Information Management for Law Firms Paul Byfield Published by In association with
Information Management for Law Firms is published by Ark Group UK/EUROPE OFFICE Ark Conferences Ltd Paulton House 8 Shepherdess Walk London N1 7LB United Kingdom Tel +44 (0)207 549 2500 Fax +44 (0)20 7324 2373 publishing@ark-group.com NORTH AMERICA OFFICE Ark Group Inc 4408 N. Rockwood Drive Suite 150 Peoria IL 61614 United States Tel +1 309 495 2853 Fax +1 309 495 2858 publishingna@ark-group.com ASIA/PACIFIC OFFICE Ark Group Australia Pty Ltd Main Level 83 Walker Street North Sydney NSW 2060 Australia Tel +61 1300 550 662 Fax +61 1300 550 663 aga@arkgroupasia.com Online bookshop www.managingpartner.com/bookshop Editor Evie Serventi eserventi@ark-group.com Head of content Anna Shaw ashaw@ark-group.com UK/Europe marketing enquiries Robyn Macé rmace@ark-group.com US marketing enquiries Daniel Smallwood dsmallwood@ark-group.com Asia/Pacific marketing enquiries Steve Oesterreich aga@arkgroupasia.com ISBN: 978-1-908640-33-8 (hard copy) 978-1-908640-34-5 (PDF) Copyright The copyright of all material appearing within this publication is reserved by the author and Ark Conferences 2012. It may not be reproduced, duplicated or copied by any means without the prior written consent of the publisher. ARK2104
Chapter 1: The building blocks of information management What is information and how is it managed? Information in the digital age includes both electronic and physical information. To successfully manage information, an organisation must be able to do this regardless of source or format (data, paper documents, electronic documents, audio, video, etc.) and collect, store, organise and deliver it through multiple channels including traditional databases, in mobile devices and via web portals. Information should be identified and treated as a corporate asset. If this principle is not acknowledged across the organisation support for IM will be weak at all levels within the business. Information must be made broadly available and shared across the organisation. While some information is sensitive and only open to certain individuals or groups (e.g. HR information and that subject to court proceedings or internal investigation), in principle, the sharing of information helps the use, development and exploitation of corporate knowledge. Creating the one-firm environment Most law firms develop silos of information because the firm has grown organically. And while many firms may have an IM strategy, a firm that has grown over five years from one office with 30 staff to five offices and 200+ staff may not have sufficiently planned for the change in IM as a result of this growth. For the IM strategy to grow with the business, partners will need to examine their business processes and strategies, including their desire to remain as one firm. It is easy to retain a one-firm culture when there are a small number of staff and only one office. Partnership/management and other face-to-face meetings are easy to organise/conduct. The firm can retain its identity because staff can develop personal relationships with each other. In theory, information sharing can be straightforward because staff members know each other and people are able to walk down the corridor and ask someone a question. A firm that has grown to have five offices and 200+ staff becomes a multi-jurisdictional practice. Has the firm retained its identity and its practice of information sharing? It is easy to say no because the firm is no longer what it when it was working as one office. The working culture is different (for example, there are now five main practice groups), the offices within each jurisdiction also operate with a fair degree of autonomy and their working culture is dictated by the managing partner within each office. The all-partner level meetings are infrequent and the international offices have their own way of doing things. It is clear that a firm of this structure has many challenges to overcome that cannot be simply solved by implementing a new IT platform. Yet IT is a great enabler of facilitating a change in approach, and to aid communication and information sharing. An IT system deployed and implemented effectively as a part of a well thought out IM strategy can help to reduce these challenges. 1
Chapter 1 Communicating the IM message via intranet One method used to instill a one-firm culture within a multi-site organisation, is by implementing or improving/updating the corporate intranet. An intranet is a vehicle that requires a great deal of work in order to be beneficial and it requires a joint approach by IT for the infrastructure, library and information services (LIS)/knowledge management (KM) for the content base and structure, and the practice groups for the content and information. With this or a similar approach in mind the intranet can act as an awareness platform to assist with information sharing. Information ownership Using the example of intranet management, it is clear that there is never just one answer at any one time. It depends on the firm s individual members and how they work with each other. It is unlikely one uniform model can be applied as a blueprint for all law firms and in-house counsel. Generally, all staff must be involved in the IM process for Paul Byfield speaks with Dion Lindsay of Dion Lindsay Consulting about the importance of implementing and using an intranet for information sharing, which is a crucial element in IM. Paul Byfield (PB) Intranets should be the perfect vehicle for information sharing/awareness as they allow each department and team to advertise what it does and to share information. To do this, do you agree that internal departments need to decide what information they are going to share with the rest of the organisation? Dion Lindsay (DL) Absolutely, but too much sharing is as bad as too