Compliance

Many enterprises face a challenge in responding to international investigations due to language barriers and differing e-discovery expectations. But given the growing complexity of data localization laws, privacy regulations and data transfer treaties, most may find themselves struggling to keep up with compliance demands in the first place.

At the Legalweek New York session “2018 Global Discovery: International Compliance in the Cloud,” in-house, law firm and legal technology professionals will examine how enterprises can navigate the compliance pitfalls and blind spots of current and future international regulatory regimes.

Some specific regulations to be discussed will be the EU's upcoming General Data Protection Regulation (GDPR), which comes online in late May 2018, and the EU-U.S. data transfer agreement Privacy Shield.

The session's speakers will include Chris Dale of the eDisclosure Information Project; Meribeth Banaschik, partner, EY Germany GmbH.; Johnny Lee, principal and forensic technology practice leader for Grant Thornton's Forensic Advisory Services; Rachi Messing, senior program manager at Microsoft; and Steve Couling, vice president of international operations at Relativity.

Lee explained that the session will focus on how the international regulatory landscape “complicates investigative and compliance efforts in increasingly distributed networks,” and it will offer practical guidance concerning four specific areas.

The first will be “considerations for what ought to be the organizational policy for different companies, nonprofits or vendors” in light of international data regulations.

The second guidance will focus on what technology considerations companies should have when seeking to comply with these regulations. For example, the panelists will look at pros and cons of outsourced services, such as cloud storage, or “what type of technology [enterprises should] have in-house” in light of the GDPR's data localization mandate.

Third, the speakers will offer advice on what type of staff and training enterprises need to ensure continuing compliance with data regulations.

And lastly, the session will discuss how to bring the first three points together in an ongoing enterprise governance policy. For example, “What are the structures we need to set up in our organization to ensure that if we have a matter that involves international compliance, e-discovery or privacy regulations, that we have all those three elements brought to the table properly?” Lee explained.

When asked what the most challenging compliance demand enterprises faced, Lee singled out the GDPR, “primarily because it requires a level of understanding of organizational data that many companies don't possess, and that is going to be [a] challenge.”

“The presumption of the regulation is that you know where your sensitive data resides, how to protect it, and that you will protect it accordingly,” he said. “But that is something that is going to take a lot of effort for many organizations to meet.”

But the GDPR doesn't just mean enterprises will be penalized for improperly storing and managing data—it also means they will incur fines and legal action if they do not follow proper procedures when transferring data outside their organization for discovery or investigations. Lee, therefore, expects many enterprises to try to “shift the liability, or to share the liability when data transfers are occurring.”

Within contracts and agreements, many will look to “have obligations to provide notice if there are comprised events, and other similar protections, all with the underlying assumption that if the source organization gives away data and that leads to a compromise, the source organization is still responsible,” he said.

Still, Lee cautioned that “as the old adage goes, you can outsource the process, but you can't outsource the risk. So overall, I think organizations are going to be paying much more attention [on] those data transfers in litigation, investigations and compliance contexts because the stakes are higher now than they were prior to the GDPR.”