Insight into where e-discovery, information governance cybersecurity, and digital transformation are heading – who is doing what now or in the future, what works and what doesn’t, and what people wish they could do but can’t – gleaned from recent publications

ABOVE THE FOLD

Join Mary Mack and me for a new ACEDS webinar series, Monthly Insights with George & Mary, starting Wed. Sept. 11.

Relativity Fest Oct. 20-23 – Join us this fall at Relativity Fest in Chicago where I will be speaking on three sessions:  LIE291972 – Is It Time to Rethink the EDRM?; PD311742 – A Call to Action: Building an e-Discovery Pro Bono Platform and Network; and PR311751 – Let’s Take This Online: Managing Mobile Data in Relativity Short Message Discovery.

ELECTRONIC DISCOVERY

Advanced strategies for analyzing mobile data – Martha Louks of McDermott, Joe Sremack of BDO, and I published the third in our series on mobile device data. In Part 1, we discussed preserving and collecting mobile device data. In Part 2, we turned to the types of information you can expect to encounter with mobile devices and key considerations for analyzing, reviewing, and producing these types of data. In Part 3, we examine advanced strategies for analyzing device data and how you can apply those strategies to your cases.

When a phone goes missing – David Horrigan of Relativity, dug into Commonwealth v. Fowler, a case that turned not on the facts of an alleged July 2016 sexual assault but rather on a July 2019 court hearing about the whereabouts and contents of the allegedly assaulted person’s missing mobile phone. The key message: mobile device data matters.

Proportionality and privacy – Nicole Allen of Kilpatrick Townsend analyzed the interconnections between proportionality under FRCP 26(b)(1) and privacy and offered three lessons: privacy now is a proportionality limitation, legitimate privacy concerns will be recognized, and that the parties must cooperate.

CYBERSECURITY & DATA PRIVACY

Board of directors’ cyber-risk oversight practices – Melissa Krasnow of VLP Law Group summarized the results of two National Association of Corporate Directors surveys on cyber-risk oversight practices performed by boards of directors, the 2018-2019 Public Company Governance Survey and the 2018–2019 Private Company Governance Survey (membership required to download). Of the 16 cyber-risk oversight practices performed by public and private boards of directors over the past year, the top three were: (1) reviewing the current approach to securing the most critical data assets against cyberattacks, (2) reviewing the approach to data privacy protections, and (3) communicating with management about types of cyber-risk information the board requires.

Cybersecurity Maturity Model Certification – Mary Beth Bosco and Eric Crusius of Holland & Knight reported on new cybersecurity standards, the Cybersecurity Maturity Model Certification (CMMC) standards, being promulgated by the U.S. Department of Defense’s Office of the Under Secretary of Defense for Acquisition and Sustainment’s new cybersecurity standards, the Cybersecurity Maturity Model Certification (CMMC) standards. They noted that compliance with this new set of security standards will be required for DoD contractors to compete for contracts. Details are at the CMMC website.

Cyber incident and breach trends report – The Internet Society’s Online Trust Alliance released their 2018 Cyber Incident & Breach Trends Report. Highlights of the 15-page document, as summarized by LLM, include the better (numbers of incidents, data breaches, and exposed records all are down), the worse (the impact of incidents was greatly on the rise), and the bad (even with the numbers down, there were 6,515 breaches, 5 billion exposed records, and 447 million sensitive records exposed).

Data breach costs – Jean Tomasco of Robinson+Cole, discussing the results the 76-page 2019 Cost of a Data Breach Report recently released by the Ponemon Institute and IBM Security, noted that health care organizations have the highest costs for data breaches – an average cost of $6.45 million per breach and $429 per record compromised.

Draft EU guidelines on processing personal data through video devices – Ataikor Ngerebara, James Clark, and Patrick van Eecke of DLA Piper reported that the European Data Protection Board has published a draft version of Guidelines 3/2019 on processing of personal data through video devices. Comments on the draft are due by September 9.

CLOUD Act assessment – Kristof Van Quathem and Nicholas Shepherd of Covington wrote that the European Data Protection Board (“EDPB”) and the European Data Protection Supervisor (“EDPS”) recently issued a 10-page joint initial legal assessment of the impact of the U.S. Clarifying Overseas Use of Data Act (“CLOUD Act”) on the EU legal framework for protection of personal data.

