You find a suitable tool, upload the file, download the result and get on with your work. But there was one more action in the middle: you transferred a client document to an external system.
The question is not whether the tool is convenient or free. The question is who gained access to the document, for how long, and for what purpose.
Five questions before you click UPLOAD
- Is the file processed locally in the browser, or sent to an external server?
- Is it deleted when the task is done, and who commits to that?
- Where are the servers, and does this involve transferring data abroad?
- May the provider make any further use of the data?
- Did the full document need to be uploaded, or could it have been reduced and redacted?
In practice
What does the law say?
First: confidentiality and privilege. Client materials are subject to a duty of professional confidentiality, and some are also protected by attorney-client privilege under the law. A client document is not "just a file": the duty of confidentiality under Rule 19 of the Israel Bar Association Professional Ethics Rules, together with privilege under section 90 of the Israel Bar Association Law, applies to it in PDF format too. Exposure of confidential or privileged material may cause irreversible harm.
Then: privacy. There is no blanket ban on using an online tool as an external service. But where the external service involves giving access to personal data from a database, check whether Regulation 15 of the Privacy Protection (Data Security) Regulations applies and set up the engagement accordingly. A server located outside Israel also requires checking the regulations on transferring data abroad and the conditions for transfer.
What to do
- Prefer tools that process data locally on your computer, but do not assume they do not upload anything. Verify it.
- Approve a list of permitted tools for the office in advance, instead of searching ad hoc when the need arises.
- Minimize before uploading: a single page instead of a whole file, redaction, and consider removing metadata.
This week's check
The next time someone needs to edit a PDF, ask them: how? If the answer is "some website", you have found a procedure worth putting in place. Sometimes the risk does not begin with a cyberattack. It begins with the UPLOAD button.
This content is for professional information only and is not legal advice or a substitute for it.
