Florida Law Firms and Copier Hard Drives Under Bar Opinion 10-2

Florida lawyers have a stated duty to protect client information stored on the hard drives of copiers, printers, scanners and fax machines. Florida Bar Ethics Opinion 10-2 says a lawyer must take reasonable steps to keep that information confidential and must make sure the machine is sanitized before it is sold, returned to a leasing company or discarded. Rule 4-1.6(e) of the Rules Regulating The Florida Bar and the technology comment to Rule 4-1.1 put the same expectation into the rules themselves.

This guide is written for managing partners, firm administrators and IT leads at law offices in Miami, Fort Lauderdale, Pompano Beach and the rest of Florida. It is general information, not legal advice, so confirm your firm's obligations with ethics counsel.

Why does a law firm copier hold client data?

A modern office copier is a networked computer with a printer attached. The Federal Trade Commission's guide on digital copier data security puts it plainly: the hard drive in a digital copier stores data about the documents it copies, prints, scans, faxes or emails.

Opinion 10-2 walks through the exact risk. When a lawyer copies a document on a machine with a hard drive, the document becomes a file on that drive, and it usually stays there until it is overwritten or deleted. If the firm later sells the copier or returns it to a leasing company without removing that data, client information can leave the building with it. The FTC adds that deleting files or reformatting the drive does not actually remove the data, which can still be recovered with utility software.

For a litigation or transactional practice, that drive can hold privileged memos, medical records produced in discovery, settlement figures and financial statements.

What does Florida Bar Ethics Opinion 10-2 require?

The Florida Bar's Professional Ethics Committee issued Opinion 10-2 on September 24, 2010, at the request of the Bar's Board of Governors. It covers computers, printers, copiers, scanners, cellular phones, flash drives, memory sticks, fax machines and other equipment that stores information. Its summary: a lawyer who uses such equipment must take reasonable steps to ensure client confidentiality is maintained and that the equipment is sanitized before disposition.

The opinion lists four reasonable steps:

1. Identify the potential threats to confidentiality, then develop and implement policies to address them.
2. Keep an inventory of the equipment that contains hard drives or other storage media.
3. Supervise nonlawyers, including outside vendors, and obtain adequate assurances that confidentiality will be maintained.
4. Take responsibility for sanitization, which includes requiring meaningful assurances from the vendor when the machine arrives and confirmation or certification of sanitization when it leaves.

Two details matter most for copiers. First, the opinion says it is not sufficient to merely obtain an agreement that the vendor will sanitize the machine. The lawyer has to confirm it, either through meaningful confirmation or by having the sanitization done at the lawyer's office. Second, the duty runs from the day the firm takes control of the machine through its whole life, including after it leaves the firm's control.

The opinion also tells lawyers to use care with machines they do not control, such as those at copy centers and hotel business centers, and to determine whether using them would preserve confidentiality.

Which Florida Bar rules apply?

Advisory ethics opinions are not binding, as the Bar notes on each one. The rules they interpret are. Opinion 10-2 applied Rules 4-1.6, 4-1.1 and 4-5.3, and the Bar has since added subdivision (e) to Rule 4-1.6, which now states the duty directly:

A lawyer must make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the client's representation.

That is Rule 4-1.6(e), "Inadvertent Disclosure of Information," as it reads in the Rules Regulating The Florida Bar updated October 1, 2026. The comment to the rule says a disclosure is not a violation if the lawyer made reasonable efforts to prevent it, and it lists the factors used to judge reasonableness: how sensitive the information is, how likely disclosure is without more safeguards, what added safeguards cost, how hard they are to implement, and how much they would hurt the lawyer's ability to represent clients. The same comment says a lawyer sending client information must take reasonable precautions to keep it from reaching unintended recipients, which applies directly to scan-to-email.

Rule 4-1.1, on competence, carries a comment telling lawyers to keep up with "the benefits and risks associated with the use of technology, including generative artificial intelligence." Florida backs that with a continuing education requirement: under Rule 6-10.3(b), at least 3 of the 30 credit hours each lawyer completes every three years must be in approved technology courses.

