Seized lawyer data in the cloud: inspection and sealing in Austria

Section 112 StPO is connected with protected professional communications. It must be read together with section 157(1) numbers 2 to 5 StPO. Those provisions concern persons who may refuse to give evidence because of professional confidentiality. Lawyers and defence counsel are covered within the scope of their professional work. The specific data set must therefore be linked to the person who entrusted the information, the professional relationship in which it arose and its content.

Section 9 RAO requires lawyers to keep confidential matters entrusted to them or learned in their professional capacity. The duty protects the relationship of trust with the client. It commonly covers advice, defence material, documents supplied by the client and communication about a mandate. A file is not automatically protected merely because it is stored in a law firm account. The connection to the mandate must be identifiable.

The review therefore starts with origin and function. A private note with no mandate connection must be assessed differently from a client email containing defence documents. In a mixed account, the material must be separated on a traceable basis.

Technical storage by a cloud provider does not automatically change the professional relationship between lawyer and client. The relevant factors are the data itself, the circumstances in which it was created and the purpose of the communication. An authority must distinguish protected mandate data from other data even where both are kept in one online account.

A direct request to the provider also requires review of the procedural basis, the addressee of the order and the data category identified. Stored content, traffic data and basic account data can be governed by different rules. A production request should not use a broad technical description to bypass professional secrecy.

The account structure matters in practice. Law firm folders, private areas, shared project folders and automatic backups may contain different types of material. The defence should provide a factual classification instead of describing every file as protected without distinction.

If protected data are found during a search or seizure, the objection to the measure should be raised immediately. The affected person should name professional secrecy expressly and ask for the affected files or data sets to be identified. The minutes should show when the objection was made and how the authority responded.

Sealing keeps the data set closed while the court decides whether seizure is lawful. The authority should not simply open or use sealed content for the investigation before that decision. The protection works only if the material remains unchanged. Deleting, sorting or editing it later can make classification more difficult.

A large account may require a technical copy. The record should then state who created it, how the data set was delimited and whether metadata were preserved. A traceable chain of handling helps determine whether the authority reached beyond the protected core.

The court decides whether protected items may be seized. It needs a clear description of the mandate, communication partners, period and data concerned. A general statement that all law firm data are confidential is not enough. At the same time, a technical collective label must not conceal a concrete mandate connection.

The appropriate response depends on the measure and its procedural stage. Review the seizure minutes, the order, any judicial decision and the date of service. Remedies against judicial decisions may be available under the applicable provisions. Legal review should address the data question and any procedural time limit together.

If the authority has already inspected the material, establish the scope of inspection as precisely as possible. Record search terms, opened folders, exported files and persons present where that information is available. This creates a basis for further applications and for assessing later use of the material.

The first record should preserve the original state. Save the order, minutes, cloud provider notices and every seizure confirmation. Note the time, authority, affected accounts and whether inspection has already begun.

Classify communications in a protected overview by mandate, communication partner, period and document type. The overview does not need to reproduce the content. It should explain why a data set falls within professional secrecy. This is particularly useful where an account contains different kinds of material.

Technical steps should be limited to preserving the state. Do not delete messages, move files or change access rights where that could affect the investigation or later evidence preservation. Have the technical record prepared by a qualified person and make every change traceable.