By now you have heard the news...the European Union’s General Data Protection Regulation (GDPR) will be in effect as of May 25, 2018. Many companies have been actively preparing for GDPR for the past year. Law firms have likely found themselves providing guidance to clients as part of these preparations. But, has your law firm conducted their own GDPR assessment and prepared for compliance? It is no small task! Hopefully, the following will be helpful in confirming your GDPR readiness steps.
Understand the regulation
Of course, the first step in determining what needs to be done is understanding the regulation, itself. There are many ambiguities - or at least uncertainties, at this point - when it comes to interpreting the regulation. A general understanding of what the law is striving to achieve will help you best determine where you need to focus your compliance efforts. Of course, if you do not conduct business in the European Union (EU), or market to clients in the EU, your GDPR compliance needs are likely quite limited, if even necessary.
The GDPR provides certain data privacy rights and protections to EU citizens (data subjects). The intent is to ensure that personal privacy rights are not compromised when the personal information of individuals is collected by an organization, even if for business purposes. One must understand that the EU, unlike the U.S., defines data privacy as a basic human right. This can be difficult for some U.S. Companies to appreciate, as the definition of privacy is much broader than in the U.S. Thus, information, such as contact information which a law firm might use to send clients or potential clients an electronic update on recent case law, is considered to be protected information under GDPR and must only be provided with the consent of the data subject.
The regulation also defines key terms which are also important to understand in determining your compliance risk assessment. For example, in the context of GDPR, are you a data controller? A data controller is an organization who physically controls personal information regarding a data subject and who determines how that data is handled. The data processor actually processes the data, or arranges for the data to be handled by another sub-processor. If you are a law firm who manages client contact information for marketing purposes, or who maintains employee information for those employees housed in the EU offices of your firm, you are a data controller and must take steps to ensure compliance with GDPR. If you conduct analyses, or otherwise use the data you control, you are also a data processor. Another example is if you are a law firm managing e-discovery, in which case you are both a processor and a controller. These roles impose certain data protection obligations on your organization pursuant to GDPR.
Another key, but certainly confusing, concept of the regulation is that of “legitimate interests”. The regulation provides for processing of certain data when the legitimate interest of the data controller permits such processing. For example, data subject consent may not be required if the controller needs to maintain certain information to ensure compliance with regulatory requirements. Using “legitimate interest” as a basis for processing requires a balancing analysis that the organization should undertake to ensure the data privacy rights are not overruled.
Assemble a team
Another key step in your GDPR compliance readiness is to assemble a team responsible for assessing and directing your compliance program. This team should likely include Information Technology staff, the firm’s risk management partner, law firm security, law firm general counsel, Records or Information Governance, and if possible, an attorney with GDPR expertise. The team will be responsible for prioritizing the steps necessary to achieve compliance. It is likely this team will have an on-going role in maintaining compliance, as well. In addition, you will need the participation of key business representatives (HR, Marketing, Finance, and e-Discovery are top examples). Further, you will potentially need to appoint a Data Protection Officer, if not designate an existing person to assume this role.
Understand your data flow
One of the biggest tasks on the road to GDPR compliance is understanding your data repositories and data flow. What are the key repositories of information which contain EU citizen personal data? Likely prioritized locations include HR systems (applicant data, employee personnel files, payroll information), marketing systems which maintain client and potential client contact information, and e-discovery platforms. Keep in mind that, in the law firm environment some of these repositories might be outsourced to third-parties, introducing sub-processors to your data protection requirements.
Develop a matrix and chart your risk
Data security has been an area of focus for many law firms over the past several years, with many law firms pursuing and obtaining security certifications, such as ISO 27001. GDPR incorporates the data security concerns and requires notification to data subjects within 72 hours in the event of a data breach. If your firm has not already addressed data security, now is the time to ensure that you are positioned to meet the breach notification requirements of GDPR.
Right to be forgotten
GDPR also provides data subjects with “the right to be forgotten”. Thus, as an example, in the event a former employee invokes this right, the firm must be in a position to identify and delete the information regarding that employee, or be in a position to explain why that data needs to be maintained for the legitimate interests of the firm. For those managing e-discovery, this is quite likely something already in place, if you have had to deal with deleting e-discovery data pursuant to a protective order. If not, a procedure around this process will need to be developed.
While daunting, and still subject to review of how it will be enforced, GDPR compliance for your firm is achievable. However, time is of the essence. If you have not started, it is highly recommended that you review the regulation, form your compliance team and begin the data mapping exercise, creating your data matrix/risk assessment to prioritize your path to compliance.
And if you missed the first blog in our GDPR series, please check it out HERE
If you would like to read the third, and last, blog in the series please check it out HERE