Disclosure Outside the Organization

Rule 1.13(a) makes the organization the client: the lawyer represents the entity, acting through its duly authorized constituents.¹ Confidentiality follows the client. A report up the ladder, covered just above, stays inside the client, because it goes to someone in charge of the organization to give that person the chance to take corrective action.² A disclosure to a regulator, a prosecutor, a lender, or a newspaper hands the client’s information to people the client has not chosen to tell. Confidentiality is the default rule against that step, and paragraphs (c) and (d) of Rule 1.13 carve a narrow exception from it for lawyers who represent organizations.

The exception is the sequel to the up-the-ladder duty and makes sense only after that duty has been tried. Paragraph (c) is a permission, so the lawyer who qualifies may disclose but need not. Paragraph (d) withdraws even that permission from a lawyer hired to investigate wrongdoing or to defend the organization against it. The sequence expresses a priority. The lawyer first insists on compliance and seeks help from higher authority inside the organization, and reserves extraordinary measures, such as disclosure of confidential information to outsiders, for the anomalous circumstance in which the governing body proves utterly inadequate to the task.³

The permission also has a single beneficiary. It protects the organization, and the harm that can justify speaking is harm to the client the lawyer serves. An exam stem that pairs a wrongdoing officer with a sympathetic outsider invites the instinct to disclose in order to rescue the outsider, but the rule measures every disclosure against injury to the organization. Three questions organize what follows: when the permission opens, how far a permitted disclosure may reach, and which lawyers never receive it.

Conditions for Disclosure

Rule 1.13(c) opens only after the organization’s own governing authority has failed to deal with serious wrongdoing, and it reaches only as far as the lawyer reasonably believes necessary to prevent substantial injury to the organization. The lawyer may then reveal information relating to the representation outside the organization, whether or not Rule 1.6 permits it. The first group of conditions looks at what the organization did with the problem: despite the lawyer’s efforts under paragraph (b), the highest authority that can act on behalf of the organization must insist upon, or fail to address in a timely and appropriate manner, an action or refusal to act that is clearly a violation of law.⁴ The second group looks at the lawyer’s judgment about consequences: the lawyer must reasonably believe the violation is reasonably certain to result in substantial injury to the organization.⁵ Paragraph (d) then removes the permission from a lawyer retained to investigate an alleged violation or to defend against a claim arising from one, a limit taken up in its own subsection below.⁶

The conditions are stacked this high because outside disclosure is an extraordinary measure. The lawyer’s ordinary tools are to insist that everyone in the organization obey the law, to refuse to tolerate illegal behavior, and to seek help from higher authority; disclosure to outsiders is for the case in which the governing body proves utterly inadequate.⁷ Each condition below blocks a different way the permission could be misused.

Exam Analysis Steps

The permission arises only if every condition is met, so the first condition that fails ends the inquiry. Run the paragraph as a screen, in the order the facts usually unfold:

Confirm that the lawyer was not retained to investigate an alleged violation of law or to defend the organization or a constituent against a claim arising from one, because paragraph (d) withdraws the permission from that lawyer.
Confirm that the lawyer has made the efforts paragraph (b) calls for, so that the matter has gone up through the organization to the highest authority that can act.
Ask whether that highest authority has insisted upon the action or refusal to act, or has failed to address it in a timely and appropriate manner.
Ask whether the action or refusal to act is clearly a violation of law.
Ask whether the lawyer reasonably believes the violation is reasonably certain to result in substantial injury to the organization.
If every answer so far allows disclosure, limit what is revealed to what the lawyer reasonably believes necessary to prevent that injury.

Steps two and three test how the organization handled the matter, and they build on the reporting-up duty. The lawyer must have carried the matter to the highest authority that can act, which in a corporation means, if necessary, the board of directors.⁸ A lawyer who goes straight to a regulator has skipped the process on which the permission rests, because the governing body never had the chance to fail. The highest authority can fail in two ways. It may insist upon the wrongdoing by endorsing what the constituent has done, or it may fail to address the problem in a timely and appropriate manner.⁹ Those last words compare the response with the threat. An inquiry, corrective steps, or removal of the responsible person is the kind of response that fits a problem, even before the harm is undone.

