December, 2023 | Article
Navigating the digital frontier -The growing importance of data minimization for Canadian law firms
A seismic shift has occurred in the operational landscape of Canadian law firms, propelling them into an era of unparalleled digital transformation. Like their global counterparts, many firms are embracing digitization, transitioning from traditional on-premises systems to cloud-based solutions and adopting modern communication tools such as Zoom and Microsoft Teams. While these changes promise heightened efficiencies and greater accessibility, they introduce a new set of challenges, particularly in information governance and the protection of sensitive legal information.
In this article Chris Giles delves into the driving forces behind the escalating significance of a data minimization strategy. He explores the hurdles associated with the migration to the cloud, the mounting cyber threats, the intricate web of privacy legislation and the promising business development opportunities entwined with effective information management. Finally, he suggests a five-step roadmap to establishing a robust information governance framework.
Drivers for information governance and data minimization
There was a time when attorneys and firms were much more comfortable keeping client records and data indefinitely than they were destroying them. But that time has now passed and in today’s legal landscape data minimization has become essential. Firms that don’t practice data minimization have greater exposure through security breaches. They also run the risk of some dire cost, performance and reputational consequences.
1. Migration of document management systems (DMS) to the cloud
Firms need to think seriously about the avoidable costs of excess data storage. Until quite recently, data storage was a fixed, and relatively manageable cost. But with the use of cloud collaboration services rocketing, the cost of continually increasing electronic data storage volumes could fast become uncomfortable.
This is borne out by a December 2022 study that showed that 500 technology leaders in mid-to-large sized organizations are spending up to one-third of their IT budget on ballooning data storage costs. Survey respondents also thought that the rising costs of data would be “unsustainable” by 2025.[1]
2. Cybersecurity concerns and ransomware attacks
A significant danger is the growing incidence of cybercrime targeted at law firms.
Cybercriminals know law firms hold a wealth of data worth stealing, which is also often ransom-worthy and relatively – in comparison with financial services and big pharma for example – poorly protected.
And this risk is not likely to recede any time soon. According to ABA’s 2021 cybersecurity report, ransomware is: “An increasing threat to attorneys and law firms of all sizes”.[2] And unfortunately, the low ebb in international relations between the West and Russia and China only exacerbates the threat, since the Russian and Chinese governments are not currently minded to clamp down on their homegrown cybercriminals. Quite the opposite.
3. Compliance with privacy legislation
Navigating the intricate landscape of privacy legislation has become a pressing concern for firms. The Personal Information Protection and Electronic Documents Act (PIPEDA), alongside global counterparts like GDPR and CCPA, has introduced a complex set of principles. From accountability to openness and access, law firms need to ensure meticulous compliance to avoid legal consequences and safeguard their reputation.
4. Compliance with the demands of your clients and profession
The next compliance booby-trap for firms is Outside Counsel Guidelines, which are becoming more ubiquitous and more demanding. Whereas they were initially conceived as a mechanism to help ensure the client is getting value for money from the firm, in the light of rising cybercrime OCGs are becoming more prescriptive around how and for how long firms holds client data. In addition, some clients – particularly big corporates – are setting their own “gold standards” for data management that go beyond existing or anticipated legislation, and which are being passed on in OCGs.
5. Business development opportunities and operational efficiency
Information governance is emerging not only as a shield against risks, but also as a catalyst for business development opportunities. Embracing leaner data sets paves the way for operational efficiencies and strategic data management positions law firms to optimize systems, streamline processes and respond with agility to client needs.
It's also the case that when firms prospect for new business and when clients are reviewing the firms they want to retain, reassurances are needed about how data, some of which is hyper-sensitive information, is being stored and actively managed in line with best practice. The ability to point to rigorous information governance systems will strengthen your hand in competitive pitches.
6. Data integrity and truth in an AI world
As artificial intelligence gains prominence in the legal sector, the integrity of data is becoming paramount. Accurate and reliable data will be the lifeblood of AI applications in legal research, document review and predictive analytics. Information governance will be the bedrock that will ensure the veracity and reliability of data to enhance the efficacy of AI in legal practice.
What should firms do now? – A 5 step plan
Acknowledging the numerous and growing risks and opportunities that law firms face when excess information isn’t systematically minimized does not make the daunting task firms face in tackling the issue any easier.
The trick is not to be overwhelmed by the magnitude of the task of taming data, but rather to approach it in a systematic and methodical way.
1. Establish a committee
An information governance program requires collaboration. A cross departmental team would commonly consist of heads of departments or practice groups, the CIO, CISO, General Counsel, DPO and, of course the Director of Information Governance. The committee is the reference point for all subsequent activity and ensures representation and buy-in from across the firm.
2. Determine and document the location of your data
A comprehensive mapping exercise is foundational to understanding your data landscape. You need to include less obvious locations like redundant servers and ‘shadow IT’ in places outside the boundary of the firm’s sanctioned and provisioned IT infrastructure. Plus, don’t overlook the firm’s other records residing in HR, finance, etc.
Once you know where your firm’s information assets are located, look to categorize and classify them by as many metadata perimeters as possible. Do they contain personally identifiable information (PII), intellectual property or are they confidential or commercially sensitive? Data should also be classified in terms of document type, practice group, department, office or jurisdiction where these have a bearing on retention and disposition; and client engagement requirements (if any) around retention/disposition.
3. Develop a simple retention and disposition policy
Simplicity is key when crafting a retention and disposition policy. Focus on clarity rather than complexity. Define how long different types of information will be retained and establish criteria for disposition. If impractical, explore alternative policies that remain effective and practical.
4. Implement the policy
Systematic implementation of the retention and disposition policy is critical. Address backlogs based on the age of the data, prioritizing “low-hanging fruit” and bulk retention decisions as these quick wins can build momentum.
Simultaneously, begin mapping the retention process for more recent material, ensuring a comprehensive approach to information governance.
5. Overcome challenges to move forward with destruction decisions
Persistence is key as reaching destruction decisions can be hard.
Help the attorneys who are going to authorize data destruction by giving them all the information they need to reach a decision. This includes confirming that no fees are outstanding and the date on which the firm’s criteria for a closed matter have been met. Then follow the preordained destruction procedure. Paper needs to be shredded or pulverized, and electronic files must be deleted beyond retrieval or reconstruction and not just archived.
Proceed iteratively
When we talk of five steps, it’s not necessary to complete them sequentially. Don’t destroy data until you have a policy in place, but otherwise don’t wait for one step to be completed before the next one starts. Do what you can when you can. But it’s also sensible to prioritize your areas of highest risk.
Finally, know that you don’t need to execute data retention and disposition unaided. Sophisticated software tools, such as iCompli, have been developed to help – for instance by automating how a data retention and disposition policy is systematically applied to mapped data. You should start talking to software vendors early in the process to minimize redundant effort and maximize the efficiency of your data retention and disposition project from day one.
To find out more watch on demand the recent TLOMA Technology SIG, where Chris Giles presented this topic. You can also get in touch with the team at LegalRM to discuss your firm’s strategy for taming data and achieving information governance.