little, as it hides the important data almost as effectively. Questions to ask include: What are our team objectives? What information should we share to help others contribute? What information from us do other teams require to meet their objectives? How do we find out the answer to the previous question and how much time do we have for providing others with the information they need? If we do not have enough time or enough understanding to get that right, what do we/the firm need to do? PB Is this process a management exercise or an information sharing exercise? DL With the right motivation and facilities for sharing already in place this can be a team or individual information sharing exercise. Otherwise it s a management exercise to assess the value of the potential sharing and decide what to put in place to make it possible. PB In other words, management need to devise a departmental strategy in terms of developing the intranet (assuming that it has been successfully implemented). DL Yes, and the type of strategy depends on the firm s objectives, for example, do they want to reduce their risk, increase cost-efficiency or focus on innovation? The key element is to engage employees. 2
Information Management for Law Firms it to be successful. IM is not just about IT, it includes adopting a management culture that staff at all levels can buy into and implement (very similar to KM). IT is clearly an enabler, but the lawyers and business support staff need to be equally involved. In every firm or organisation, there are different models of ownership for information, broken down by process or by content. For example, a key department or unit with responsibility for some aspects of IM is the library and information service. Within the law firm environment, the management model has changed and been adapted over time and there has been a noticeable trend to align with other areas of the firm, particularly with the other business support functions. Where is the library positioned within the business? In Table 1 note that for model number five, the combined service aligns with KM and business development, which ensures reporting of tasks can be channelled through one senior person. The business support strategy can therefore be discussed by all the business support team heads within a collegiate structure. This alignment should enable clear discussion on the various elements involved in the acquisition, management and dissemination of external information (LIS), how internal information is managed and disseminated (KM/professional support lawyers (PSLs)), how information can be used to support clients, and to understand new industries and potential clients (BD). Despite this so called collegiate approach to IM, the question of ownership and responsibility is also crucial. In order for documents and processes to be maintained it has to be clear within the firm who owns certain categories of information and documents (see Chapter 3 section on document management). Ownership of information creates a requirement for responsibility, which in turn creates quality control. Both elements are vital to good IM practices. Quality control (i.e. the quality of precedents) is often the responsibility of the senior partner within the particular business group and he/she will have PSLs (working within the KM team or within the practice group) who manage the precedents. As law firms are responsible for the management of information used in order to advise clients, they are also responsible for the information that they hold about their clients and their staff. Data protection (DP) is an extremely important issue and is often high on a law firm s agenda when talking about information management. Budgets and personnel The past 20 years have seen an explosion in the types of applications, software, databases and systems that have been Continues on p6. Model Unit/team Reporting department in firm Reports to 1. Traditional Library n/a Library partner 2. Pre-KM LIS n/a Library/know-how partner 3. Know-how/PSL LIS Know-how Head of know-how 4. (KM) Information service KM Director of KM 5. Combined service Information service KM Director of KM and business development Table 1: Reporting models for LISs within the business support structure for law firms 3
Chapter 1 Protecting your firm s information Q&A with Lynn Wyeth, head of information governance at Leicester City Council, about data security and relevant regulatory changes that may impact legal departments and in-house counsel. Q1: Have there been any key recent changes that may affect the way that legal departments/ in-house counsel manage their clients data? The Data Protection Act 1998 (the Act) has been in force in the UK for over a decade with little change to the actual legislation. Apart from a few statutory instruments clarifying some matters, the Act has not altered, and seeks to implement the existing European Directive which dictates it. Changes in other legislation, however, have had regular and sometimes profound effect on how personal data can be used and shared. More recently, powers granted to the UK DP watchdog, the Information Commissioner (IC), has also focused data control, with potential fines of up to 500,000 for data breaches. The emergence of case decision notices by the Information Commissioner s Office (ICO) and decisions by the Information Tribunal, along with decisions in the courts regarding privacy cases (under the Human Rights Act Article 8) have also given practitioners greater direction in how to interpret the Act. Q2: Can you explain the key DP issues when implementing case or matter management systems in legal departments or in-house legal teams? Systems Any systems that are implemented whether manual or electronic need to be put through a rigorous privacy impact assessment (PIA). This is a process developed by the ICO and guidance