Data

 

This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.

 

Information governance and the protection of corporate data are top concerns for law firms. To ensure standards are met, some clients are now tying payment to compliance with outside counsel guidelines (OCG). OCG have moved from guidelines to actual contracts that provide for indemnification of the client for cyberbreach and violation of privacy laws, and require firms to explicitly secure the client's data. 79% of legal departments now provide OCG to their law firms, a 30% increase over 2017, and OCG are overwhelmingly the most effective methodology for legal departments to control spend and mitigate risk, per the 2018 Altman Weil Chief Legal Officer Survey.

To comply with the data side of the OCG, firms must have a clear information governance strategy for which the firm's use of technology systems is foundational. Ensuring that the clients' documents are organized, that nonpublic data is secured and that protocols are in place to allow for the destruction of data or its transfer when requested, are prominent aspects within that strategy. Firms can better deliver on clients' needs through an effective IG program; specifically gaining these process improvements:

  • Greater visibility into information assets (defined location and classification);
  • Proper access control and security of information (use of firm-sanctioned systems with permissions);
  • Ability to migrate to an electronic-first mind-set and cut down on paper with the official record housed in electronic format in the system of record (g., Document Management System) whenever possible, with exceptions for policy carve-outs;
  • Defined user expectations by role for proper file maintenance (electronic and paper);
  • Ability to locate and purge information per retention schedules (application of policy to all documents regardless of location or media);
  • Reduction in off-site storage needs and costs (destruction of legacy documents, a decrease in future documents going off-site, and purging of remaining off-site records per retention schedules); and
  • Auditing protocols in place to ensure defensibility.

How to Implement Information Governance: Am Law 100 Firm Example

Implementing these changes can be onerous and complex, which is why many firms benefit from an outside expert to advise and oversee the implementation of their IG programs. We recently worked with an Am Law 100 firm to do just that. The voluminous amount of extremely sensitive material the firm handles, coupled with a sense that neither firm-wide standard practices or the integrated use of company systems aligned with proper user behavior were in place, meant that OCG compliance was going to be tough to demonstrate in the firm's current state. Recognizing these shortfalls, the firm's leadership decided to leverage the expertise of a consultancy firm to navigate, implement, and ensure compliance with their information governance mandate.

The number one directive for process improvements—greater visibility and accessibility of information assets (such as email, network shares, archives, document management systems, records management systems, physical media, and 3rd party sharing tools) was the first priority. A data mapping exercise illuminated where all the firm's information resided, and a plan was put in place to streamline the number of data stores and facilitate the flow of information to the appropriate systems.

A change management program was critical in getting users to change their behavior when it came to document handling. For example, long-term storage of critical information in email and network shares had long been a common practice (as with most law firms). This created information silos where the firm could not leverage that information or ensure its compliant storage with ultimate disposition per policy. For a successful program moving forward, users were required to migrate critical information into the document management system (DMS). Further, standardization of indexing within the document management system was critical for cross-user retrieval and any future disposition exercises.

The ability to locate and purge information per retention schedules therefore became the next focus. While many firms only address destruction of paper records, an effective IG program requires attacking both electronic and paper. On the electronic side, workflows were created for moving legacy information from email and network shares into the DMS en masse. This required standing up 3rd party tools to facilitate relocating documents from numerous locations, coupled with extensive user training and the setting of milestone dates for compliance. Ultimately, official retention schedules were managed within the DMS for official electronic records, with all ancillary data locations purged per a set schedule.

For physical records, a comprehensive diagnostic revealed that the off-site storage contract did not allow the firm to destroy physical records in a cost-effective manner. Further, a complicating issue with many of the older off-site boxes was a lack of precise knowledge of their contents (due to a number of system migrations, vendor changes, acquisition of smaller firms, etc.). The firm needed a defensible plan for gaining insight into box contents in advance of destroying those contents per retention schedules. The consultants utilized their industry-wide expertise to negotiate a new off-site storage contract that allowed the firm to have the selected service provider review the contents of the boxes, and then, if allowed per the retention schedule, destroy. The firm will be able to conduct this review-and-destroy, and still realize savings (versus simply storing all materials indefinitely as had been the firm's practice).

Future-Proofing Information Governance

For these process improvements to be sustained and lasting, the firm's leadership understood that streamlining firm-wide protocols was central to successful implementation. The standardization of tool sets, promotion of the correct user behavior, and the enforcement of methods for purging all ancillary data stores were recommended. Additionally, an extensive change management program was put in place to address user behavior, workflow, and the integrated use of systems.

By the end of the process this firm had implemented an information governance program that allowed for defensible management of all information assets regardless of media or location. This ushered in uniform user behavior integrated with the firm's technology system to create less paper and send minimal paper off-site in the future. The firm continues to draw down on physical off-site records in a cost-effective manner, with the ultimate goal to be out of the off-site storage business in the next 10 years.

Delivering on all client needs is the top priority for law firms — compliance with outside counsel guidelines has become an indispensable part of meeting those needs. Processes to make sure that the clients' documents are organized, that nonpublic data is secured and purged where necessary, all while instilling a firm-wide culture of adherence to best practices, combine to alleviate inefficiencies and trim bottom-line costs. The firm has aligned its users' behavior with the use of supporting systems and adherence to policy in order to achieve the necessary visibility and compliance for all information, electronic and physical, while still realizing savings over the next 10 years by drawing down on the hard costs related to physical storage.

 

Stephen Cole is Director, Client Technology & Strategy at Mattern & Associates and can be reached at [email protected]. He has a successful track record with over 20 years of expertise in consulting for large law firms. Cole gained his experience both on the service provider and law firm sides including as the Vice President over the legal business unit at Pitney Bowes Management Services, a technology specialist at an AmLaw 50 firm, and most recently, a Regional Vice President of Ipro Tech, an advanced e-discovery solution.