The Legal Update

The Top 7 Issues Keeping GCs Up At Night

What are the big concerns facing legal departments that are keeping GCs up at night? There were some very interesting insights from Morrison and Foerster’s Up At Night report, examining the key themes and issues that are pressing on GCs’ minds. We take a look at some of standout results from the study…

#1 GDPR and Other Global Regulatory Challenges

It’s the acronym that’s making every lawyer, regulator and business owner quake, but GDPR is part of a larger picture of global regulatory worries that GCs are facing. A fragmented regulatory environment on an international scale was identified in the study as one of the major causes for concern for legal departments, with 72% of respondents citing regulations and enforcement as a ‘very important’ challenge. The sheer pace of evolution of data security and privacy regulations can leave departments short of the time and resources needed to address the problem. Our advisory article on GDPR offers some tips on keeping departments on track to comply with the new regulations.

#2 Intellectual Property

Along with regulations and enforcement, intellectual property is the subject that has seen the biggest increase in imbalance between time spent on the issue and the level of importance it is deemed to have. Global regulations covering data privacy and intellectual property are themselves playing catch up with the ever-evolving means in which we produce and share intellectual property, so it’s little wonder that GCs are fretting about how to apply current laws to new circumstances, and realising the need to keep up with new enforcements with the same level of budgets and resources. Drilling down further into the responses, 52% of GCs described enforcing IP rights and trademark/copyright infringement as their primary concerns in the realm of intellectual property.

#3 Budgets – Doing more with less

As a more general theme, budget and resources restrictions repeatedly come up as a major concern in all issues highlighted in the study. From risk and crisis management to litigation, the worry for most GCs seems to be the availability of financial and team resources to dedicate to the issues.  The needs of the business and the state of the regulatory environment are the primary drivers influencing changes in demand as we can see below.

Graphic courtesy of Morrison Foerster/ALM

#4 Resource Crunch

To compound the problem of complex issues and stretching budgets, legal departments are also facing a resource crunch. Many GCs cite that their departments simply do not have the necessary finance, staffing and technology available required to meet the challenges they face. One way to remedy staffing shortages is to increase legal outsourcing and work with legal services companies, such as Obelisk Support, who can provide temporary support for legal teams. Adopting legal technologies can also be an efficient way to speed up and automate repetitive low-skills processes, freeing up valuable lawyer time to deal with more complex issues. For regular updates on Legal Tech, Artificial Lawyer is a good place to start. One particular concern quoted by respondents is the lack of resources to train staff for compliance purposes (see #1 GDPR). Companies will be under pressure to assess their budget priorities to tackle this issue.

 #5 Organisational Misalignment

Possibly as a result of resource constraints, there is a suggestion that the time being spent on addressing those concerns amongst GCs is much less than the perceived importance of the issue. It seems that departments are also yet to implement measures to ensure organisations avoid silos of information and procedural overlaps and clashes. With no improvement in the disparity between the Spring and Fall 2017 studies, the conclusion drawn is that legal departments are in danger of becoming overwhelmed, and are yet to find a solution. Reviewing internal processes to streamline and avoid crossovers between departments is a time-consuming but necessary exercise that GCs would greatly benefit from.

Graphic courtesy of Morrison Foerster/ALM

#6 Privacy and Data Protection

Becoming ever more pertinent in our daily lives, GCs have a whole range of new and evolving issues relating to privacy and data that can mean very real consequences of litigation, reputation and trust loss. But it’s interesting to see exactly what privacy and data issues GCs are troubled by – and more interestingly perhaps, the ones they appear to be prioritising less. The following shows the percentage of respondents who deemed concerns ‘not important’ – that the lack of necessary technology is not a concern for many is somewhat surprising, considering aforementioned concerns over technological resources, and that legal departments more generally are highlighted as being slow to adapt to new technological advances.