can be found at www.ico.gov.uk. This assessment will establish whether the system has sufficient controls to hold personal data securely, only allow access to appropriate people, and protect customers privacy adequately. The new European data regulation (see below) may make PIAs mandatory. Good housekeeping IM is key to managing personal data as it is to managing any data. Information is a valuable asset. Simple cultural changes will ensure staff members get used to best practice, for example, standard file naming across an organisation, use of version control, use of national marking scheme, and retention and deletion schedules. Information will be easier to find, not stored longer than necessary, and not become a risk to your organisation. Home and mobile working Staff members are increasingly working from home or on the move. Staff should not be accessing information from their personal PCs unless via a secure remote access login. No personal data should be kept at home or on their own computers in case of burglary. All equipment provided should be encrypted. Secure network remote access should be put in place. Personal e-mail accounts should not be used to send data home. Invest in the technology needed to ensure staff undertaking mobile or home working methods are not put at risk of data breaches. 4
Information Management for Law Firms Subject access requests The public are becoming well informed about their rights. They are more aware that they can submit subject access requests (SARs) to see what information an organisation holds about them. Legal teams need to be aware of subjects rights. Section 7 of the Act allows the requester to access their own data, and there are only 40 calendar days to respond. Section 10 allows the requester to request that their data be amended or deleted, and this has to be responded to within 21 days. Legal teams must also be aware about when they can refuse to release some information (where a valid exemption exists) or where there is a good business reason for non-deletion/ amendment. Legal professional privilege is an important exemption and, nearly always, legal advice will not be released in response to a SAR. This specialist area of work requires staff who understand all the possible exemptions so as not to prejudice a case. Data breaches Now that an organisation can be fined up to 500,000 for a data loss or breach, organisations must be extra careful how they transfer and dispose of personal data. Faxing case details of a sex offender to the wrong solicitor s fax number could cost your organisation 100,000. For data that is regularly transferred to another organisation when there is a legal basis for sharing, organisations should put an independent safeguarding authority (ISA) in place and review it annually. For one-off sharing events like sending the case file to a defence solicitor, make sure e-mails go to the correct recipient (beware auto-fill or pre-set groups), do not have sensitive data in the body of the e-mail and always password protect the attachments. Always send hard copies of information that contains sensitive personal data in the post by recorded delivery/to be signed for. Make sure that systems can be audited to check access in case there is a need to catch staff stealing or misusing data from the computer systems. Remember that serious data breaches must be reported to the ICO. Legal teams will no doubt be aware of the escalating number of potential claims in an increasingly litigious society. Section 35 of the Data Protection Act allows a requester to ask for other peoples personal data if they are looking to take legal proceedings against them. Increasing numbers of requests from solicitors, insurance companies and claims companies can be onerous. Be clear about what you will release and what you would expect a court order for and whether you will charge for such requests. The police can request information under section 29 if investigating a crime. Always try and get the request in writing and record an audit trail. Recent stories about police accessing data illegally are on the increase, so protect your staff and never be afraid to challenge them for ID or authorisation from their superior officer. Training Untrained staff will put your organisation at risk of a breach and a large fine. Mandatory DP training for new staff should be the norm, with regular refresher training. The very nature of the area of legal work means most personal data handled will be sensitive and much more care must be taken. There are plenty of e-learning modules online to enable this easily and cost effectively. It is a small price to pay compared with a 500,000 fine. 5
Chapter 1 Case law Monitor the outcomes of court cases connected with Article 8 of the Human Rights Act, and also regularly search the Information Tribunal and ICO websites for cases relating to DP or s40 (personal data) of the Freedom of Information Act. Put a system in place for alerting staff to new relevant case law, or decisions and guidance from the ICO. Q3: Should an organisation regularly review its DP policy? If so, how often or should it use changes in DP legislation to dictate the frequency of those reviews? In light of the ever changing advice and guidance, and the glut of case law that is now being generated from this ever growing area of work, DP policies should be reviewed annually. As stated previously, the actual law has not been amended for 14 years. The speed of change in case law and other legislation in the last five years, however, shows the need for a regular refresh of policy. Practitioners should be fully aware that the EU is currently proposing a new European DP regulation. This will not need a national Act of Parliament and must be implemented in full once passed at EU level. This is expected (at the time of writing) to come into law in approximately 