Info Law Group : Technology Lawyers & Attorneys : Information Law Group : Privacy, Security & Intellectual Property Law

As the partners of InfoLawGroup make our way through the sensory overload of the RSA Conference this week, I am reminded (and feel guilty) that it has been a while since I posted here.  I have good excuses - have simply been too busy with work - but after spending several days in the thought-provoking environment that is RSA, I had to break down and write something.  A few observations, from a lawyer's perspective, based on some pervasive themes:

1. We all need to work together, and we can.  Legal, Information Security, Privacy, Compliance, IT, and the affected business units.  Now more than ever, it is essential that ALL the stakeholders join forces, as early as possible, to address security and privacy risks, assess and vet business deals, and put in place appropriate procedures - RFPs, due diligence, contract negotiation - to address the risks.
    
2. Cloud, cloud, cloud, yada, yada, yada.  Hold up - the technology is not new - but usage and the business model have changed dramatically.  I have been having this argument with my information security and technology friends for months.  OK, I get it.  "Cloud" technology in some form or another has been around for 30 or 40 years.  What is new is the massive scale, availability and changes in usage and the business model - in part driven by the economics.  Guess what?  Those business model changes make the legal risks even more pervasive.  Going back to (1) above, all of the stakeholders need to be in the room (or on the phone or videoconference) discussing the issues BEFORE the decision is made to enter into a cloud arrangement.  ANY cloud arrangement.  Not after the RFP is issued.  Not after IS does its due diligence.  Not after the contract negotiations have begun.  And not after the contract is inked.  The same due diligence and attention to risks that would apply in a traditional outsourcing/offshoring relationship must be applied here, too.  The cost savings are illusory if the short-term and/or long-term risks are significant.  Think about the kind of data at issue.  What are the risks?  Evidence preservation, data security, breach response, enforcement rights, indemnification.  And before we even get to those - can the data be transferred across borders in the first place?  Think about it early.  And then talk about it before decisions are made. 

More after the jump.

• Email This
• Print
• Comments (4)
• Trackbacks
• Share Link

On December 8, 2009, the Data Accountability and Trust Act -- HR 2221(DATA) moved one step closer to law by passing the House of Representatives.  DATA is sponsored by Congressman Bobby Rush (D-IL).  Note that the InfoLawGroup has previously commented on similar data security bills currently pending in the Senate.  The DATA in Congress has similar elements as Senator Leahy's S. 1490, the Personal Data Privacy and Security Act, including not only breach notice obligations, but also information security policy requirements.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Last month we posted some basics on cloud computing designed to provide some context and identify the legal issues.  What is the cloud?  Why is everyone in the tech community talking about it?  Why do we as lawyers even care?  Dave provided a few things for our readers to think about -- privacy, security, e-discovery. 

Now, let's dig a little deeper. 

I am going to start with privacy and cross-border data transfers.  Is there privacy in the cloud?  What are the privacy laws to keep in mind?  What are an organization's compliance obligations?   As with so many issues in the privacy space, the answer begins with one key principle -- location, location, location.  For those of you who prefer to listen, check out my recent webinar on International Regulatory Issues in the Cloud, or you can download the slides (PPTX). For everyone else, read on after the jump.

• Email This
• Print
• Comments (5)
• Trackbacks
• Share Link