Attorney Liability When Using Consumer Information Obtained Without Permission

The Legal Minefield: Why Attorneys Must Understand Permissible Purpose

In today’s legal landscape, the wrong investigative approach can transform a routine case into a professional liability nightmare that destroys careers. Attorneys face devastating consequences when they use information obtained from consumers without proper legal authority—consequences that include massive civil judgments, criminal prosecution, bar complaints, and permanent damage to professional reputation.

The Cautionary Tales: Real Consequences for Real Attorneys

The Kathy Lawlor case stands as the definitive warning about investigative liability. When investigators obtained Lawlor’s telephone records through pretexting—impersonating her to obtain private information without consent—the resulting judgment exceeded $1.8 million. More critically for attorneys, North American Corporation learned that companies cannot escape liability by outsourcing investigative work, even through multiple layers of contractors. The court held the company fully accountable for privacy violations committed on their behalf, regardless of the “distance” between the company and the actual perpetrator.

Private investigators have faced criminal prosecution for impersonating taxpayers to obtain IRS information. These weren’t civil penalties—these were criminal charges that resulted in incarceration. Attorneys who used such information faced their own investigations, bar complaints, and in some cases, disbarment proceedings.

The Complex Legal Framework Attorneys Must Navigate

The Fair Credit Reporting Act (FCRA) establishes strict requirements for accessing consumer credit information. 15 U.S.C. § 1681b defines “permissible purposes” for obtaining consumer reports. Attorneys must understand that accessing consumer information without a valid permissible purpose violates federal law. Section 6802(e)(8) exceptions provide narrow circumstances under which financial information may be accessed, but these exceptions are far more limited than most attorneys realize. Misunderstanding these provisions has resulted in devastating liability.

The Right to Financial Privacy Act (RFPA), codified at 12 U.S.C. §§ 3401-3422, restricts access to customer financial records held by financial institutions. Attorneys seeking financial information must comply with specific procedures, including proper judicial subpoenas under 28 U.S.C. Chapter 176 (Fair Debt Collection Procedures), compliance with notice requirements, and adherence to institution-specific protocols. Attempting to obtain bank records through deception or without proper legal authority violates federal law and exposes attorneys to both civil and criminal liability.

Beyond federal requirements, attorneys must navigate state privacy statutes that often impose additional restrictions and penalties. California’s privacy laws, for example, provide private rights of action with statutory damages that can accumulate quickly across multiple violations. State consumer protection acts frequently prohibit “unfair or deceptive practices,” which courts have interpreted to include obtaining consumer information through misrepresentation or without legal authority.

How Attorneys Become Liable

Attorneys face direct liability when they request information knowing it will be obtained illegally, provide investigators with instructions that require illegal methods, use information they know or should know was improperly obtained, or fail to inquire about investigative methods when circumstances suggest impropriety. The consequences extend far beyond simple negligence claims.

Courts consistently hold that principals are liable for the actions of their agents, even independent contractors. When an attorney hires an investigator who violates privacy laws, the attorney bears responsibility for civil damages to the violated consumer, statutory penalties under applicable privacy statutes, punitive damages when the violation involves willful misconduct, and attorney’s fees incurred by the plaintiff. This vicarious liability cannot be avoided through contractual disclaimers or indemnification clauses.

Many attorneys mistakenly believe that hiring investigators through multiple layers of contractors creates an “accountability gap” that shields them from liability. This belief is dangerously wrong. Courts have explicitly rejected this defense, holding that companies and attorneys cannot escape responsibility by creating distance between themselves and the actual violation. The Lawlor case demonstrated this principle conclusively.

Professional Consequences Beyond Civil Liability

Using illegally obtained information triggers multiple ethical violations under the ABA Model Rules. Rule 8.4(c) states: “It is professional misconduct for a lawyer to engage in conduct involving dishonesty, fraud, deceit, or misrepresentation.” Rule 8.4(b) provides: “It is professional misconduct for a lawyer to commit a criminal act that reflects adversely on the lawyer’s honesty, trustworthiness, or fitness as a lawyer.” When attorneys use information obtained through pretexting, impersonation, or other illegal means, they violate both rules simultaneously.

Bar complaints arising from such conduct can result in public reprimand, suspension from practice, disbarment, and a permanent record affecting professional reputation. These disciplinary proceedings occur independently of any civil litigation, meaning an attorney can face simultaneous bar complaints, civil liability, and potential criminal prosecution for the same underlying conduct.

