Using lawtech in your practice

Glossary of terms specific to this practice note

• Artificial intelligence: the theory and development of computer systems able to perform tasks normally requiring human intelligence, such as visual perception, speech recognition, decision-making
• Chatbot: a software application used to conduct an online chat conversation via text or text-to-speech, in lieu of providing direct contact with a human agent
• Lawtech: technologies that aim to support, supplement or replace traditional methods for delivering legal services, or that improve the way the justice system operates
• Machine learning: a subset of artificial intelligence that sees computer algorithms improve automatically from experience
• GDPR: General Data Protection Regulation that came into effect across the European Economic area on 25 May 2018 and was incorporated into UK law by the Data Protection Act 2018

Who should read this practice note?

All solicitors and members of their staff offering or planning to offer online legal services employing lawtech products.

What is the issue?

Practices introducing legal services employing lawtech face a number of regulatory and professional conduct challenges which they should address at the design or procurement stage by undertaking comprehensive risk assessments.

There have also been profound changes to the ways in which legal services are delivered since we published our practice note on semi-automated legal services in 2016. These relate not only to the products and services in the marketplace which employ new technologies, but to the advent of new regulations enabling solicitors to offer services outside of traditional legal entity models.

Changes to data protection law – the General Data Protection Regulation (GDPR) and Data Protection Act 2018 – have also taken effect since we produced our previous note and need to be taken into account.

In referring to ‘semi-automated’ legal services, the title of the 2016 practice note recognised the scope for the emergence of more fully, or wholly, automated legal products and services.

These services do not involve any review or consideration by, and aren’t under the supervision of, a solicitor pledged to review the implications of these for the duties of solicitors if and when they emerged.

As before, our view is that it’s unclear how the professional conduct risks from wholly automated legal services might be mitigated. While much has changed in the legal product and services landscape over the last four years, we’re yet to see such products come to market. We’ll continue to keep this under review and produce further guidance for the profession as required.

Lawtech delivery of client services

Online legal services involve interaction between a client and a practice's online system in which some automated decision-making is undertaken on the basis of information provided by the client. Appropriate human review is built-in to ensure that key issues and risks are taken into account.

Automated legal services differ from a traditional service in which there is no automated decision-making and which simply uses the internet as a communications channel.

Digital technology can provide many stages of a typical legal service including (but not limited to):

• client onboarding, including regulatory compliance checks
• acceptance of instructions
• analysis of a client's legal problem
• construction of a complete or partially packaged legal solution
• delivery of the solution
• billing and payment, and
• storage or archiving of relevant records
• secure communication with clients, including document sharing and video calling

Examples of current use of technology by law firms to deliver legal services include:

• the use of chatbots to provide generic legal information (with options for direct engagement with legal practitioners)
• fixed-fee online advice services in legal practice areas ranging from family law to contract law
• automated assembly of legal documents, including wills
• online applications for grant of probate
• uncontested online divorces
• debt recovery
• document review and disclosure

As practices and clients become more familiar with online legal services, further innovation in their range and nature is likely.

Lawtech use in firms

Machine learning capabilities are already allowing computers to recognise patterns in large data sets, reducing the need for laborious legal research. As well as these efficiency gains, lawtech is an increasingly important part of law firm management, and the work of in-house teams and the not-for-profit advice sector. However, technology is used in different ways.

Private practice

Research suggests the technology investment strategies of the top 50 law firms are increasingly focused on key infrastructure, with upgrades to:

• practice management
• client relationship management
• flexible and remote working by fee earners
• HR systems

Priorities are document review, demonstrating compliance with data protection requirements and cybersecurity are priorities.

Pressure from corporate clients and their general counsel is driving lawtech adoption, particularly where it’s providing more advanced billing solutions that corporate clients expect, while other professional sectors, such as banking, are driving uptake of machine learning solutions by firms.

