Client Confidentiality: Duties for Legal Teams

What Client Confidentiality Covers

Client confidentiality covers more than legal advice: it can protect financial records, instructions and information learned while acting for the client. A statement bundle can expose a client’s relationships and spending as well as account balances.

The Law Council’s conduct-rules commentary also addresses confidential information obtained from prospective clients where no retainer follows. Treat initial enquiries as protected material when assessing access and later use.

Confidentiality and legal professional privilege answer different questions. Confidentiality governs disclosure of client information. Privilege protects qualifying communications from compulsory disclosure and has its own waiver rules. Sending a pre-existing bank statement to a solicitor does not automatically make it privileged.

Statutory privacy duties are separate again. A firm’s coverage under the Privacy Act needs its own assessment. A document marked confidential still needs a lawful disclosure decision, while an unmarked document can contain protected information.

Identify Authority and Any Permitted Exception

Identify the applicable professional rule and the proposed recipient before deciding whether disclosure is permitted. The Law Council’s adoption overview explains the jurisdictional framework. Its model rules and commentary do not replace the instrument binding the practitioner.

For example, Western Australia’s adopted Rule 9 recognises specified law-practice recipients. These include solicitors in the practice and people engaged for delivering or administering legal services for the client. Assess an outside provider against the actual wording and engagement. Being outside the office does not alone decide the answer.

Rule 9.2 separately permits disclosure through express or implied client authority, legal permission or compulsion and other defined exceptions. Those include confidential advice on the solicitor’s obligations, specified serious-offence or physical-harm prevention and disclosure to the practice’s insurer. Match the facts to the particular exception and its limits.

Express instructions can identify the expert, documents and analysis the client approves. Explain that scope before recording the authority. Where there are joint clients, address each client’s authority rather than treating one person’s instruction as everyone’s consent.

Implied authority is limited by the retainer. The Queensland Law Society’s guidance describes disclosure necessary or incidental to its proper conduct. A general instruction to investigate finances does not settle every later recipient or use.

For a subpoena or statutory demand, establish the legal requirement, its recipient and its scope. Assess privilege separately before production. Legal compulsion to provide specified records does not authorise sending the entire file to other people.

A Disclosure Decision Record

Use a short record that another supervising solicitor can follow. The following example is fictional and assumes the firm has obtained express client authority for the specified analysis.

Field	Example entry
Purpose	Reconcile transfers between two identified accounts
Information	Statements for those accounts over the agreed review period, plus a focused analysis instruction
Recipient	Named statement-analysis provider and agreed personnel handling the work
Authority	Client’s recorded instruction approving this provider, purpose and document scope
Limits	Use for this analysis only. No wider circulation or reuse. Agreed handling of copies
Checker	Supervising solicitor, before the approved package is released

If the provider later requests additional correspondence, return to the authority assessment. Record what changed before expanding the package.

Control Disclosure to Staff, Experts and Providers

Give each authorised recipient the information needed for their assigned work. A permitted recipient’s role does not make unrestricted access a sound default.

A colleague preparing advice may need the client’s instructions and the analysis. An independent expert preparing an opinion needs the assumptions and evidence relevant to that opinion. An outside statement-analysis provider needs the agreed financial records and a focused instruction about the analysis required.

For a service such as FinTrace, the work can replace hours of manual statement review with a searchable ledger and a source-backed findings report. Define the analysis scope before transferring documents. Ask any provider who handles the records, where processing occurs and whether subcontractors receive them. Establish the terms for access and onward disclosure, including how retained copies are handled.

Written instructions and a non-disclosure agreement can constrain the recipient’s use. They do not themselves establish the solicitor’s authority to disclose. Keep the authority decision distinct from the safeguards used to carry it out.

A Statement Package With Too Much Information

In this fictional matter, the client authorises reconciliation of transfers between two accounts. The matter folder also contains settlement advice, a draft affidavit and correspondence about an unrelated health issue.

Incorrect approach: share the whole folder because the provider has signed confidentiality terms. The folder reveals legal strategy and personal information beyond the approved analysis.

Correct approach: prepare a separate package of the authorised statements and focused instructions. Keep the originals intact. If a wider account history is necessary to follow a transfer, explain the additional need and assess authority before sending it.

Use recipient-specific access when exchanging that package. Legal client portals can help control delivery, but the folder permissions must reflect the decision already made. An information barrier addresses separation and access controls where required. It cannot create disclosure authority.

Respond to an Accidental Disclosure

Contain an accidental disclosure immediately and involve the supervising solicitor. A mistaken attachment or shared-folder invitation needs attention even if the recipient promises discretion.

1. Revoke the unintended link or access where possible. Ask the recipient to stop using or circulating the material.
2. Preserve the sent message, attachment list and access records. Establish what was available, who accessed it and whether it travelled further.
3. Escalate internally to the solicitor responsible for the matter and the firm’s incident lead. Record the containment steps and outstanding exposure.
4. Assess the professional response, including communication with the client and any insurer requirements. Obtain confidential advice where the decision needs it.

Avoid circulating the exposed material again while investigating. Preserve evidence of the incident separately from any request for return or deletion of recipient copies.

Containment does not determine whether privilege is waived, whether a remedy is available or whether statutory notification is required. A notifiable data breach assessment applies its own coverage and harm tests. Record those decisions separately and allocate responsibility for follow-up.

Maintain Confidence After the Retainer

Closing the matter does not release its confidential information for general use. The continuing duty requires access and later disclosure to remain justified.

Keep archive access tied to a work purpose. When a new adviser requests former-client material, establish their identity, the client’s authority and the requested scope before releasing anything. A relationship with the former client does not by itself authorise access.

At the end of outside analysis, reconcile the provider’s copies with the agreed return and retention arrangements. Identify any residual copies, their permitted retention basis and who can access them. Record how those restrictions continue after the work ends.

Before using matter facts in training or a case study, assess whether the client can be identified from the remaining details. Removing a name can leave a recognisable combination of transactions and circumstances. Decide the permitted use before copying information out of the closed file.