1. Legal Issues Contracts & Electronic Discovery Source: CSA Security Guidance Report v.3 Presented by: Toby Tobkin – toby.tobkin@gmail.com 1

2. Motivation why i chose this topic 2

3. Privacy Law 3

4. Data Privacy Data on the Internet is vulnerable  I won’t show a proof for this 4

5. Data Privacy Data on the Internet is vulnerable  I won’t show a proof for this Burden of protection of personal data is on organizations in some regions 5

6. Data Privacy Data on the Internet is vulnerable  I won’t show a proof for this Burden of protection of personal data is on organizations in some regions Some regional organizations that mandate this:  OECD: Organization for Economic Cooperation and Development  APEC: Asia Pacific Economic Cooperation  EEA: European Economic Arena 6

7. Examples of US Privacy Laws Federal  Laws: GLBA, HIPAA, COPPA  FTC orders 7

8. Examples of US Privacy Laws Federal  Laws: GLBA, HIPAA, COPPA  FTC orders State  Generally: reasonable security measures must be in place  including with subcontractors 8

9. Privacy by Contract If some aspect of privacy isn’t regulated, it could still be specified by a contract  but you knew that Company using cloud service may  Have a contractual obligation to protect employee data it’s storing  Want to protect their trade secrets stored in the cloud  Have a privacy contract with their customers  Specify that data can only be used for certain purposes 9

10. Contracts 10

11. Concepts Data custodian 11

12. Concepts Data custodian Due diligence 12

13. Cloud E- Discovery Issues 13

14. Discovery Phase In litigation, this comes prior to the trial Philosophy: neither party should be able to keep secrets from each other 14

15. Discovery: Problems Data that may be demanded might not be under a party’s control  Might be on a third party’s backup system  Or something Problem: whose obligation is it to produce requested information? According to this document: it depends 15

16. Discovery: Problems Standard e-discovery tools may not work 16

17. Discovery: Problems Standard e-discovery tools may not work Rules on preservation don’t seem to be clear  who pays for storage? client? service provider?  what constitutes “relevant” information to a litigation?  what about programmatically purged data? 17

18. Discovery: Problems Standard e-discovery tools may not work Rules on preservation don’t seem to be clear  who pays for storage? client? service provider?  what constitutes “relevant” information to a litigation?  what about programmatically purged data? Collection can be difficult  Limited bandwidth  Limited client functionality  Physical forensics could be overly intrusive on something like EC2 18

19. Discovery: Problems Standard e-discovery tools may not work Rules on preservation don’t seem to be clear  who pays for storage? client? service provider?  what constitutes “relevant” information to a litigation?  what about programmatically purged data? Collection can be difficult  Limited bandwidth  Limited client functionality  Physical forensics could be overly intrusive on something like EC2 Native production 19

20. Discovery: Solutions Have terms in service agreement about e-discovery  e.g. accessing large amounts of data at once when bandwidth is usually limited 20