Legal Issues Contracts & Electronic Discovery Source: CSA Security Guidance Report v.3 Presented by: Toby Tobkin – 1

Motivation why i chose this topic 2

Privacy Law 3

Data Privacy Data on the Internet is vulnerable  I won’t show a proof for this 4

Data Privacy Data on the Internet is vulnerable  I won’t show a proof for this Burden of protection of personal data is on organizations in some regions 5

Data Privacy Data on the Internet is vulnerable  I won’t show a proof for this Burden of protection of personal data is on organizations in some regions Some regional organizations that mandate this:  OECD: Organization for Economic Cooperation and Development  APEC: Asia Pacific Economic Cooperation  EEA: European Economic Arena 6

Examples of US Privacy Laws Federal  Laws: GLBA, HIPAA, COPPA  FTC orders 7

Examples of US Privacy Laws Federal  Laws: GLBA, HIPAA, COPPA  FTC orders State  Generally: reasonable security measures must be in place  including with subcontractors 8

Privacy by Contract If some aspect of privacy isn’t regulated, it could still be specified by a contract  but you knew that Company using cloud service may  Have a contractual obligation to protect employee data it’s storing  Want to protect their trade secrets stored in the cloud  Have a privacy contract with their customers  Specify that data can only be used for certain purposes 9

Contracts 10

Concepts Data custodian 11

Concepts Data custodian Due diligence 12

Cloud E- Discovery Issues 13

Discovery Phase In litigation, this comes prior to the trial Philosophy: neither party should be able to keep secrets from each other 14

Discovery: Problems Data that may be demanded might not be under a party’s control  Might be on a third party’s backup system  Or something Problem: whose obligation is it to produce requested information? According to this document: it depends 15

Discovery: Problems Standard e-discovery tools may not work 16

Discovery: Problems Standard e-discovery tools may not work Rules on preservation don’t seem to be clear  who pays for storage? client? service provider?  what constitutes “relevant” information to a litigation?  what about programmatically purged data? 17

Discovery: Problems Standard e-discovery tools may not work Rules on preservation don’t seem to be clear  who pays for storage? client? service provider?  what constitutes “relevant” information to a litigation?  what about programmatically purged data? Collection can be difficult  Limited bandwidth  Limited client functionality  Physical forensics could be overly intrusive on something like EC2 18

Discovery: Problems Standard e-discovery tools may not work Rules on preservation don’t seem to be clear  who pays for storage? client? service provider?  what constitutes “relevant” information to a litigation?  what about programmatically purged data? Collection can be difficult  Limited bandwidth  Limited client functionality  Physical forensics could be overly intrusive on something like EC2 Native production 19

Discovery: Solutions Have terms in service agreement about e-discovery  e.g. accessing large amounts of data at once when bandwidth is usually limited 20