileged, but privileged communication will almost always attract confidentiality obligations.
This distinction matters more than ever in the digital era.

The Nigerian Legal Position

In Nigeria, the duty of confidentiality is firmly rooted in professional ethics.
Rule 19 of the Rules of Professional Conduct for Legal Practitioners 2023, imposes a clear obligation on lawyers to preserve client confidences and secrets. This duty is not optional. It is central to professional integrity and the administration of justice.

The Evidence Act 2011 also in Sections 192–196 protects privileged communications between legal practitioners and clients, subject to recognized exceptions.

These protections exist because the justice system depends on full and frank disclosure between lawyer and client. A client who fears exposure may withhold crucial facts, thereby impairing legal representation and undermining fair adjudication.

However, the legal principles developed in a paper-driven era are now being tested by digital realities.
Technology Has Changed Legal Practice Forever.

Though Technology has undeniably improved legal practice, communication is faster, Research is more efficient, remote collaboration is easier and virtual hearings have expanded access.

Document automation has reduces repetitive work and AI-assisted drafting and analytics tools are increasingly common however, convenience has introduced vulnerability.

A lawyer who once worried about misplaced physical files must now worry about:

• hacked email accounts;
• unsecured cloud storage;
• compromised mobile phones;
• intercepted virtual meetings;
• metadata leaks;
• phishing scams;
• accidental forwarding of privileged communications;
• AI platforms retaining confidential prompts;
• insecure public Wi-Fi exposure.

The issue is no longer whether technology should be used in legal practice. That debate is over.
The real issue is whether lawyers are using technology responsibly.
 
The WhatsApp Lawyer Problem

One of the most common realities in modern practice is client communication through WhatsApp.

Clients send sensitive instructions through instant messaging because it is convenient, informal, and immediate but convenience can be deceptive.
Phones are lost. Devices are shared. Backups may sync to unsecured cloud accounts. Screenshots can be circulated in seconds. Family members may access unlocked devices etc. A privileged legal discussion can become public through one careless moment.

These associated risks do not mean lawyers must abandon modern communication tools. It means they must appreciate the risks and establish boundaries.

A lawyer who freely discusses highly sensitive matters over insecure channels without safeguards may be exposing client confidences in ways inconsistent with professional duty.

Email Is Not Automatically Secure

Many practitioners assume email is inherently professional and therefore secure. However, common risks still exist. These include:

• sending documents to the wrong recipient;
• replying-all with confidential information;
• email account compromise;
• weak passwords;
• phishing attacks disguised as legitimate correspondence;
• unencrypted attachments.

A single mistaken click can expose privileged strategy memoranda, settlement positions, witness statements, or commercial secrets.
Technology does not excuse negligence.

In fact, the more accessible communication becomes, the greater the duty of caution.
 
Cloud Storage and Digital File Management

Law firms increasingly rely on cloud systems for document storage, collaboration, and remote access.
The benefits are obvious:

• flexibility;
• remote working capability;
• efficient document retrieval;
• reduced infrastructure costs.

 
But significant questions arise about which includes:
Where is the data stored?
Who has access?
Is the provider secure?
Is the information encrypted?
What happens after a breach?
 
Client information cannot be treated casually simply because it exists in digital form.
 
A lawyer therefore remains responsible for safeguarding confidential information even when third-party technology providers are involved. Delegating storage does not delegate ethical responsibility.
 
Artificial Intelligence (AI): Opportunity and Danger

Perhaps no recent development poses more complex questions than artificial intelligence. AI tools can summarize documents, generate drafts, assist research, analyze contracts, and improve efficiency.

For overburdened practitioners, these tools are undeniably attractive. But AI introduces serious confidentiality concerns. If a lawyer uploads confidential pleadings, contracts, witness statements, or strategic case information into an unsecured AI platform, critical questions arise:

• Is the data stored?
• Is it used for model training?
• Can third parties access it?
• Does use of the tool amount to disclosure?

 
These are not hypothetical concerns.
The ethical issue is straightforward: a lawyer cannot compromise client confidentiality in pursuit of convenience.

AI should be treated as a professional tool requiring informed caution—not casual experimentation.

Competence in modern practice increasingly includes technological competence. Competence now includes:

• understanding secure communication tools;
• recognizing cyber risks;
• managing digital records responsibly;
• supervising staff technology practices;
• understanding AI limitations;
• safeguarding client data.

 
Ignorance will usually not avail a practitioner. Thus, legal practitioners must deliberately embrace safeguards against the above stated challenges of technology and many more such as metadata issues, virtual hearing concerns, wrong use of social media and cybersecurity concerns faced on a daily basis.
 
Practical safeguards include:

Given the associated risks to the use of technology in legal practice, some practical safeguards are;

1. Secure Communication Protocols
   Use secure channels for sensitive communication. Avoid casual handling of privileged matters over vulnerable platforms.
2. Device Security
   Protect phones, laptops, and tablets with strong authentication and remote wipe capability.
3. Email Verification Discipline
   Always verify recipients before sending confidential communications.
4. Staff Training
   Confidentiality breaches often result from human error rather than malicious intent.
5. Metadata Review
   Clean documents before external transmission.
6. AI Governance
   Never input confidential client material into tools without understanding privacy implications.
7. Access Control
   Not every staff member requires access to every client file.
8. Incident Response Planning
   Firms should know what to do if a breach occurs.
9. Virtual Hearing Protocols
   Ensure private environments and secure connections.
10. Social Media Restraint
    Professional branding should never compromise client secrecy.

 
Conclusion

Confidentiality and privilege are not outdated concepts struggling to survive modern technology. They are enduring principles being tested by new realities. Technology has made legal practice faster, smarter, and more accessible.
 
It has also made breaches easier, mistakes costlier, and ethical vigilance more important than ever. The lawyer of the digital age must be more than legally knowledgeable. They must be technologically responsible.
 
This is because in legal practice, trust remains the most valuable currency—and once confidentiality is lost, rebuilding that trust may be far harder than recovering any file.