I keep getting asked about Cambridge Analytica and Facebook. And no one seems to like my response – I’m frankly amazed that this all took so long to blow up. How long? How about since 1973. That’s when the U.S. Department of Health, Education, and Welfare first articulated the Fair Information Practice Principles (FIPPs or FIPs) in its report Records, Computers, and the Rights of Citizens: Report of the Secretary’s Advisory Committee on Automated Personal Data Systems. The FIPPs went on to become bedrock global privacy principles, and central to them are the principles of notice and consent.
As the FTC later explained in Privacy Online: A Report to Congress:
1. NOTICE/AWARENESS
The most fundamental principle is notice. Consumers should be given notice of an entity’s
information practices before any personal information is collected from them….
2. CHOICE/CONSENT
The second widely-accepted core principle of fair information practice is consumer choice
or consent. At its simplest, choice means giving consumers options as to how any personal
information collected from them may be used….
These mechanisms – notice and consent – are what make a self-governing privacy system work. If someone (such as Facebook) is going to obtain and use our personal data, they should first give us notice of how they will use it (such as provide or sell it to others), and then we make a choice – we either consent and provide our data, or we don’t. The government may enforce these representations and choices under fair trade practices laws, such as FTC Act Section 5, but the rules themselves are made in the marketplace.
There has to be some source of governance. The alternative to self-governance through notice and consent is governance by government, with legislators and regulators making the rules for how our data is handled. There’s quite a bit of that in the EU and elsewhere, but in the United States, outside of specific sectors such as healthcare (HIPAA), education (FERPA), and financial services (GLBA & FCRA), there’s little such regulation here. In the U.S. we’ve made a policy decision to largely self-govern the privacy of personal data.
Fast forward from 1973 and, especially in our Internet-driven, U.S. self-regulatory environment, we’ve got a large, smoking crater – precious little government regulation, and even less personal responsibility. Let’s face it. We don’t actually pay attention to privacy policies and terms of use, and we don’t actually make informed choices on our consent to data practices for our personal information. Under our self-governing privacy system, look in the mirror. The enemy is ourselves.
Testing for technical vulnerabilities is a key part of security risk assessment. To get the straight scoop on technical vulnerabilities, and how they’re exploited, why not ask a hacker?
Would you take a deposition by solely following a template of standard questions, without assessing the unique issues and circumstances of the case? Or conduct transaction due diligence by simply marching though a generic punch list, without assessing the unique aspects of the company, the deal, and the industry? Of course not. Your law firm’s data security posture is no different – you need a security risk assessment to understand your firm’s unique vulnerabilities to security threats, and to identify which security controls are already adequate for your firm and which other safeguards are needed.
I had a nagging worry that something was wrong with my car, so I finally decided to take it to the dealer. I couldn’t exactly describe my concern, except there was an intermittent, “funny noise” coming from somewhere in the front end. An unscrupulous dealer would have taken me down a long path of parts replacement, beginning with tires, then wheels, then tie rods, and on and on, perhaps never fixing the real problem. Fortunately, my dealer was honest and performed diagnostics, ultimately discovering that the rack and pinion was failing. The part was under warranty, so the repair cost me nothing and my funny noise is gone.
As explored in last week’s posts, the 
Law firms face significant 
It all seemed so routine, so straightforward. The case was settled, with a $500,000 payment to be made to the approved settlement administrator. The law firm received an email from the administrator with wire transfer directions, and the settlement funds were sent per the instructions. Just one problem – the email didn’t come from the administrator, the receiving bank was not the right bank, and the half million dollars evaporated. Poof – gone in an instant.
Sometimes one needs to zoom in to understand the big picture. This year we’ll continue to explore Information Governance, but through the lens of a particular industry segment – law firms – and a particular focus – data security.
How time flies. Seventeen years ago, I went to work for a small, visionary company based in Seattle—Computer Forensics, Inc. Indeed, the founder was so early in the e-discovery and forensics industry that our URL was forensics.com. Laptop drives typically had 8 GB of storage, and servers were more often than not simply a bigger box that sat in a closet.