In-house

In-house teams are using lawtech for efficiency gains and to meet business needs. They may, however, need to overcome internal challenges to lawtech adoption relating to traditional ideas about functional relationships in organisations. They’re under greater pressure to produce a verifiable business case justifying the expenditure on lawtech often to a greater degree than their colleagues in private practice.

Not for profit

Lawtech products are used to help with unmet legal needs and increase access to justice. Increasingly, lawtech is used to develop:

• frontline services for legal education
• information and advice through chatbots
• legal aid calculators
• legal triage tools

Lawtech’s role in unmet legal needs

Research by the Legal Services Board shows that over half of adults in England and Wales faced a legal problem in the last three years, yet only one in three sought expert advice or assistance.

This reticence is replicated by evidence showing that 63% of people don’t believe professional legal advice is affordable for ‘ordinary people’. Others put a figure as high as 80% for the number of people and small businesses that fail to get legal advice when they need it.

See our Lawtech Adoption Research report

The size of the ‘latent legal’ market implied by these numbers is potentially huge, and new methods of providing technology-based legal services to consumers are already happening. Some of the knowledge underpinning these methods is being delivered by lawyers, and successful legal businesses in future are likely to be those whose business planning and delivery models are best adapted to the use of technology to address unmet need and maximise market share.

As well as its role in providing quality legal services at affordable prices for the mass market, lawtech also has the potential to transform access to justice, ensuring that legal services are available to those with limited ability to pay.

We have investigated the extent to which technology is a key to unlocking access to justice in our Technology, Access to Justice and the Rule of Law report which found that, while technology is not a silver bullet to making the justice and legal systems more accessible, it certainly has a role.

The report has good examples of the application of technology by organisations to meet legal needs, and we’re working with academics and organisations to promote best practice in innovation and legal training.

The regulatory and professional conduct environment

SRA regulation is based on responsive and responsible conduct, and not on the tools firms use to achieve them. The principles of the SRA Standard and Regulations apply to your provision of legal services in general and do not distinguish between conventional legal services and services provided using lawtech products or services.

Delivery of legal services via lawtech must achieve the same minimum professional standards as your conventional services and, in order to ensure that they do so, you will need to decide which aspects of the service can be automated and which cannot.

The SRA’s approach to regulating technology is set out in its report Technology and legal services.

You must also satisfy generally applicable regulatory requirements, for example, in relation to the GDPR and Data Protection Act 2018 and the Equality Act 2010.

Data protection by design and default

As with most IT-related projects, it’s usually better to address professional and regulatory compliance early in the design or evaluation of your online legal service. It has always been good practice to carry out a privacy by design approach in project planning and the GDPR has made this a legal requirement under the term ‘data protection by design and by default’.

Additionally, where you propose using new technologies for data processing, and this is likely to result in high risk to the rights and freedoms of natural persons, you’re required to carry out a Data Protection Impact Assessment (DPIA).

The types of activities requiring a DPIA are set out in Article 35 of the GDPR, and the Information Commissioner’s Office (ICO) has published a list of the types of processing it considers high risk. Importantly, if a DPIA, is required, it must take place prior to the processing it assesses.

Your firm should have already considered the appointment of a Data Protection Officer (DPO) as part of its GDPR compliance. While most law firms will not be required to appoint a DPO under the GDPR, firms should evaluate their processing of personal data against the criteria for mandatory appointment. The ICO website has information on the appointment of DPOs.

If firms decide not to appoint a DPO, they should consider appointing a suitably senior and qualified person with the necessary resources to lead their data compliance function, and to involve them in any DPIA process.

There’s more information and guidance in our GDPR Guide for Law Firms 

You should also consider the free online tool designed by the French Data Protection Regulation that can walk you through the steps required to undertake a DPIA.

