Permission, Compliance, Security & Custody
Each year, the world moves toward an internet and data-centric approach to business. In particular, law firms are coming under increased scrutiny in how they handle consumer data.
For international corporate counsel and general counsel law firms, this is being driven by large fines and substantial regulation around the EU’s General Data protection Regulation (GDPR). In the United States, the focus is on privacy issues, marketing permission, and the custody chain of consumer data, which is primarily self-regulated (except in California).
An additional key driver is the internet search and technology sectors. It’s recognized that law firms and solo practitioners have a unique position on the internet as they deal with businesses or consumers who tend to use their website as a front-facing portion of the law firm. Law, along with healthcare and finance, is placed into a special search class of professional services on the internet due to the sensitive data handled.
Industry leaders like Google are helping to ensure some level of data compliance by triggering penalties to law firm websites when best practices are violated. Large data players like IBM are staying in the background but are heavily involved in laying the groundwork for the next generation of US-based data and security fabrics.
Sketchy lead-gen methods can cause legal issues around data security
Data privacy and security issues are further complicated by a rise in internet lead gen companies for plaintiff’s attorneys that often use sketchy and many times illegal methods for harvesting clients that are sold to the highest bidder. In these cases, not only is the practice highly unethical, the lack of a custody chain of where the client came from could pose legal issues if the clients were derived from illegal sources, such as a hacked Google Business Profile (GBP) listing or another law firm’s website.
Jacob DelHagen, CTO of Sherloq™ with IBM Watson, writes, “Many law firms use digital agencies for marketing and websites. While we are seeing top digital agencies like Big Voodoo Interactive use blockchain security for their legal clients' websites, the issue here is that many are not gaining consent nor creating a secure custody chain of the private consumer data flowing in from the internet to the law firm. ‘Sherloq,’ as we say, is cost-effective, easy to install permission and consent software that every law firm should have.”
The legal outlook on privacy and consumer data
According to Paul Nicolai, an ABA Life Fellow and former member of the ABA Board of Governors who practices in data security and privacy issues, Europe has been a leader on the subject of privacy and consumer data use for years. It is primarily driven by the underlying European assumption that consumer data belongs to consumers and third parties only get a right to use that data for specifically authorized purposes. This principle has been codified in various iterations of EU law and regulation.
Although the United States has undertaken to regulate data privacy over the past decade, early efforts were largely centered on notification of data breaches. The litigation arising out of those notifications has to date largely failed. Courts have mostly ruled that without actual financial damage to a consumer, the consumer has no cause of action. The US Supreme Court also recently ruled class action participants must have actual damage and that a technical violation of a statute is not enough to support standing in a class action.
“This masks that the law is rapidly changing in the United States,” Nicolai says. “Tens of thousands of arbitrations have been filed against Amazon for the use of consumer recordings and data in their Alexa system. These cases are based on state laws which provide statutory damages and create the kind of standing consumers have not been able to obtain at common law.”
A case currently pending before the United Kingdom's highest court requests that it recognized that UK citizens are damaged by reason of data misuse even if there is no actual out of pocket damage.
The most recent regulatory changes in the EU have all imposed statutory damages for violation of data ownership rules.
Says Nicolai: “It is only a matter of time before these developments converge in the United States to create entity or personal liability against those who violate either privacy or data security rules.”
Data privacy is a key consideration for legal directories and lead generation
Legal directories, too, will be affected by the changing landscape. Knowing Law.com is the most respected brand in legal, ALM, the parent company of Law.com, collaborated early on with Big Voodoo on the search marketing side and Sherloq with IBM Watson to design the architecture of Lawyerpages, a premium directory offering that includes AI and blockchain. This architecture ensures that premium listed clients will get the best technology and security going forward. In addition, the AI technology provides a strategic advantage to law firms that list with Law.com by identifying which cases are most valuable, both organically and with integrated media through the ALM publishing networks.
Implementing the legal technology to address permission, compliance, security and custody can be a significant undertaking depending on the size of the law firm and whether the system is custom-built.
Regardless of the technology path you choose, future liabilities can be avoided by implementing basic data protection for your clients now.