2014/15 and could have a big impact on organisations that manage personal data. Data controllers need to monitor progress of this Act and what it will mean for them, plan ahead for changes, and update their policy accordingly when necessary. Q4: What has been the impact of social media in changing the agenda regarding DP issues within organisations? Social media is an area of work which is still particularly untested in the courts. A key area of concern for legal teams is that of an employee bringing a firm into disrepute through posting on social networks. Employment lawyers need to work closely with HR and communications teams to make sure the employment contract clearly states the company policy on this, and what staff members are expected to do and not do on social networks. There should be clear policies, with a clear indication of potential disciplinary action, even if the offence occurs outside of work, while of course recognising the staff member s right to privacy and right to free speech under the Human Rights Act. The firm also needs to make staff aware of what it will publish online, for example, the names and contact details of its key staff on the company website, or salary details of top earners/directors in its accounts. Staff should be given fair processing notices so they know what their data will be used for and where it may be shared or made public. Continued from p3. purchased and used by law firms. There was a year on year increase in the amount of money being spent by law firms to improve their infrastructure. However, since 2009 this spend has shrunk significantly enough, in that it is the first time this trend has been seen. This rationalisation has probably been beneficial to firms as they have been able to conduct a full audit of the systems they have in order to reduce overlap and waste. According to a recent article in Managing Partner, 1 the annual percentage spend on IT has decreased three to four per cent since 2010 and up to 11 per cent since 2009. These figures do indicate a downward trend in expenditure but do not necessarily 6
Information Management for Law Firms mean that law firms are focusing less on technology. In fact, the exact opposite could be said. Law firms realise they have to be innovative to be competitive and this has led to all budgets being scrutinised and reduced, especially where overlap or over concentration of resources have been observed. A recent US survey of technology spend within law firms, 2 found that over 50 per cent of respondents said their capital budget on IT had increased by between five and ten per cent since 2010. This of course is a very positive picture of the recent environment. However, 43 per cent of respondents said that expenditure on equipment upgrades has been adversely affected by budget cuts in the same period. Even so, these encouraging figures should be tempered by the fact that some respondents noted that expenditure had decreased in the previous two years, so they were in fact playing catch up to try to reverse the recent trend. Of course the spend on IT and IM resources has to be matched with investment in good quality staff. And the IM industry has not been immune to the impact of the downturn and this factor is significant in how firms recruit in the current market conditions. Q&A with Julia Hordle, director of corporate intelligence at TFPL, regarding trends in the recruitment of IM professionals and the effect on the IM industry and law firms. Q1. Are current market conditions discouraging new recruits to enter the profession? Not really. This is more an issue about how we define ourselves than about the flow of potential new recruits. Certainly, the number of suitable courses in core IM has reduced, but graduates are coming into the profession from many different routes often through general recruitment drives. Aspiring professionals tend to gravitate toward us once they have decided our disciplines are what they definitely want to do. In tough times new graduates can get caught in a lack of experience loop if they have chosen to do a vocational course with work experience; anecdotes about this are very discouraging. But in the right environment, learning on the job is a very valid development route for people who did not qualify early. One of the issues TFPL faces is not the volume of supply versus demand, but the quality of supply versus demand. We always have more permanent roles for up-and-coming professionals than we can fill at the graduate two+ years entry level. We always have contract roles available, which are the point of least resistance for new entrants. It is much more common for temp roles to be available as fixed term contracts now, and this makes for a better stepping stone into permanent employment than week-to-week temping. Q2. What new job roles are emerging? Are these a reflection of generalisation or specialisation in the market? Versatility would be a better word than generalisation. On the whole, the demand is for multifaceted professionals with a specialism either in operations or in subject matter. There is a high demand at the enterprise level: individuals with leadership qualities and programme management skills, individuals with a mastery of enterprise technologies, ERP systems, portals and big data. Specialists are also in demand like sector specialists and technical 7
