Law firms aren't just expected to protect their clients' sensitive information—they have a legal and moral duty to do so.