Login | November 15, 2024
Law Bulletin column: 50 ways to expose your clients’ data
DANIEL A. COTTER
Law Bulletin columnist
Published: January 29, 2018
We have over the last several years used this column to discuss matters of lawyers and technology and the importance that we understand the risks and benefits of technology.
When the American Bar Association passed the “technological amendments” to the Model Rules of Professional Conduct, the game changed. This column uses the familiar format of the song by Paul Simon, “Fifty Ways to Leave Your Lover,” to identify a variety of ways that you and your firm and colleagues may be exposing your clients’ data and giving them 50 ways to leave their lawyer. (Don’t even ask why this format came to me.)
There must be 50 ways for your clients to leave you for not taking privacy and cybersecurity seriously:
1. You leave your laptop in the cab, Fab.
2. You lose your thumb drive on the bus, Gus.
3. You don’t care about a good password, Gerd.
4. You use the free WiFi, Hai.
5. You don’t lock your door, Moore.
6. You just throw it in the trash, Cash.
7. You use the free Affinity e-mail, Hale.
8. You don’t close out Word, Hurd.
9. You can’t advise on GDPR, Ger.
10. You don’t know the amendments to RPC, Lee.
11. You don’t understand the risk, Lisk.
12. You don’t watch what you say, Jay.
13. You go to the virtual water cooler, Fooler.
14. You don’t lock up information about HR, Cher.
15. You have it open and obvious on the train, Main.
16. You talk in public very loud, Proud.
17. You don’t know AI, Fry.
18. You don’t know word one about blockchain, Jane.
19. You don’t understand how to encrypt, Skip.
20. You don’t lock sensitive data down, Brown.
21. You don’t have an incident response plan, Jan.
22. You without consent collect fingerprints, Hintz.
23. You do your research on sites housed in China, Lina.
24. You are not discreet, Pete.
25. You don’t shred but just throw away, Mae.
26. You use the free version of Box, Cox.
27. You e-mail instructions for the real estate wire, Meyer.
28. You don’t know your privacy obligation and duty, Rudy.
29. You don’t turn on automatic screen save, Dave.
30. You don’t have good policies, Holy See.
31. You click on the cute rooster pic, Dick.
32. You use that hyperlink, Mink.
33. You don’t take the time to think, Pink.
34. You never take the time to train, Lane.
35. You don’t take relevant CLE, Lee.
36. You think this stuff to you does not apply, Guy.
37. You don’t have anyone spend time to assess, Les.
38. You like to talk shop on the elevator, Gator.
39. You have never read Comment 8 to Rule 1.1, Son.
40. You don’t know about 1.6(e), Me.
41. You have not read ABA 477r, Starr.
42. You use a fly by night vendor for cloud, Aboud.
43. You don’t care to spend a dime, Lime.
44. You don’t have a locked box of shed, Fred.
45. You do sensitive work at the local coffee shop, Chop.
46. You don’t use Citrix or VPN, Sten.
47. You plug into public slots your thumb drive, Live.
48. You don’t have a good policy for BYOD, Key.
49. You don’t know the benefits and risks, Fritz.
50. You really don’t give a damn, Dan.
The first checkpoint as you read the list should be for you to understand the references being made.
If not, you probably need someone to review your firm’s privacy policies and procedures. You should next review the policies and procedures you do have to assess how reasonable and protective they are.
The reality is that much can be done for zero or de minimis out of pocket. It is important that you and your firm take privacy and cybersecurity seriously. It is not only your duty and obligation get under the Rules of Professional Conduct, but also is protection of your firm’s reputation, which at the end of the day is all that we as lawyers have to sell.
Don’t place yourself in a position where your clients have data and privacy-related reasons to leave you as their lawyer.
Daniel A. Cotter is a partner at Latimer LeVay Fyock LLC and an adjunct professor at The John Marshall Law School, where he teaches SCOTUS Judicial Biographies. The article contains his opinions and is not to be attributed to anyone else. He can be reached at dcotter@llflegal.com.