Graphic courtesy of Morrison Foerster/ALM

#6 Cyber Security Threats

Cyber security was the biggest and most specific concern under the theme of Risk and Crisis Management for GCs, accounting for nearly 60% of all the risk & crisis management concerns expressed by survey respondents. It is an issue that has seen the most rapid rise to the top of the priority list, so it is little wonder that participants cite resource restrictions as one of the main challenges they are facing in tackling cyber security threats.

#7 Outsourcing Work

Coming back to #4 Resource Crunch, strategic sourcing is a theme connected to the resources constraints and increasing complexity of issues to be tackled. GCs are challenged by the need to source an ever increasing variety of legal expertise, in the most cost-effective manner. It appears that budget concerns are behind many of the decisions to source work to a supplier, as well as the need to bring in expertise that is lacking in the department. We predict that alternative service providers are going to become a bigger part of this picture in 2018 and beyond. North American trends also show that working with legal suppliers who value diversity, inclusion and other responsible business practices will soon be as important as negotiating their budget or scoping the work.

Graphic courtesy of Morrison Foerster/ALM

While some of these themes are familiar concerns for GCs, many are on new and unknown legal territory. Without the in-house resources available, GCs are going to need to become more agile to source and make the most of available expertise.

The Legal Update

Data Protection for Lawyers: Keeping Information Secure

Obelisk consultant Alisha McKerron Heese looks at the big issue of data protection in the modern age, and how lawyers can make sure the information they handle is safe and compliant at all times.

Compared to other areas of the law, Data Protection is relatively new and data protection for lawyers is fast becoming an essential business tool. It arises in many different aspects of day-to-day business and has undergone rapid change over the years, particularly with the development of technology and the increase in flexible and remote working.

Data protection and security affects us in more ways than we can imagine as lawyers. All service providers must make sure they keep their client data safe, but as lawyers often deal with extremely sensitive personal information, we must be particularly careful as to how we handle it, and we need to keep up to date with new regulations. It is these qualities which make it an exciting area of the law and at the MBL Conference on Data Protection & Security, we heard six speakers examine current and future developments in data protection laws and procedures. Here are the topics to look out for to keep legal information secure in your legal practice.

#1 Data Breaches and Exposure

Over the last 10 years, there have been several infamous instances of data breaches from companies such as HMRC, T-Mobile, Sony, Yahoo, TalkTalk, Sage and Three. According to Dr. Stephen Hill, a trustee director of the Fraud Advisory Panel, most of these stem from poor business practices. It seems that the greatest security risk to organisation is outdated software, and indeed, outdated employee knowledge of technology and security measures. 

Steps to prevent breaches: Data security needs to be in the hands of experts, which often means outsourcing data storage and security to a specialist company. As Jared Staver of Staver Law Group states in this Digital Guardian article, offsite servers that are encrypted, protected and have teams of people ensuring their security are the safest way to store data.

Some other simple, practical ways of guarding against these incidents include:

  • Making use of the blind copy (“BCC”) function when emailing
  • Ensuring that confidential information is removed from documents before sending
  • Emails/documents are sent/faxed to the correct address
  • Paper work is kept secure and regularly checked.
  • To find out if your email has been breached Dr. Hill recommends, which allows you to check passwords for any email account to check if they come up on lists of passwords stolen by hackers.

#2 Regulating Data Protection: Privacy and Electronic Communication

What about the areas that are out of our individual control? Advertently or inadvertently, valuable information is being collected and stored when we use electronic devices to communicate with one another. As technology advances, what is being done to ensure continual protection? To see if your browser is safe from tracking, Dr. Hill suggests using to analyse how well your browser and add-ons protect you against online tracking techniques.

Rosemary Jay, one of the leading lawyers in the area of data protection, told us that the E.U. Commission has proposed a draft regulation on Privacy and Electronic Communications (“PEC”) which contains specific provisions on cookies, online marketing and the use of content and metadata.  

