Practice Innovations: Is data privacy a realistic goal?

New technological advances and the increasing demand to collect, capture, store, leverage, and access information and data whenever and wherever possible continue to define the digital landscape.

Many law firms have responded to this demand by providing on-demand access to digital work products and data. Further, the Covid-19 pandemic has shown many professional service firms the importance and value of providing digital copies of confidential and secure files.

This has led to a digital transformation in many industries, including legal. While digitizing information and data provides greater access and flexibility to attorneys and clients, it also increases risk and presents opportunities to cybercriminals. And as many firms transitioned to a work-from-at-home model during the pandemic, they were confronted with security and privacy challenges. Safeguarding sensitive information has become an arduous task for many firms.

Law firms — because of their access to sensitive personal information and data — are a prime target for cybercriminals who employ increasingly sophisticated tactics to expose, alter, or steal these digital assets. Indeed, the American Bar Association’s (ABA’s) 2021 Legal Technology Survey reported that 25% of respondents said their firms had experienced a data breach at some time. The report also noted that many law firms reported they are not using basic security measures.

Data security and data privacy

While the two concepts of data security and data privacy are intertwined and strongly coupled, there are definitional differences.

Data security ensures that personal data is accurate, reliable, and available to only authorized parties. The focus is on protecting data from unauthorized third-party access or malicious attacks and exploitation. Different methods and techniques are employed to protect the data, including  Monitoring activity, securing networks, controlling access, and use of such security methods as encryption and multi-factor authentication.

Data privacy, on the other hand, focuses on the use and governance of personal data. In general, data privacy is the individual’s right to control his or her personal information, and the individual trusts that his or her personal information is appropriately managed. Personal information includes confidential data, such as financial data, protected health information, and intellectual property data.

Since data privacy includes the proper handling and protection of personal data, it is essential to consider both data security and data privacy when attempting to protect personal information and data.

Why is data privacy important?

Individuals and companies recognize the increasing value of personal data and the importance of safeguarding it. Many governments across the globe have responded by accelerating the implementation of new data privacy laws or updating existing laws. These laws entitle individuals to certain rights regarding their personal data and require that companies comply to fulfill those rights. The firm must know which laws and regulations apply and what their legal responsibilities are in the event of a data breach.

Further, attorneys have ethical, legal, and increasingly, a contractual or regulatory obligation to take competent and “reasonable measures” to safeguard and protect client information and data. The ABA’s Model Rules of Professional Conduct contains several rules that are applicable to safeguarding client information, and several ABA ethics opinions discuss the importance of client data protection and an attorney’s ethical obligations when a data breach exposes client confidentiality. These obligations require attorneys to make efforts to employ competent and “reasonable” measures to safeguard and protect the confidentiality of client information and data. For many attorneys, this presents a challenge since most attorneys are not technology or cybersecurity experts.

Getting started

While challenging, implementing a data privacy program is within the capabilities of most law firms and professional service firms. There are some basic guidelines to consider when designing such a program, including:

• • • Designate a chief privacy officer (CPO) — The evolving technology landscape and the proliferation of privacy legislation across the globe requires a senior executive to lead a firm’s privacy and compliance efforts. While the role is evolving and can vary, generally, the CPO is responsible for managing data privacy within the firm. The position oversees creating data privacy policies, providing guidance and input for employee privacy employee training, and responding to legislative and regulatory directives.
    • Follow the data minimization principle — The idea is that one should only collect and store the personal data that is necessary and avoid surveillance capitalism. Firms should only collect the data they need now, and not the data they believe may be helpful in the future.
    • Use a privacy-by-design approach — When designing practices, processes, and IT systems, factor privacy into the design process. Data privacy should not be thought of as an add-on, but instead must be considered an integral part of all standards, policies, practices, processes, and procedures within the organization.
    • Select a privacy framework — This framework should be consistent with globally recognized standards, guidelines, and practices. This framework should also allow the firm to align people, processes, and technology to manage risk by providing a common language for understanding, managing, and communicating privacy risks with all stakeholders.
    • Perform a data privacy impact assessment (DPIA) — A DPIA is a risk assessment that identifies the risk of processing personal data. The DPIA will identify the personal data being collected, why it is being collected, and how the personal data is stored, protected, and managed.
    • Audit frequently — To ensure compliance, it’s necessary to continually and frequently assess and evaluate whether data privacy protection measures are being followed and the effectiveness of those policies and controls. The firm will need to determine the scope of the audit and whether external support is required. Also, the first audit should examine data protection in all departments of the firm and how the data is collected, stored, used, and managed.
    • Integrate data privacy into the overall information security program — Maintaining data privacy is dependent on data security and should be integrated into a comprehensive information security program. Include privacy training in your cybersecurity and data security training. Employees, contractors, and suppliers must be aware of their responsibilities under the applicable privacy laws and the firm’s privacy policies.

A law firm has a responsibility and obligation to protect the privacy of client personal data and that of their employees and suppliers. Understanding the firm’s obligations when managing personal data is essential to maintaining regulatory compliance. The benefits of integrating robust data privacy measures into your overall information security program go beyond compliance. A comprehensive approach to data privacy helps build client trust and mitigate risk when a data breach occurs.