For The Defense, July 2010 - DRI Today

D E F E N S E E T H I C S A N D P R O F E S S I O N A L I S MProtecting Personal InformationWhat You Don’t Know CouldHurt You and OthersBy Diane M. Saundersn Diane M. Saunders is a partner with Morgan, Brown & Joy, LLP, a Boston- basedboutique specializing in representing employers in labor and employment mattersin New England and across the United States. She is a member of DRI’s Lawyers’ • Install automatic encryption on all laptops and wire-Professionalism and Ethics and Employment Law Committees. Ethics, continued on page 9186 n For The Defense n July 2010Massachusetts recently joined over 40 other stateswith comprehensive legislation requiring all entitiesthat store the personal information, such as Social Security,driver’s license, credit, and bank account numbers,of Massachusetts residents, to take appropriate steps toprotect that information, including the developing writtensecurity policies. The impetus behind this legislationhas been the large-scale data security breaches thathave captured headlines nationwide, involving companiessuch as Citibank, TJX, and Hannaford Supermarkets.While it may seem as if only large banks andretailers are prone to data security breach risks, attorneysare as well.Law firms and corporate legal departments store notonly the personal information of their employees, but oftenthat of their clients, witnesses, and others connectedto cases. In employment and tort cases, for example, legalfiles very often contain paper and electronic copies ofpersonnel, medical, payroll, and other records containingthe personal information not only of plaintiffs, but alsoof other individuals connected to cases. The personal informationstored in connection with class actions, particularlywage and hour class actions, is often voluminous.Indeed, because of the frequency with which legal pleadingscontain personal information, many courts have prohibitedits inclusion in court filings.Unfortunately, because of the wide and varied waysin which attorneys store personal information in theirpractices, they must do more than simply rely on their ITproviders to implement measures to avoid potential datasecurity breaches via their computer systems. Rather,attorneys need to take part in creating plans to ensurethat they inadvertently do not engage in data securitybreaches through their practices.Step One—Conduct an Audit of the PersonalInformation that Your Organization StoresThe first step to creating a data security plan is to figureout what type of personal information your organizationstores and where it is stored. Among the questions youshould ask during an audit are:• Are paper files containing personal information everleft on the desks of attorneys, paralegals, or other staffmembers?• Does personal information leave the work site withattorneys or paralegals?• Do attorneys or paralegals copy all or portions of casefiles containing personal information onto thumbdrives or onto their home computers?• Do they access electronic case files containing personalinformation remotely via the internet or transmitthem to others through unencrypted e-mail?• Do they remove from the office all or portions of paperfiles containing unredacted documents with personalinformation?• What happens to extra copies of material containingpersonal information—are these documents shreddedor simply thrown in the trash?• Do any third-party vendors, payroll companies andexpert witnesses, for instance, receive and store personalinformation on your behalf?Step Two—Develop a Plan to Protect the PersonalInformation that Your Organization StoresOnce you know the “what” and “where” of the personalinformation that your organization stores, you shoulddevelop a plan to ensure that you are adequately protectingthat information from an inadvertent, data securitybreach. Your plan should take into account the variedways in which your company stores personal information—paper,electronic files, e-mail, third-party vendors—andshould include measures to protect each one.Some of the most important measures that you shouldconsider implementing include the following:• Institute a data destruction policy to limit the amountof personal information that your organization storesand require the appropriate destruction of documentscontaining personal information;• Ensure that all computers used by attorneys, paralegals,and staff members have up-to-date firewalls,virus, malware, and spyware protection;