Price transparency

SRA transparency rules require solicitors and firms practising in particular legal areas to display prices and service information. There are requirements covering the format and clarity as well as the amount and nature of the information to be provided, and you’ll want to pay particular attention to these requirements in providing services to clients that employ lawtech systems and services.

ePrivacy Regulation

On 4 October 2019, the Presidency of the European Council published its revised text of the Proposal for a Regulation Concerning the Respect for Private Life and the Protection of Personal Data in Electronic Communications (the draft ePrivacy Regulation). It’s intended to replace the existing Privacy and Electronic Communications Regulations (PECR) which set specific rules on privacy rights in relation to electronic communications on:

• marketing calls
• emails, texts and faxes
• cookies (and similar technologies)
• keeping communications services secure
• customer privacy regarding traffic and location data, itemised billing, line identification, and directory listings

For now, the PECR remains in force, but you may wish to check the ICO website for developments

Testing and quality assurance

You should test systems employing lawtech products and services in the same way as supervisors monitor and assess the work of trainees. This should be done regularly to ensure your firm is maintaining the quality and ethical standards required. It should incorporate a structured quality assurance programme for the systems you buy or use.

Regulators will need to see evidence that you’re undertaking regular testing and quality assurance in order to demonstrate compliance. Consequently, records of the outcomes of all testing should be maintained. If testing reveals any risks, these should be added to the firm’s risk register and then reduced over time as a result of regular risk review meetings and actions.

All quality assurance, either internally or from external accessors, should be recorded and all recommended actions should be carried out without any undue delay. 

Responsibility for meeting your regulatory duties cannot be outsourced to separate technology providers. The SRA has made clear in sections 2.1, 2.3 and 2.5 of its Code of Conduct for solicitors that where flaws or errors exist in systems acquired from third parties, it’s unlikely to take regulatory action where firms have done everything they reasonably could to assure themselves that the system was appropriate and to prevent issues arising.

You should consider organising the regular, preferably annual, penetration testing of any lawtech system by an external accessor with suitable technical expertise. Any pen test should be accompanied by a written report detailing the outcome of a test and identifying any weaknesses or failures that need to be addressed. Any perceived failings should be addressed in a reasonable and proportionate manner depending on the severity of the risk identified and the reasonable resources available to manage that risk.

You should also consider the assessment of your organisation's preparedness in responding to a cyberattack that could lead to a data protection breach on our lawtech system, as highlighted in the Firm Code of Conduct (SRA Code of Conduct for Firms). The National Cyber Security Centre (NCSC) has a range of exercises that can be followed by teams and boards that are responsible for the identification and management of such risks, such as their Exercise In A Box. These tools are free of charge are used regularly to demonstrate compliance with both the GDPR and the SRA’s regulatory objectives.

Risk identification, assessment and evaluation

The Principles and the Codes (Combined Solicitor and Firm Codes) require compliance risks to be managed. In considering the use of lawtech systems or tools you should pay particular attention to: 

• Principle 2: to act in a way that upholds public trust and confidence in the solicitor profession and in legal services provided by authorised persons
• Principle 6: to act in a way that encourages equality, diversity and inclusion
• Principle 7: to act in the best interests of each client

Risk assessment involves the identification, categorisation and, as far as possible, mitigation of risk. Some risk will remain and may exceed the level you’re willing to accept.

Effective risk management is a positive obligation placed on:

• firms
• owners and managers
• Compliance Officers for Legal Practice (COLPs)
• Compliance Officers for Finance and Administration (COFAs)

You should have systems to monitor and manage risk continuously.

Your firm should have a risk register which should include any risks identified through the operation of any lawtech products and services.

Once identified, steps should be taken over time with due regard to the level of severity of that risk to amend or remove these risks through organisational or technical measures. You should keep a record of both identifying these risks and how you manage them to show compliance with regulatory objectives. These records may include copies of the risk register as updated over time as well as the minutes of periodical risk review meetings where risks have been identified and managed.

Where applicable, the minutes of partnership meetings, board meetings and wider compliance meetings may also contain evidence that demonstrates compliance with the need to demonstrate the management of these risks.

You should also carry out thorough due diligence on any technology partner, product or supplier.

