Every Cloud Has A Silver Lining. Protecting Privilege Data In A Hosted World

Transcription

1 Every Cloud Has A Silver Lining Protecting Privilege Data In A Hosted World May 7, 2014

2 Introduction Lindsay Stevens Director of Software Development Liquid Litigation Management, Inc. Tia Gilford Senior Counsel Rakuten Marketing

3 Agenda What is the Cloud? Why do we use the Cloud? Legal concerns / Contract consideration Confidentiality and Privilege in the cloud Reasonable Care Guidelines

4 What is the Cloud? An on-demand network access to a shared pool of configurable computing resources Cloud Deployment Types + Private resources including data operated solely for a single organization, lower risk, higher cost Public resources available over a network that is open for public use, higher risk, lower cost Community / Controlled services are not publicly available but may still be shared by several organizations. Spreads costs with lower risk. Hybrid Service Models Infrastructure Platform Software

5 Why do we use the Cloud? Elasticity of Resources Rapid provisioning of hardware resources pooling across multiple users to distribute cost Use only what you need Pay for only what you need On demand support and team of experts Availability & Reliability 24/7 Access from anywhere Redundancy and failover Strategic Technologies User Experience

6 Balancing Act for Lawyers Attorney Client Privilege Does data and communications in the cloud waive privilege? Data Protection Are you taking steps to protect your organization or client s data? Data Privacy Do issues of privacy around personal identifying information come in to play? Data Discovery How will providers handle data discovery requests and how will it affect access to your data? Data Breach How will providers handle data security breach and notice? Cross-Border Issues How will local law impact your data?

7 Due Diligence Pre-Negotiation Checklist Review the Cloud Provider Documents in Conjunction with the Agreement: Security Policies, Security Certifications (ISO, SSAE 16) & SOC Reports Privacy Policy Data Breach Notification Policy SLA (including what services are included in the SLA) Disaster Recovery/Business Continuity Plan Safe Harbor Certification PCI DSS Compliance (if applicable)

8 Client Confidentiality and Privilege Ethical Duty to protect client information and confidences Law of attorney - client privilege 1. Any Communication 2. Between privilege persons 3. In Confidence 4. For the purpose of obtaining / providing legal assistance for the client Stengart v. Loving Care Agency, Inc., 408 N.J. Super. 54 (App. Div. 2009) s to attorney sent thru password protected web based provider on a company laptop and cached by browser Ruling Employee could retain an expectation of privacy as she took reasonable steps to keep messages confidential

9 Governing Rules and Law Restatement (Third) of the Law Governing Lawyers, Section 68 Model Rules of Professional Conduct (ABA) FRCP 26(b)(1) Federal Rules of Evidence 501 and 502 Various jurisdiction rules

10 United States Jurisdictions Generally found practice of using cloud computing permissible (ABA Chart) American Bar Association Model Rule 5.3, Ethics Commission Report (Aug 2012) Comment 3 When using such services outside the firm, a lawyer must make reasonable efforts to ensure that the services are provided in a manner that is compatible with the lawyer s professional obligations. 15 State Bar and Ethics Committees provide guidance on cloud computing NY, Alabama, Arizona, California, Nevada, New Jersey, North Carolina, Pennsylvania, Texas,

11 International - Attorney-Client Privilege differences - EU Data Protection Directive (Directive 95/46/EC) - Data Protection - Article 17(2) of Directive 95/46/EC puts "full responsibility on cloud clients to choose cloud providers that implement adequate technical and organizational security measures to protect personal data and to be able to demonstrate accountability" - Data Transfer - Article 25 / 26 of Directive 95/46/EC provides for free flow of personal data to countries located outside the EEA only if that country or the recipient provides an adequate level of data protection - Safe Harbor Certification US / EU transfer of data framework - Privacy Level Agreements (PLAs)

12 Reasonable Care Guidelines Question and understand the technology and security Know the terms of any arrangements concerning the protection of client information Stay up to date on changes and challenges to online security Reconfirm policies regularly

13 Cloud - Security Physical Certification Infrastructure Security Notification Data Transfer Data Storage Account

14 Cloud - Storage Multi-Tenant / Co-mingling Concerns Backup and retention policies Portability / Export Litigation Holds Data Subpoenas Physical Location / Jurisdictions

15 Cloud Confidentiality and Accountability Who has access? User Access Restricted User Access (application level) Vendor Access Subcontractors / The Stack Terms of Service Privacy Terms Service Level Agreements (SLA) Privacy Level Agreements (PLA)

16 BYOD - The Internet of Things Added twists More dependent on individual Portable / Mobile dimension What you the individual can do User Access Security Encryption of data

17 Conclusion Define clear policies for BYOD and Cloud Computing, including Regularly perform due diligence on cloud providers,technologies and security Develop a Cloud Provider Policy Develop an Information Security checklist Insurance policy Confirm includes data breach coverage Service and Privacy agreements Ensure confidentiality is not waived You get what you pay for Pay for higher levels of data confidentiality, integrity and availability Cloud computing is compatible with attorney client privilege given reasonable care

18 Questions?

19 Thank You!