Data Privacy

Last week, the law firm Norton Rose Fulbright launched the Network Traffic Analyzer (NTA), a new data protection tool designed to help organizations keep track of data they didn't even know they were collecting. Such data could possibly be bringing them into conflict with any one of a number of data privacy regulations sweeping the globe.

That raises a lot of questions, the most pertinent of which might be, are companies really still struggling with compliance almost one year after the European Union's sweeping General Data Protection Regulation (GDPR) came into force?

“When we get hired, it's not like we generally find pictures of good compliance or near compliance. We generally find a lot of stuff,” said Steven Roosa, head of digital analytics and technology assessment platform at Norton Rose.

Companies turning to their law firms for an assist with cybersecurity and privacy compliance is certainly nothing new. Last fall, Lewis Roca Rothgerber Christie formed a partnership with cybersecurity consulting firm eosedge Legal in order to sharpen its edge in the field of technical cybersecurity. Apps specializing in compliance—like Parsons Behle & Latimer's CCPA IQ—are also in vogue.

Still, NTA was always designed to be more than a digital repository for legal advice. According to Roosa, keeping track of all the different laws on the book is actually not the most arduous part of compliance for most organizations.

“It's even more difficult to know what data your app or website is actually collecting or sharing,” Roosa said.

At least some of that has to do with the third party software development kits (SDKs) that developers incorporate into their own source code to help with analytics or advertising.  According to Roosa, it's not uncommon for an app to contain up to 10 different SDKs, all of which could be collecting data that falls into the personally identifiable information category.

“Oftentimes, free [third party] services will often take data and then re-purpose that for their own data selling,” Roosa said.

Meanwhile, the organization deploying the app may be totally unaware that this additional information has been collected at all. NTA was designed to identify that data—coded or not—and check it against potential conflicts with various privacy regulations. Legal insight, however, is still crucial.

“It's funny for a technical solution to say this, but our biggest advantage is definitely the global team's input on what matters and exactly what we need to find in terms of types of information,” Roosa said.

While this iteration of the NTA may be geared towards compliance, Roosa thinks there could also be potential applications down the line that could help offset the leakage of proprietary data within a company.