  • The proposed regulation will expand and tighten our existing legislation which makes it unlawful to, amongst other things, transmit an automated recorded message for direct marketing purposes via a telephone, without prior consent of the subscriber.  
  • The proposed regulations will not just apply to telecom companies, but also to Over The Top (OTT) providers such as WhatsApp.
  • PEC will cover services such as public WiFi (found at, for example, a hotel or a bar), and services provided by “Internet of Things” (IoT) devices.  Stricter rules will apply to WiFi location tracking.
  • Access to websites will no longer be conditional on accepting tracking cookies. The aim is to get rid of cookie banners and make it a requirement that browsers contain cookie controls so that users must choose those settings as part of the installation process.

The proposed regulations have some way to go before being finalized and approved and it is likely that the timing will not coincide with the GDPR timing, as discussed below.

#3 GDPR & Technology: Friend or Foe

One need look no further than the dark web to ascertain the value of stolen data, where large amounts of data are auctioned. It’s a comfort to hear from Robert Bond, voted Best Lawyer in the U.K. for the practice area of Information Technology Law 2017, that protecting personal information is nothing new. It’s the scale of that task in modern times that has moved the goal posts. Without a doubt, the advent of the computerised world has complicated matters, because it has enabled large quantities of data to be stored and exchanged and the connections with the data subject, to be lost in the process.  

Greater protections are due to come into effect in May 2018 with the new General Data Protection Regulation (GDPR).  GDPR widens the definition of personal data, while applying the same principles that currently apply.

  • Stronger evidence of consent to handle personal data is required and there is a greater emphasis on transparency and accountability.
  • Your existing rights have been strengthened and you will have more rights–including the right to rectification, to request all your personal data be erased, to restrict processing, the right to have  personal data made portable so that it can be transferred–for example to a third party–the right to object and rights in relation to automated decision-making and profiling.
  • The proposed PEC will compliment the general GDPR with its specific rules.  

#4 Biometrics and Data Protection

What about rights in respect of information derived from us physically?

Apple’s latest phone allows you to use your thumb print to get into your phone. British e-passports now have additional security features including a chip with the holder’s facial biometric. Other examples would include iris recognition and DNA. This type of information, called biometric data, falls within the definition of personal data and is protected by the GDPR.  But there is another type of information closely associated with biometric information, called bodily-generated information, which is personal information generated by an individual directly. This may not be used as an identifier, in the sense that it allows you to identify who the individual is e.g. heartbeat, body temperature. Consider the increasingly popular activity trackers people wear on their wrists and the data they generate.

Does the GDPR cover this type of information? According to Mrs. Jay, overall the controls of GDPR should help minimise the risks associated with the use of biometric data. Whether it covers bodily generated data is a somewhat unclear, but best practice is to assume that it does.

#5 The Cost of Data Protection Compliance

What happens if an individual asks a public authority to provide him/her with a copy of all information that it holds on him/her? As Rory Dunlop explains, requests like this can be a lengthy and expensive exercise for any organisation on the receiving end.  Bear in mind that personal data extends not only to electronic data, but paper too. Thankfully there are instances where non-compliance is acceptable, for example in the context of excessive costs or vexatious claims.

The exponential growth in the collection and sharing of personal data has raised a number of questions as to how we can get a handle on, and own, our data. Fortunately, proposed legislation offers a number of regulatory frameworks to solve this problem, such as the GDPR which comes into effect in May next year and the PEC which is in the process of being finalised. Painful as they may be for companies, I believe that these frameworks are a force for good that will enable us to gain more control from large internet companies, like Facebook and Google.

Communicating securely and protecting client data are our top priorities as lawyers, so it is vital to invest the time and finance to ensure our systems and knowledge stay up to date with the changing digital landscape.

Alisha McKerron Heese is a multi-jurisdictional capital markets and corporate lawyer. She has magic circle and investment banking experience and is looking to transition from the voluntary sector back to fuller employment in the legal field. She is a magistrate and a freelance lawyer.