Dutch regulators addressed use of transaction data for marketing purposes – Chris Ewing, Tim Hickman, and Nathalie Colin of White & Case wrote that the Dutch Data Protection Authority sent the Dutch Banking Association a letter informing it that processing individuals’ transaction data for direct marketing purposes may not comply with the GDPR. Appended to the letter was guidance meant to help banks determine whether processing transaction data for direct marketing purposes would be compatible with the original propose for which the data had been collected.

NY enacted SHIELD Act – Joseph Lazzarotti, Jason Gavejian, Damon Silver, Mary Costigan, and Maya Atrakchi of Jackson Lewis discussed highlights of the New York Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) recently signed into law.

NYC moved to prohibit sharing location data – Womble Bond Dickinson reported that the New York City Counsel is considering legislation, Int 1632-2019, that would prohibit telecommunications carriers and mobile applications from sharing cellphone users’ geo-location data with third parties, when data is collected while mobile devices are in NYC.

CCPA –

• Proposed Amendment to California Consumer Privacy Act (CCPA) Reaffirms Employer Notice Requirement and Employee Private Right of Action for Failure to Implement Cybersecurity Safeguards to Take Effect January 1, 2020
  Brian Cesaratto, Patricia Wagner, Deanna Ballesteros, and Matthew Savage Aibel (Epstein Becker & Green) (July 23)
• California Consumer Privacy Act (“CCPA”) Amendments One Step Closer to Passage
  Angelica Zabanal (Duane Morris) (July 23)
• CCPA Security FAQs: Does the CCPA Allow an Individual Whose Email Address is Compromised Through a Data Breach to Recover Statutory Damages?
  David Zetoony (Bryan Cave Leighton Paisner) (July 23)
• The CCPA’s Contractual Requirements Between Covered Businesses and Service Providers
  Steven Blickensderfer (Carlton Fields) (July 23)
• CCPA: The (Qualified) Right to Deletion
  Yoni Bard and Scott Bloomberg (Foley Hoag) (July 24)
• California Senate Weakens Potential CCPA Employee Exemption
  Sheryl Falk, Alessandra Swanson, and Eric Shinabarger (Winston & Strawn) July 25)
• CCPA Amendment Progress Report: July Update
  Melinda McLellan and Taylor Bloom (BakerHostetler) (July 25)
• How To Prepare For the California Consumer Privacy Act’s Impact on eDiscovery
  Chuck Kinnan (Milyli) (July 29)

INFORMATION GOVERNANCE

OMB on chief data officers and data governance – Jason Baron of Drinker Biddle analyzed a recent 37-page memorandum from the Office of Management and Budget, M-19-23, Phase 1 Implementation of the Foundations for Evidence-Based Policymaking Act of 2018: Learning Agendas, Personnel, and Planning Guidance, that announced a commitment to align data and information policy guidance across the federal government in four phases (Learning Agendas, Personnel, and Planning; Open Data Access and Management; Data Access for Statistical Purposes; and Program Evaluation) and then focused on the first phase.

LEGAL TECHNOLOGY & DIGITAL TRANSFORMATION

Law firms in transition – As noted by Jim Gill of Ipro, Altman Weil has released an 80-page report on the results of its Law Firms in Transition 2019 survey. The report substantive sections are Market Forces, Productivity, Lawyer Staffing Strategies, Efficiency of Legal Service Delivery, Pricing Strategies, Law Firm Profitability, Practice Groups, Leading Change, Financial Performance, and Bonus Question.

E-DISCOVERY CASE LAW

Recent e-discovery decisions

7/1/2019 – U.S. District Judge Robert Bryan denied the requesting party’s motion to compel production of documents and metadata. As to the documents, the court found that the requesting party had failed to identify a specific response for production to which the producing party did not respond. As to the metadata, the court found that the responding party already had complied with an earlier production order to the extent that it was able, and that the requesting party had not shown that the metadata it sought was relevant and proportional to the needs of the case. Washington v. GEO Group, Inc., No. 17-5806 RJB (W.D. Wash. July 1, 2019).

ANNOUNCEMENTS

ADDITIONAL ARTICLES

UPCOMING EVENTS

Conferences, webinars, and the like can provide insight into where e-discovery, information governance cybersecurity, and digital transformation are heading

8/1/2018-8/30/2019 EVENTS