Chapter 1 specialists. Management grade professionals have the potential now to rise higher, as the knowledge enterprise aligns under mainstream operations or practice management. Q3. Has Googleisation (the perception that everything is easily available and free) led to more of a requirement for value added services from information professionals? Yes. But information professionals have also had to learn to sell themselves and the benefits of using a specialist. It has been a tough challenge, requiring constant reminders, PR and an articulation of value based on return on investment. Q4. What has been the impact of social media on the recruitment industry? Are employers actively looking at Facebook and LinkedIn to scan profiles? Are employers looking for people with social media skills (for example, social media strategists and online reputation managers)? Social media has had the effect of creating many more opportunities for candidates to get access to vacancies, unrestricted by hours or location. This has opened up the recruitment market for individuals but at the same time made it more complex. Online recruitment is far from a perfect solution. There is a disproportionate bias towards key word selection and makes it difficult for a talented individual to shine, outside the norm. In-house HR teams do use LinkedIn. In larger firms recruiters often have multiple roles to hire for, so there is a limit to how much time people have to scour the web and qualify the names they find. Facebook is popular among some communities, but it is a long way from being a go-to place for experienced professionals actively seeking a new career. Of course, social media extends the range for people using their personal networks of friends of friends to hire. Recruitment consultants are there to provide ideas outside that range and objectivity as well. Skill in communication has long been the attribute which differentiates rising stars in the industry from their peers. With the advent of social media, practitioners need to be at ease with the myriad forms of communication techniques, from platform speaking to e-learning tools, from bite size links to mobiles to vox pops and community spaces. We see this especially at the top of the profession. Influencing others on a firm-wide basis is almost impossible without a training or aptitude in communications. Q5. If there is going to be a rise in the number of law firm mergers (as recently predicted) will this result in the market being flooded with information professionals? Will they have to look outside of the industry for jobs or is the industry robust enough to enable this to happen? Timing is the big issue here. Information professionals who have been successful in law firms and have kept up their continued professional development should have nothing to fear, if they are happy to use their skills in any organisation. Experience tells me that the market normally can absorb a swell of jobseekers. There are still many organisations who are yet to set up their first research or know-how functions, and there are always some growth areas in the market. It is a question of where to look. Post redundancy, there is a difference between getting some work and getting the right work for your career. The former is relatively easy, the latter takes longer. For senior practitioners, it can take a year or two to find true equilibrium again. 8
Information Management for Law Firms If mergers create much larger firms through aggregation, this naturally brings about new challenges requiring senior heads to shape the change. It is the vanilla roles that are at risk but any vanilla role is always under threat from either a technological solution or outsourcing/ off-shoring, often both. In the main, information professionals should be in a good position to keep their careers on track. Q6. What is the most important skill necessary for an information professional at the moment? Your hard skills make you employable, but your soft skills make you competitive: Hard skills Good planning or project management skills, which are transferable between most complex environments, especially with training in recognisable frameworks, for example, Prince2 or similar. Soft skills Active listening and consulting skills give candidates the ability to translate conversations and ideas into clear action plans. Q7. Has there been a significant move towards compliance/risk management/business intelligent roles in the industry, will this trend increase or stabilise? While legislation is written regularly and new technologies are invented, there is scope for new content and new forms of best practice. The pace of change just gets faster, unless interrupted by a deep recession. Since TFPL established its risk and compliance desk in 2011, we have been pleased by the flow of business. Business intelligence (BI) is an ambiguous term. The strategic and competitive definition of the market and the big data and BI dashboard segment are in growth. For the latter, it is experience in use of the trending technologies that brings value in the job market. Q8. What will the information industry look like in five years time? Five years is not very long in the scheme of things, but I expect to see more innovation: bringing together different disciplines under one umbrella, with larger multi-disciplinary teams in multiple locations. I also see an increase in the use of dashboard technologies to bring together analysis from the internal and external sources mash-ups tailored to monitor the performance and competitiveness of any organisation, also feeding in leads and opportunities from the real world. In the last few years, we have seen more effort spent (in law firms) on commercialising their know-how and on business pursuit than in any other area. I cannot see that changing. There will continue to be a flow of opportunities stemming from this technological innovation, service partnerships and post-merger knowledge challenges. Some of these will be inside law firms, some with their partners and suppliers. References 1. Law firm budgets down on 2008, Managing Partner, 27 September 2011, see: http://www.managingpartner.com/index. php?q=node/2550. 2. Law Firm Technology Survey 2011: Spending and Saving, The American Lawyer, see http://www.americanlawyer.com/ PubArticleTAL.jsp?id=1202520748309&t=13 20144607&slreturn=1. 9