This is the third in a series of articles on information security. The first article in the series dealt with simple steps to help keep your data safe and was followed with thoughts on the rise of tablet computing and the information security concerns regarding tablets. This article deals with keeping and using sensitive customer information and ways in-house counsel can assist in keeping that information secure.

The recent spate of disclosed data breaches has underscored the need for companies to remain vigilant in how they use and secure sensitive customer information. The breach of the Epsilon platform, which exposed millions of names and email addresses, along with other recent breaches, underscores the vulnerabilities of this type of information.

A recent survey by the Ponemon Institute estimated that the average cost of a data breach for a company is $7.2 million, or an average of $214 per record compromised. Clearly, this is not an inconsequential sum. However, it may pale in comparison into the reputational damage that is incurred by companies that are found to have lost or had sensitive customer information compromised in some fashion. This reputational hit can be very expensive in terms of lost consumer trust and brand loyalty. In fact, it may take years for the company to recover, if it is able to do so at all.

In light of the vulnerabilities associated with retaining and using sensitive customer information, as well as the damages associated with such information if it is compromised, companies need to be increasingly vigilant in how they handle sensitive information. In-house counsel can and must play an increasingly important role in this process.

In addition to the normal contractual clauses that in-house counsel would concern themselves with such as indemnity clauses, limitation of liability clauses, choice of law provisions, SLAs and performance guarantees, warranties and insurance requirements, in-house counsel will increasingly be tasked with understanding the more technical aspects of data usages, storage and security. As such, in-house counsel must make certain that, as they are advising their corporate clients, they are asking the right questions and more importantly, understanding the answers.

Perhaps one of the most fundamental questions that should be asked is what type of security the company is providing for sensitive information. This question should be asked of any vendors that are providing services to the company or to in-house IT staff if the services will be managed in-house. Robust security is becoming increasingly important as companies rely more and more on utilizing sensitive customer information for things such as gaming platforms, marketing campaigns, social media strategies and customer relations/services.

In-house counsel must also understand the industry that the company is in and be prepared for any regulatory and compliance issues that arise. In-house counsel must be aware of all applicable laws and regulations as well as any governance concerns raised by the company's industry and how the company is using data. Also, as “customer touching” platforms become more international in scope, in-house counsel must become knowledgeable on the relevant country-specific laws and regulations.

Vendor liability and lock-in are also two issues that should be addressed by in-house counsel in coordination with the company's IT staff and business personnel. In-house counsel should question the viability of the vendor both from an economic and from a performance standpoint. Additionally, in-house counsel should understand how the company's information will be transitioned from the vendor in case the company desires or needs to move to another vendor or platform. This includes understanding the format of the data and how the data will be translated if the old and new platforms are different.

Finally, in-house counsel should understand the platforms that will be handling this sensitive customer information. For example, if the vendor is providing a “hybrid cloud” type service to the enterprise, how will the company's data be segregated from the data of other companies on the cloud vendors' network? This is becoming increasingly important to understand as instances of data leakage between customers of cloud vendors occur.

While the above is a sampling of some of the more important issues that in-house legal counsel must begin to understand and question, this list is not exclusive or exhaustive. In short, in-house legal counsel must increasingly become more aware and astute as to the technology solutions being deployed by the company as well as how sensitive customer information is being used and secured. Of course, the same concerns apply to sensitive company information. It is indeed a brave new world.

Read Roy Hadley's previous column.