The first board shows why a response still in progress does not open the permission. A board that is working on the problem has not failed, even if its lawyer is impatient or would have chosen a different remedy. Only a failure of response satisfies the condition, and disagreement over how the board is handling the matter does not.

The third condition requires that the action or refusal to act be clearly a violation of law. The word clearly sets the standard for the violation itself and keeps the lawyer’s reading of an unsettled legal question from displacing the board’s. Where reasonable lawyers could disagree about whether conduct is lawful, the violation is not clear, and a board that follows one reading has made a judgment instead of committing an unmistakable breach.

The fourth condition turns from the organization’s conduct to the lawyer’s judgment about its consequences, and it has three layers. The belief must be reasonable, which makes the test objective: a sincere hunch that would not persuade a careful lawyer with the same facts does not qualify. The injury must be reasonably certain, which is more than possible or even probable. And the injury must be substantial, which excludes harm the organization can absorb without real damage.¹⁰

The injury that counts is injury to the organization, because the organization is the client and paragraph (c) exists to protect the client.¹¹ The standard illustration is a corporate lawyer who learns that the chief financial officer is engaged in massive securities fraud and reports it to the board, which takes no action. The board has failed to address a clear violation, and the lawyer reasonably believes the fraud will cost the corporation substantial money. Paragraph (c) therefore allows disclosure, but only to the extent the lawyer reasonably believes necessary to prevent that harm.¹²

A lawyer who finds paragraph (c) closed has not necessarily exhausted every route, because paragraph (c) itself operates “whether or not Rule 1.6 permits such disclosure,” which treats Rule 1.6 as an independent source of permission. Keep the two questions apart on an exam. One asks whether the conditions of paragraph (c) are met, and the other asks whether some other rule independently permits the disclosure. Paragraph (c) protects the client, so any protection for outsiders harmed by the wrongdoing has to come from a different rule.

Even when every condition is met, paragraph (c) says that the lawyer “may” reveal information. It creates no duty to disclose, and the permission reaches only as far as the lawyer reasonably believes necessary to prevent the injury. The next subsection takes up that limit on scope.

Loyal Disclosure Only

Rule 1.13(c) ends with a limiting clause that governs everything a lawyer may do once the conditions are met: the lawyer may reveal information relating to the representation “only if and to the extent the lawyer reasonably believes necessary to prevent substantial injury to the organization.”¹⁴ Two limits sit in those words. Only if makes disclosure depend on a reasonable belief that revealing information is needed to prevent the injury, and to the extent confines the amount revealed to what that prevention requires.

Both limits measure necessity against a single target, injury to the organization. The target is the organization because it is the lawyer’s client, acting through its duly authorized constituents.¹⁵ A disclosure under paragraph (c) is therefore a loyal disclosure: an act in the entity’s interest alone, permitted because the entity’s governing body has left it exposed. The lawyer does not become a general enforcer of the law. The only sense in which an organization’s lawyer can be said to act as a whistleblower under Rule 1.13 is this limited, client-protecting one.¹⁶

The clause names no recipient, so necessity does the narrowing. A disclosure helps prevent injury only if the recipient can change what the organization is doing, and it stays within the permission only if it reveals no more than that change requires.

Hypothetical Illustration

A lawyer for a regional lender has reported to the board that the chief executive is sending falsified loan-quality reports to the lender’s bank regulator, and the board has voted to let the practice continue. Angry at the vote, the lawyer gives a newspaper reporter the lender’s entire file, including unrelated merger negotiations and personnel records. Most of what was revealed has nothing to do with the false reports, and a newspaper story does not compel the board to stop them. The disclosure is wider than any rescue of the lender requires, so paragraph (c) does not authorize it.