Beyond regulatory consequences, attorneys face malpractice claims from their own clients when cases are damaged by tainted evidence. Discovery of illegally obtained information can result in evidence exclusion, trigger sanctions against the attorney, provide grounds for dismissal or adverse judgment, and create independent claims against the attorney by opposing parties. The malpractice exposure becomes particularly severe when the attorney’s conduct causes the client to lose an otherwise winnable case.

The Evidentiary Disaster: When Illegal Investigation Destroys Cases

Perhaps the most devastating consequence occurs when illegally obtained information destroys the attorney’s entire case. Consider this scenario: An attorney obtains detailed financial information about an opposing party through an investigator who used pretexting. During discovery, the opposing party’s counsel identifies the source of the information and files a motion to exclude all evidence derived from the illegal investigation, sanction the attorney for ethical violations, dismiss the case with prejudice, and award attorney’s fees and costs.

The court grants all relief. The attorney’s client loses the case entirely—not on the merits, but because the attorney’s investigative methods violated the law. The client then sues the attorney for malpractice. The attorney’s malpractice insurer discovers the ethical violations and denies coverage. The attorney faces personal liability for the client’s damages, bar disciplinary proceedings, and potential criminal prosecution.

What Constitutes “Proper Legal Means”

Courts recognize specific legal methods for obtaining non-public consumer and financial information. Legitimate methods include properly issued subpoenas following 28 U.S.C. Chapter 176 procedures for post-judgment discovery, court orders obtained through appropriate ex parte or noticed proceedings, debtor examinations conducted under oath pursuant to judgment enforcement procedures, voluntary disclosure by the consumer with informed and uncoerced consent, and information provided pursuant to valid FCRA permissible purposes with strict compliance with all statutory requirements.

Conversely, illegitimate methods that create liability include pretexting (impersonating the consumer or using false pretenses to obtain information), bribery (paying bank employees or other custodians to provide non-public information), unauthorized access (obtaining information through hacking, social engineering, or exploiting security vulnerabilities), misrepresentation of authority (falsely claiming legal authority to access records), and third-party database abuse (using databases that obtain information through illegal means, even if the attorney doesn’t directly commit the violation).

The Critical Question Every Attorney Must Ask

Before using any non-public consumer or financial information, attorneys must ask their investigator: “What is the specific legal authority that permits you to obtain this information?” If the investigator cannot cite specific statutory authority, court orders, or valid consent, the information is likely obtained illegally. Using such information exposes the attorney to all the consequences described above.

Several red flags indicate that information is illegally obtained. These warning signs include situations where the investigator cannot or will not explain their methodology, information arrives faster than proper legal process would allow, the investigator describes methods involving “connections” or “sources” at financial institutions, the cost is surprisingly low compared to proper legal discovery procedures, the investigator dismisses questions about permissible purpose as “technicalities,” or reports lack proper documentation of legal authority. Any of these red flags should prompt immediate inquiry and potential rejection of the information.

Protecting Yourself: Due Diligence Requirements

Attorneys have an affirmative duty to ensure investigations comply with applicable law. This requires vetting investigators for knowledge of privacy laws, FCRA requirements, and permissible purpose limitations before retention. Attorneys must demand transparency about investigative methods before retaining services and should obtain written representations that all methods comply with federal and state privacy laws. When information is received, attorneys must reject information that cannot be traced to legitimate legal authority. Throughout the process, attorneys should document their compliance efforts to demonstrate good faith if questions arise later. This documentation can prove crucial in defending against bar complaints or civil liability claims.

The Bottom Line: Ignorance Is Not Protection

Courts and bar authorities will not accept “I didn’t know my investigator was breaking the law” as a defense. Attorneys are charged with knowledge of the ethical and legal requirements governing their practice, including the methods their agents use to obtain information. The devastating judgments, criminal prosecutions, and professional discipline cases all share a common theme: attorneys who failed to ensure their investigators used proper legal means to obtain information paid catastrophic prices.

In an era where privacy violations carry million-dollar judgments and criminal penalties, understanding permissible purpose isn’t optional—it’s essential to protecting your license, your clients, and your career. The investment in proper legal investigation methods—while potentially more expensive and time-consuming than shortcuts—pales in comparison to the professional and financial devastation that flows from using illegally obtained information. Every attorney must recognize that the ends do not justify the means, and that winning cases through improper methods ultimately leads to losing everything that matters in legal practice.