The legal technology procurement checklist in the annexes to this note has guidance on questions that need to be asked regarding security, privacy and data protection compliance.

This should be done for all technology used by your firm, including communications technology such as digital phones, voicemail provision, video conferencing and instant messaging.

Free systems such Dropbox, Google Hangouts, LinkedIn Messenger and Facebook Messenger should not be used for business purposes. Should a client contact you on LinkedIn or engage in sending you messages on LinkedIn, get the conversation onto your secure business email as soon as possible.

The NCSC does not recommend the use of WhatsApp for business related activity. It can be fine for informal chats and social plans discussed by colleagues in a team, but it should not be used for contacting clients or for discussing client related business activity.

Risk and innovation

As noted above, SRA regulation is based on responsible and responsive conduct, rather than the tools used to meet them. This means that the SRA Principles and Codes still apply despite the absence of specific rules on the use of technology.

SRA Innovate is a programme to support legal businesses in managing the risks associated with innovation. This “regulatory sandbox” functions as a safe space for firms to test novel ideas and the SRA guarantees that no enforcement action will be taken if innovations bring firms into technical breach of its rules.

Understanding your client

If your semi-automated online legal service does not involve any direct personal interaction with a client, it may be impossible to assess matters, including:

• your client's vulnerability
• the possibility of undue influence and impersonation
• their full needs and circumstances

However, where there is some degree of interaction, your processes and procedures may be able to address such issues. How they do so should be documented.

Vulnerable clients

'Vulnerable client' is not defined in the codes and is probably not a fixed category. However, section 3.4 of the SRA Code of Conduct for Solicitors, RELs and RFLs states that you must “consider and take account of your clients attributes, needs and circumstances”.

In the Firm Code of Conduct at 4.2 you must “ensure that the service you provide to clients is competent and delivered in a timely manner and takes accounts of your clients attributes, needs and circumstance”.

Individuals can be temporarily vulnerable for physical, social or psychological reasons – for example, following an accident, arrest, bereavement or marriage breakdown. They may also suffer enduring physical or social vulnerability – for example, severe cognitive impairment or long-term homelessness. Vulnerability is therefore multi-faceted and may affect any client using an online legal service.

It’s important to adopt a broad definition within your organisation as to who could constitute a vulnerable client. They could be someone suffering from a physical disability which is non-visual that requires a significant amount of daily care and support or could be recovering from a serious or life-threatening illness.

Vulnerable clients may be heavily dependent on carers such as family members or close friends. It’s also important to take a holistic view of the potential vulnerability of a client. Decisions should not be made solely on the basis of income or social status that an individual could not be perceived as being in a vulnerable situation.

The SRA has confirmed that vulnerable clients are a supervisory priority.

Vulnerability is relevant to at least two of the mandatory principles:

• Principle 6: you must act in a way that encourages equality, diversity and inclusion
• Principle 7: you must act in the best interests of each client

Undue influence

Undue influence and duress are related to client vulnerability. How is the possibility of undue influence or duress to be identified when you’re dealing with a client remotely through a semi-automated online legal service?

You must consider the question of undue influence as part of your assessment of prospective semi-automated online services. The nature of the service, the scope for undue influence, and the characteristics (including potential vulnerability) of your client-base will be relevant. You may be able to identify high-risk categories of legal services which should not be delivered through a semi-automated online legal service or whose design should differ from the design of other, less risky, services.

It may be necessary to incorporate a risk assessment into the initial client onboarding process to identify whether the client could be under duress from another party. This could be more than just emotional pressure, it could be from:

• financial pressure
• the threat of debt
• withdrawal of a financial benefit or support

The assessment should be as thorough for online legal services as it would be for clients you meet in person.

The client's legal issues

One risk of providing a semi-automated online legal service is that a client's legal problem is incorrectly or incompletely diagnosed. This can arise where a client chooses a semi-automated online service without discussing with a solicitor whether or not it’s appropriate. You should consider this when designing their non-automated review processes. You should also take into account formation and limitation of retainers, as well as client care obligations.

