Data protection for law firms Wednesday 13 July 12pm

Freedom of Information Act 2000 Data Protection Act 1998 Privacy and Electronic Communications Regulations 2003 Freedom of Information Act 2000 Environmental Information Regulations 2004

What is “personal data”? “…data which relate to a living individual who can be identified – from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller”

ico.org.uk/for-organisations/register Legal requirement when processing electronically Costs £35 per year Virtually all law firms will need to register Registration ico.org.uk/for-organisations/register

Risks in the legal sector ! Risks in the legal sector

Legal sector data security breaches by type in 2015/16 In 2015/16, 4% of all data security incidents reported to the ICO related to solicitors and barristers. That’s 75 out of 1895. Legal sector data security breaches by type in 2015/16 This was a slight decrease of 4% on the previous year. The two main data security issues affecting the legal profession are: Loss and theft of paperwork (27% of incidents in 2015/16) Data being posted or faxed to The incorrect recipient (17% of incidents in 2015/16) 4% of all data security incidents (75 out of 1897) An upward trend throughout the financial year

Incidents by data type The information held by legal professionals is often very sensitive; therefore the damage caused by data security incidents is often substantial and could meet the threshold for issuing a financial penalty. The main data protection issues affecting the legal profession are:   Loss and theft of paperwork (27% of incidents in 2015/16) Data being posted or faxed to the incorrect recipient (17% of incidents 2015/16) Loss and theft of unencrypted devices (13% of incidents 2015/16) Data being sent by email to the incorrect recipients (13% of recipients 2015/16) These issues are reflective of the fact that information handled by legal professionals is often held in paper files rather than secured by encryption. Legal professionals will often carry around large quantities of information in folders or files when taking them to or from court, and may store them at home. This can increase the risk of a data breach. These issues are reflective of the fact that information handled by legal professionals is often held in paper files rather than secured by encryption. Legal professionals will often carry around large quantities of information in folders of file when taking them to or from court, and may store them at home. This can increase the risk of a data breach.

Not many examples of law firms themselves receiving CMPs, but these two examples involve internal legal team so the same kind of issues apply

Steps you can take Encrypt electronic devices Adequate physical security Data minimisation Clear policies and procedures Appropriate training Effective access control

Data Protection self assessment toolkit Use our toolkit to assess your compliance with the Data Protection Act and find out what you need to do Data Protection self assessment toolkit ico.org.uk/for-organisations/improve-your practices/data-protection-self-assessment toolkit

Questions about various aspects of compliance

Produce a traffic light report at the end highlighting the risks

Data Protection self assessment toolkit Quote from a lawyer Data Protection self assessment toolkit ico.org.uk/for-organisations/improve-your practices/data-protection-self-assessment toolkit

Advisory Visits

ICO guidance

Subscribe to our e-newsletter at www.ico.org.uk Keep in touch Helpline: 0303 123 1113 Subscribe to our e-newsletter at www.ico.org.uk or find us on… @ICOnews