Rule 4-5.3 makes lawyers responsible for reasonable efforts to ensure nonlawyers act consistently with the lawyer's obligations. Its comment names "sending client documents to a third party for printing or scanning" as one example of using nonlawyers outside the firm. Opinion 10-2 applies that supervision duty to the outside vendors who service a firm's copiers and scanners.

A copier checklist for Florida law offices

These steps turn Opinion 10-2 and Rule 4-1.6(e) into routine office practice.

1. Inventory every machine with storage. List each copier, MFP, scanner, fax and printer with internal storage, with its model, serial number, location and whether the firm owns or leases it. Include satellite offices and any machines at home offices.
2. Turn on encryption and overwrite. The FTC recommends both, and it advises securely overwriting the entire hard drive at least once a month. Confirm the settings are on, not just available.
3. Control access and use secure release. Require a badge, PIN or login at the machine, and hold print jobs until the user releases them in person, so a confidential filing never sits in an open output tray. Restrict the administrator panel and change default passwords.
4. Lock down scan-to-email. Route scans to your document management system or to firm addresses, limit free-typed outside addresses, and review the shared address book regularly.
5. Put vendor assurances in writing. Your lease or service agreement should state how technicians handle stored data, what happens to a drive replaced during a repair, and how sanitization will be confirmed at the end.
6. Plan the return before the lease ends. Check whether your agreement says the firm keeps the hard drive or the provider will overwrite it. Then have the drive sanitized at your office or get a written confirmation tied to the serial number, and keep it in the file. Do not pull the drive yourself: the FTC warns that removing and destroying it without replacing its firmware can leave the machine inoperable. NIST Special Publication 800-88, Revision 2, is the federal guideline on media sanitization methods.
7. Write the policy down and train staff. Opinion 10-2's first step is a policy, and its third is supervision. Make sure assistants and paralegals know which machine to use for which matters and what to do when a technician arrives.

What about Florida's data security statute?

Opinion 10-2 warns that misuse of this equipment can also violate state and federal laws that protect sensitive personal information such as medical records and Social Security numbers. A key Florida example is the Florida Information Protection Act, section 501.171 of the Florida Statutes, which requires reasonable security measures, proper disposal of customer records and breach notice within 30 days. Our guide on HIPAA and Florida privacy law for medical office copiers covers that statute in detail.

Talk to a local DEXpert

DEX Imaging is headquartered in Tampa and serves law firms across Miami-Dade and Broward from its South Florida offices in Miami, Fort Lauderdale (Miramar) and Pompano Beach, with the same support for firms in Tampa Bay and the rest of Florida. Our print security service covers drive encryption, secure overwrite, secure print release and user authentication at the machine. When a machine leaves your office, your DEX rep will ask whether you want its hard drive wiped, and DEX will wipe it for you if you do. See how DEX works with legal and professional services firms, or request a quote and a local DEXpert can walk your office through the checklist above.

Frequently asked questions

Is Florida Bar Ethics Opinion 10-2 binding?

No. The Florida Bar states that advisory ethics opinions are not binding. The rules the opinion applies, including Rules 4-1.6, 4-1.1 and 4-5.3, are binding on every Florida lawyer.

Is a leasing company's promise to wipe the drive enough?

Not under Opinion 10-2. The opinion says it is not sufficient to merely obtain an agreement that the vendor will sanitize the machine; the lawyer needs meaningful confirmation or certification, or can have the sanitization done at the firm's office.

How much technology CLE do Florida lawyers need?

Rule 6-10.3(b) requires 30 credit hours of continuing legal education every three years, and at least 3 of those hours must be in approved technology courses.

Can we use a copy center or hotel business center for client documents?

Opinion 10-2 says lawyers should use care with machines in public places such as copy centers and hotel business centers, and should determine whether using them would preserve confidentiality before relying on them.

Does the opinion cover printers and scanners as well as copiers?

Yes. The opinion lists printers, scanners and fax machines along with copiers, and its focus is any equipment with a hard drive or other storage media, so check the specifications of every model in the office.