Forming and limiting of retainers

You can seek to limit the scope of your retainer in relation to services, deliverables or liability. For example, you can provide online legal services on a non-advised basis (for example, providing precedents, lodging client-prepared papers at court). Typically, this will be in return for a smaller fee and/or for more sophisticated clients.

A solicitor or practice may not contract out of their regulatory or ethical responsibilities under the codes. (It should also be noted that a solicitor will be unable to limit the retainer in respect of many matters, for example, the advice not being accurate or suitable for the client's circumstances. In addition, such restrictions may constitute unfair contractual terms or undermine the ethical principles of the codes.)

You must give as complete information as possible prior to agreeing to provide a service, but clients with sufficient knowledge and experience can demand a specific service only.

Your duties under the code may be triggered as soon as preliminary advice is provided.

A recent example is the Court of Appeal case of Padden v Bevan Ashford [2011] EWCA Civ 1616, in which Lord Neuberger emphasised the fact that, just because advice was free, it did not relieve the firm from the responsibility of giving full advice and did not prevent the firm from being subject to the 'core minimum' duties set out by Lord Nicholls in Royal Bank of Scotland plc v Etridge [2001] UKHL 44.

Retainers for online legal services are likely to be concluded online. This means there is no opportunity to explain or negotiate the provisions in a retainer. You should ensure that audit trails in your online service show the valid establishment of a contract or retainer and its precise scope.

Client care

Client care (Section 1 of the Codes, Section 3 of Solicitor Code and Section 4 of the Firm Code) focus on providing proper standards of service that take into account the individual circumstances of clients.

The interests of the client will be different, depending on the matter in question and what sort of service is being provided. You should consider whether it’s appropriate to deliver a particular semi-automated online legal service. Sometimes face-to-face advice or video conferencing will be necessary as part of your non-automated review process.

You should ensure that you can provide continuity of service and have sufficient capacity to satisfy demand. Where your technology is provided by a third-party supplier, you remain responsible for the performance of the tool and for ensuring that it reflects changes in the codes, the law and professional legal practice.

You and your client must be clear about what service is being provided and the scope of the retainer.

Without knowledge of a client, identifying their needs and circumstances remotely using computer software may be a significant risk. Steps to mitigate this risk should be part of the design of the automated component of your online service. 'Off-ramps' – barriers to proceeding with the automated component of your semi-automated online service and directions to alternative forms of legal advice or assistance – should be considered.

Practices should provide clients with clearly written, relevant and prominently displayed information and guidance to inform their decisions. Whether a tick box mechanism is a sufficient/acceptable form of consent has not been tested in the UK courts.

Reserved legal activities

In thinking about appropriate human review for your semi-automated service, it’s essential to take particular care if you are offering a reserved legal activity.

There are a number of reserved legal activities under the Legal Services Act 2007. Not all will be relevant to the provision of semi-automated legal services. They are:

• the exercise of rights of audience (appearing as an advocate before a court)
• the conduct of litigation (issuing proceedings before a court and commencing, prosecuting or defending those proceedings)
• reserved instrument activities (dealing with the transfer of land or property under specific legal provisions)
• probate activities (handling probate matters for clients)
• notarial activities (work governed by the Public Notaries Act 1801)
• the administration of oaths (taking oaths, swearing affidavits, etc)

Anyone providing human review for a semi-automated reserved activity must be an authorised person for the service or their involvement will need to be such as to fall within the exemptions in Schedule 3 of the Legal Services Act 2007. Practices will be familiar with these provisions but should ensure that they’re considered in the context of the design and delivery of semi-automated services.

Appendix

The appendix to this practice note summarises some of the main generic compliance issues relevant to online legal services.

Other resources

• Information Commissioner’s Office, Data protection by design and default
• NCSC 10 steps to cybersecurity
• Web accessibility guidelines 
• National Cyber Security Centre
• Action Fraud