Electronic Data Records Law | How to Win E-Discovery

Custom Professional Training

Tutorials | Questions Answered

Price | Professional Credit | E-Policy Workshop

Many professionals who visit this blog are looking for education on electronic records or technology law. Mr. Wright can deliver custom tutorials on the topics important to you right now.  A tutorial can be one hour, two hours, a half-day, or more.

Benjamin Wright has much experience training professionals on such topics as e-discovery, e-record privacy, data security law, cyber defense investigations, record retention policies, BYOD, e-commerce records and contracts, and more.

Now he delivers this continuing professional education on a tailored, as-needed basis.  Tell him what interests you, and he will work with you to develop a curriculum and a delivery plan.  The number of students could be one, two, 100, or more.

The method of delivery could be Webex, on-site, telephone conference, or something else, depending your needs and resources. A tutorial could combine lecture and interactive Q & A.

To discuss, please call Mr. Wright at 1.214.403.6642.


Price

Price would depend on many factors, such as the length of seminar time, the medium of delivery, out-of-pocket expenses, and the amount of advanced preparation involved.  A one-hour briefing by Mr. Wright to a small audience (delivered by telephone call you initiate) on a topic for which he already has material, could cost as little as $375.


Continuing Professional Education Credit

Many professionals – auditors, lawyers, investigators, accountants, records managers, security professionals -- need continuing professional education (CPE and CLE) hours.  Mr. Wright's tutorials are of a quality to support the granting of credit.  Mr. Wright will be happy to sign a letter confirming that any particular professional participated in a seminar.  However, the application for and obtaining of credit will be the responsibility of the individual professional.

Rules for continuing legal education credit vary by jurisdiction.  Often an attorney can obtain credit by applying for it after attending a seminar.


Policy Workshop

Mr. Wright and Messaging Architects deliver an in-house workshop for developing enterprise policy on BYOD and the retention, destruction and management of electronic records, especially e-mail.

=
Statement from Andrew Scygiel, Merck & Co., Inc. to Mr. Wright:  "Thanks again for a great class and very insightful information.  You have really changed my view of records and I have 'aspired' to be much more aware of our policy and how today's climate can affect us."

As senior legal instructor at the SANS Institute, Mr. Wright emphasizes that -- in response to an IT security incident -- an effective public message is just as critical as the technical and legal responses.

Metadata | Email Discovery Control

Logs and Audit Trails for Data Privacy and Internal Control

Filtering Attorney Work Product

Electronic records such as email serve as memorials of business actions and as evidence of legal responsibility.  But they are also vulnerable to abuse by privacy infringers or trade secret thieves.

One key to protecting e-records is metadata.  Meta-data comprises all the ancillary notes and audit trail surrounding a given record (a given e-mail) . . . the system logs showing when a record was created, who accessed it and when, how and when it was changed, to whom it was forwarded and possibly much more.  Metadata can illuminate an auditor or detective about the status, the history or the security of the record in question.

For records containing personally identifiable information (PII), good meta-data can be invaluable as an instrument of privacy.  Metadata can deter a snoop.  A busybody in a hospital  who wants to peek at a celebrity’s patient record will think twice before doing so if he knows the system will create an audit trail showing what he saw and when he saw it.  Further, in the investigation of a hacker incident, system logs can inform whether (for instance) the crook accessed credit card record X or social security number Y.  Armed with this information, an investigator can evaluate whether the hacker did or did not actually breach the security of record X or record Y.

Example: In the wake of a security breach at one of its hotels, Best Western International was able to evaluate the breach and narrow the universe of affected credit card numbers by inspecting specific logs on the computer in question. 

Accordingly, a well-crafted e-mail archival system will maintain extensive meta-data about each electronic mail record.  The M+Archive product for instance keeps tabs on who viewed a record, when it was printed and so on. 

Be all that as it may, sometimes system logs are undesirable.  For example, when an attorney turns over records in an eDiscovery request, she normally should not turn over metadata that constitutes her own work product.  As she reviews individual emails in an archival system, the system may be keeping meta-records showing which records she accessed, when she accessed them and how often.  Those records are probably her attorney work product, which normally is excluded from disclosure in the discovery phase of litigation.  She should normally screen out any such work product when she turns over required emails to another party.

I spoke to Ranjit Sarai, e-discovery expert at Messaging Architects. “The management of meta-data in an enterprise archival system can be tricky,” he said. “Normally you want the system to be making meta records for security and accountability purposes.  But sometimes ediscovery lawyers want to turn this logging feature off, or they want to filter out their work product metadata before delivering records to an adversary.  We have experience helping an attorney understand the options and craft a solution for her particular case.”

–Ben Wright

Mr. Wright often serves as a public speaker on the law of electronic records and investigations.

Data Loss Prevention Strategy

Transparency as Compliance with Data Security Regulation

How are data holders to comply with the swelling riot of data security laws?  These laws include breach notification laws, which require that individuals and/or government be notified when the security of private data has been compromised.  Perfect compliance is impossible.

Almost all the states have adopted breach notice laws – though they are not uniform – and legislatures are expanding the scope of the laws.  

The original law from California (effective six years ago) focused on identity information – name plus social security number, driver’s license number or financial account number.  Then the California legislature expanded its law to also include breaches of medical data. That expansion became effective January 1, 2009.  Result?  In the first five months of 2009, California authorities were notified of a whopping 823 healthcare data breaches, mostly through self-reporting by healthcare entities. That’s just one industry, in one state, in five months.  And California authorities anticipate that the flow of notices will rise as people in the healthcare community become better aware of the new law. 

A data breach can occur in myriad ways:  a misdirected fax or e-mail, a hacking incident or snooping by an employee.

Meanwhile, we see floods of breach notices issued in other states and other industries – retail, nonprofit, colleges, financial, professional services, water districts, school districts, county government, municipal government, state government, federal government.  No organization is immune.  As these laws sit longer on the books, the flow of notices grows larger and larger.

Why are there so many notices?  The reason is that the laws assume that 100% data privacy can reasonably be achieved.  They further assume that any shortcoming (or suspected shortcoming) of data privacy should be an unusual event within well-managed enterprises.  The assumptions are wrong.  
The expectations of the public, and especially the expectations of policy makers, are out of touch with the reality of modern data management.  These outsized expectations contribute to a growing risk of monetary liability on the part of data holders.

So what are data holders to do?  Obviously they need to invest in data security, training and investigation – and they have been.  But banks, schools, utilities, clinics, hospitals, merchants and government agencies can throw massive investments at this problem and never meet present expectations.