CBA Record September-October 2022

VO*WL/*(+U /S W/0uVU0)OsL O0S/+2s)O/0& Vs)s r+UsWPU*& WnrU+fs))sWM*& s0V /)PU+ related issues. While both Florida and North Carolina had previously required their lawyers to receive education in )UWP0/L/Qn QU0U+sLLng XUp y/+M rUWs2U )PU u+*) 9e=e N(+O*VOW)O/0 )/ +U,(O+U that lawyers receive training in cyber f security, privacy, and data protection. Such a requirement is eminently rea f */0srLUe a/+ 2(L)O-LU +Us*/0*g Lsp u+2* continue to be among the most sig f 0OuWs0) )s+QU)* /S WnrU+s))sWM*e !POUS s2/0Q )PU2 O* )Ps) Lsp u+2* )U0V )/ store extremely sensitive – and, to cyber f attackers, valuable – information, includ f O0Q -U+*/0sLLn OVU0)OusrLU O0S/+2s)O/0g WLOU0)*5 u0s0WOsL Vs)sg PUsL)P O0S/+2s)O/0g and intellectual property. For example, if n/(+ Lsp u+2 +U-+U*U0)* s u0s0WOsL O0*)Of tution in litigation, the institution has LOMULn *Ps+UV W/0uVU0)OsL O0S/+2s)O/0 pO)P n/(+ u+2e a/+ s WnrU+ s))sWMU+g O) O* much easier to breach that information 'Os s Lsp u+2 O0*)UsV /S )P+/(QP u0s0f cial institutions, mainly because they have historically had much stronger security -+/)/W/L* )Ps0 Lsp u+2*e ^)5* )PU /--/f site of the old joke about robbing banks rUWs(*U )Ps)5* pPU+U )PU 2/0Un O* T O0 these instances, the bad actors get what )PUn ps0) S+/2 )PU rs0M5* Lsp u+2*g rather than the banks themselves. Indeed, cyberattacks and attempts against law u+2* Ps'U W/0)O0(UV )/ O0W+Us*U )/ *(WP a number that it is becoming increasingly VOSuW(L) S/+ u+2* )/ /r)sO0 WnrU+ O0*(+f ance – a topic for another day. It is cer f tainly reasonable to require lawyers to have educational training in this area, as it continues to be of more importance in our legal industry and our clients. Illinois has not yet adopted a require f 2U0) LOMU XUp y/+M5*g s0V s* Ss+ ^ M0/pg no such requirement is being considered. But for those who also have licenses in XUp y/+Mg pU 0/p pOLL Ps'U )/ S(LuLL )PO* +U,(O+U2U0) O0 UsWP /S XUp y/+M5* reporting periods. Moreover, it is likely that other jurisdictions will begin to adopt this requirement. Lawyers and law u+2* W/0)O0(U )/ rU *OQ0OuWs0) )s+QU)* of cyberattacks, and there is no chance that risk will abate any time soon.

PRACTICAL ETHICS BY TRISHA RICH Evolving Technological Competence Requirements M ost of us will remember when the Illinois Supreme Court amended Supreme Court Rule

2017, Illinois was only the third state to require lawyers to complete programming in mental health and substance abuse education, and the fourth to require law f yers to complete diversity education pro f gramming. Since that time, many other states have added similar requirements. Now a new requirement may be on the horizon. Although more than 40 jurisdictions have amended their rules of professional conduct to include a duty of technological competency (including ^LLO0/O*g S/(0V O0 !/22U0) wDv /S ^LLO0/O* Rule of Professional Conduct 1.1), earlier )PO* nUs+g XUp y/+M N(*) rUWs2U )PU u+*) state to require its attorneys to complete one hour of CLE each reporting period in cybersecurity, privacy, and data protection. XUp y/+M5* +(LU* sL*/ O0WL(VU )PU +U,(O+Uf ment for competence in technology, but 0/p )PU *)s)U5* POQPU*) W/(+) Ps* )sMU0 )PU additional step of requiring its lawyers to S(LuLL )PU Uo)+s UV(Ws)O/0 +U,(O+U2U0)e According to the new requirement, *(WP UV(Ws)O/0 2(*) +ULs)U )/ LspnU+*5 obligations to protect electronic data and communications. It may include such *(rNUW)* s* )PU */(+WU* /S LspnU+*5 /rLOQsf )O/0*& )PU -+/)UW)O/0 /S W/0uVU0)OsLg -+O'f ileged, and proprietary information and Vs)s& W/22(0OWs)O/0 s0V *)/+sQU -+/)/f W/L*& +O*M* s0V -+O'sWn O2-LOWs)O/0*& *UW(f rity issues related to protecting monies O0 U*W+/p& O0sV'U+)U0) /+ (0s()P/+OmUV

794(d) in 2017. Before that, Illinois attor f neys were required to complete 30 CLE hours each reporting period (every two years), six credits of which had to be in professional responsibility topics. After the amendment of Rule 794(d), lawyers must complete 30 hours of CLE credit, includ f ing six in professional responsibility topics. Still, two of those six hours must include one hour each in (a) diversity and inclusion and (b) mental health and substance abuse. Until the 2017 amendment, the Illinois Supreme Court had encouraged lawyers to take additional courses in both sub f jects for many years, given the impact that both have on the practice of law. How f ever, statistical tracking over many years indicated that the number of courses offered in both diversity education and mental health and substance abuse educa f tion had remained nearly unchanged, as did the number of Illinois lawyers com f pleting such programs. So, the Court for f mally amended the rule in 2017, requiring Illinois lawyers to complete such courses every other year. Since then, the number of courses offered in those topics, and the number of lawyers taking those courses, have skyrocketed – in short, the Illinois Supreme Court found that the carrot was not working, so it employed the stick. In

Trisha Rich is a litigator and legal ethicist at Holland & Knight and the President of the Association of ProfessionalResponsibilityLawyers, thenational bar association for legal ethicists. You can reach her at trisha.rich@hklaw.com, onLinkedInat linkedin.com/ in/trisharich, or on Twi tt er @_TrishRich.

50 September/October 2022