A second lawyer, facing a board that likewise refuses to act, delivers to the regulator only the falsified reports and the records showing they are false. The regulator can compel the lender to correct them, and nothing beyond what that task needs has left the file. This disclosure stays within what the lawyer reasonably believes necessary to prevent substantial injury to the lender, so the permission covers it.

Because the permission serves the client, a sympathetic motive to protect investors, customers, or the public does not enlarge it. The question under paragraph (c) is whether the disclosure is reasonably believed necessary to prevent substantial injury to the organization. Harm that would fall only on outsiders does not meet that test, and any other basis for disclosure has to be found under a different rule.

Statutory whistleblower protection works from a different definition, one that looks to who receives the information. Section 21F(h)(1) of the Securities Exchange Act, added by the Dodd-Frank Act, prohibits an employer from retaliating against a whistleblower, defined in section 21F(a)(6) as a person who provides information relating to a securities-law violation to the Commission.¹⁷ In Digital Realty Trust, Inc. v. Somers (2018), the Supreme Court applied that definition to an employee fired after reporting violations to his company’s senior management. It held that he fell outside the statute’s anti-retaliation protection because he had not reported to the Commission.¹⁸ The ethics permission asks a different question. It names no recipient and looks instead to whom the disclosure helps, which is the organization.

Investigation and Defense Exception

Rule 1.13(d) withdraws the permission in paragraph (c) from lawyers whose engagement is of a particular kind. Paragraph (c) does not apply to information relating to a lawyer’s representation of an organization to investigate an alleged violation of law, or to defend the organization, or an officer, employee, or other constituent associated with it, against a claim arising out of an alleged violation of law.²⁰ Two kinds of retention trigger the exception: an investigation of alleged wrongdoing, and a defense against a claim that grows out of alleged wrongdoing. The test looks to the purpose of the representation, so the lawyer’s assignment decides the question, whatever the lawyer later discovers. The word alleged means the exception does not wait for a finding that a violation occurred.

Comment 7 to Rule 1.13 explains the withdrawal as “necessary in order to enable organizational clients to enjoy the full benefits of legal counsel in conducting an investigation or defending against a claim.”²¹ Each engagement shows the point in its own way. In an investigation, the findings are the product the organization is paying for, and a lawyer who could pass them to outsiders would be building a case against the client with the client’s own resources. In a defense, the claim has already put the conduct in dispute, and the client depends on its lawyer as an advocate and not as a potential informant. Because the exception reaches the defense of an officer, employee, or other constituent as well as the entity, a firm retained to defend a company and its chief financial officer against a fraud claim stands where an investigating firm stands.²²

The exception is narrow in what it switches off. Paragraph (d) says that paragraph (c) shall not apply, and it says nothing about the reporting duty in paragraph (b).²³ A lawyer hired to investigate or defend therefore remains responsible for reporting findings about misconduct to higher authority within the organization.²⁴ Reporting findings to the organization’s governing authority delivers them to the client itself and discloses nothing outside it. The exception thus closes the outside route and leaves the inside route open, so the entity’s governing body can still learn of the problem and correct it while the organization keeps the candid counsel it hired. The exception removes a permission and creates no new duty, so the elements that trigger paragraph (b) must still be present. A common mistake is to read paragraph (d) as silencing the lawyer entirely, when it forbids only the step outside the organization.

An exam stem that shows a board ratifying a clear violation and asks whether the lawyer may go to a regulator tests two questions in order, and students tend to skip the first: what the lawyer was retained to do. Only a lawyer who was not retained to investigate or defend reaches the conditions of paragraph (c).

In both scenes the governing body has defaulted on a clear violation, and the lawyers’ options differ only because of what each was hired to do. The lawyer hired to investigate or defend keeps the duty to report up and loses the permission to report out. A lawyer who is discharged for acting on wrongdoing, or who withdraws, faces a separate duty under Rule 1.13(e), taken up in the next section.²⁵