Data Privacy

Roughly a month-and-a-half after California issued the first COVID-19 stay-at-home mandate in the U.S., with nearly all other states soon following, many lawyers and their staffers have likely settled into a routine for remotely working.

But while successful, the legal industry's sudden shift to remote work didn't include the significant data governance and tech considerations needed for a more permanent, long-term switch to telecommuting, industry observers warned.

However, as law firms slowly reopen and consider offering permanent telecommuting status to attorneys and staffers, their policies have to be adjusted. For now, most firms' telecommuting polices are short-term and one-off, said certified information privacy professional and Cozen O'Connor member Brian Kint.

"It wasn't necessarily a solution for a long-term use where you have employees working remotely everyday," said Kint. "Those policies may not be tailored to those situations and flexibility may need to be included."

One consideration for long-term policies is that while flexibility regarding leveraging technology to meet a client's demand is important while telecommuting, it cannot be at the risk of harming the firm's cybersecurity, noted Cozen O'Connor cybersecurity consultant Trevor McGuinness. He explained that consistent telecommuting exposes a law firm's firmware and data to various software that must be continuously evaluated.

"At the end of the day, to adopt these temporary decisions to get people up and running remotely for a long term would be haphazard at best," said McGuinness. "I think companies will have to look at their infrastructures to know how their applications interact and [if there's] any security gaps."

A significant remote workforce also ushers in other hurdles for a law firm or company's IT department, he added.

"Inventory management is one area most IT departments may not have the best and strict policies [for], especially in the wake of the COVID pandemic," he said. McGuinness added that tracking data across company-owned and personal electronics, logging access to data and early notifications spotting worrisome actions would also be crucial for supporting a permanent remote workforce.

Software and electronics also muddies ethical and legal compliance, with telecommuting raising the likelihood of misplacing data, Kint noted.

"When everyone is at the same physical location and has easy access to a firm's networks, it's easier to control the data. But as people disperse in their remote workspace, they can have a tendency to not adhere to the policies and procedures in place," Kint said. "Employees may have a sense that they need to send something to a personal email or put a document into their Dropbox." Such lax behavior can lead to losing data and ethical issues may arise when clients' sensitive or confidential matters are exposed, he added.

In response, a long-term remote working policy should be tailored by including ongoing education detailing the law firm's data sharing and storage policies, Kint said. When remotely working long-term, fostering a culture of compliance is also important when lawyers and staffers aren't working under direct supervision.

"It can be a little bit easier to kind of let things go, let minor things go when most of the workforce is in the office," Kint said. "But when lawyers are largely dispersed throughout the country there needs to be strict compliance to make sure the data is where it needs to be so the law firm has control of the data."