The story of North Korea allegedly hacking into Sony's IT infrastructure and sending Sony a threatening email that led it to cancel the distribution of a new film, “The Interview,” a comedy-adventure film about two Americans who land an interview with North Korean leader Kim Jong-un, dominated the news as 2014 winded down. At the time of this writing, the United States was contemplating what action to take in response, and President Obama, who compared the Internet to the “Wild West,” called for international cooperation in forging agreements and creating agencies to police Internet conduct around the globe.

Since there has been, for the past few years, considerable public discussion about the need for law firms to address information security, or InfoSec, issues with their clients, with regard to e-discovery and other vendors that house firm data, and within the firms themselves, InfoSec can hardly qualify as the next big thing. However, the Sony story has brought the issue front and center and, as we begin 2015, we can be sure that the issue will only grow. With that in mind, I'd like to look at some recent changes to California's law regarding duties that arise when a party (think here a law firm) receives data personal to another party (think typical e-discovery electronically stored information), to discuss the changes on their own merits, and to segue into a more general discussion of law firms' obligations regarding InfoSec.

The California Law

California Civil Code Section 1798.81.5 (b), unamended, requires that a “business that owns or licenses personal information about a California resident … implement and maintain reasonable security procedures and practices … to protect the personal information from unauthorized access, destruction, use, modification or disclosure.” For those outside of California, note that the law pertains to information “about a California resident,” regardless of where that information is stored. This type of law, protecting a state's residents' information regardless of whether that information is stored within or outside of the state, is common. So, law firms, ask yourself how many matters you are involved in where you are storing, for litigation or other legal services purposes, information of California residents. The law applies to you. Also ask yourself, regarding all of the other matters where you are storing ESI, whether you know the residency of all of those people whose ESI you are storing. If you don't, you must assume that those matters as well fall under the statute.

The recent changes amend the phrase “business that owns or licenses personal information” to read “owns, licenses or maintains personal information.” In typical litigation matters, you, the law firm, do not own or license the personal information, but there is no denying that you do maintain it. Thus, the amendment was put in place to remove the escape valve for all sorts of businesses—businesses that maintain the credit card information of clients or the Social Security numbers and other personal information of their employees, for example, and not simply, or principally, law firms that neither own nor license that information, but certainly maintain it.