Data Law Trends & Developments - Crowell & Moring

cybersecurityCybersecurity’s escalating threats, intensifying oversight, and expanding publicity in recentyears exploded in 2013. It was a year bookended by President Obama’s cybersecurity warningsin his State of the Union message and the mega-breaches at Target and Neiman-Marcus. Andit gave us a cyber panorama – the Cybersecurity Executive Order; industry security reports ofmassive cyber looting of U.S. intellectual property and technology; the Iranian cyber attacks onU.S. banks; the Snowden breach of national security secrets; the proliferation of cybersecuritystandards governing everything from private- and public-sector contracts to cloud computing;and the intensified scrutiny of federal agencies (including the SEC, FTC, and HHS) on securityvulnerabilities and breaches.By: David Z. Bodenheimer & Evan D. WolffGoing forward, this kaleidoscope of cyber events foretellsreports (e.g., Mandiant’s report) point to a singleeven rougher weather for both the public and privateconclusion: foreign nations and competitors are stealingsectors. Corporate officers, government officials, andthe economic lifeblood of Fortune 500 companies,other organizations will have plenty of cybersecurityresulting in “the greatest transfer of wealth in humanconcerns ahead, with the following five overlapping andhistory” according to the NSA Director Keith Alexander.morphing areas deserving particular emphasis for thoseFor 2014, cyber attacks will not only continue to replicateseeking shelter from the cyber storms.prior economic damage (e.g., where single companiesMega BreachesLike the mega-breaches of the past (Heartland,deals), but will pack second and third punches.ChoicePoint, Sony, TRICARE, Epsilon, and more) exposingAfter elevating its scrutiny in 2011-13, the SEC ishundreds of millions of records containing sensitiveclamping down hard on publicly-traded companies failingpersonal information, the Target breach potentiallyto report deficient security programs and material datacompromising 110 million records foretold more thatbreaches. Shareholder suits will follow. And the largestfollowed. But the gauntlet in 2014 and beyond will befederal and state public sector agencies will stop doingmuch rougher, as mega-breach victims will face not onlybusiness with companies that cannot protect networks,lost customers and hammered stock prices, but also classtechnology, and secrets. Any business without robustactions, shareholder suits, regulatory investigations, andcybersecurity programs will face an impossible question:even Congressional scrutiny. In short, companies nothow could you not be ready for this threat?ready for cyber crisis management of epic proportions– including a strong incident response plan and databreach playbook – will confront one question many6have lost 1 billion in technology and 2.4 billion mergerCyberwar on Corporate TargetsIn a recent Defense News survey, major corporatetimes: were they not prepared?executives identified cyber attacks as a top concern.Pillaged Intellectual Propertyand Technology2012-13, U.S. banks had a foretaste of the future whenSince President Obama’s warning in 2009 that cybercases, posed fundamental network risks. Going forward,thieves had stolen over 1 trillion worldwide inattacks by rogue nations, terrorists, and hacktivists willintellectual property and technology, the news has onlyintensify, with those least ready taking the hardest hits.gotten worse. Numerous intelligence and industryBoth public and private officials will need to take muchDuring the cyber attacks attributed to the Iranians insuch assaults impaired electronic business and, in someData Law Trends and Developments: E-Discovery, Privacy, Cybersecurity & Information Governance

cybersecurityharder looks at their organization’s cyber resilience and backupplans. For such organizations, the hard question is simple: areyou ready to protect your fundamental operations with a soundforecastcontinuity of operations plan?In February 2014, the National Institute of StandardsProliferation of Security Standardsand Technology (NIST) released the long-awaitedCybersecurity Framework, which promises to haveLike an alphabet with unlimited letters, the standards governinginformation security are proliferating at a mad pace into asector-driven patchwork: HIPAA (healthcare), GLBA (financial),ISO (international), NERC/FERC (power grid), and NIST (federalagencies and contractors) to name a few. Because overarchingfederal legislation is highly unlikely in the near term, we will seethe promulgation of even more security standards, resultingin growing conflicts and compliance burdens for companiescrossing several industry sectors. Untangling this expandingand overlapping field of cybersecurity requirements cannotbe left to the IT department, but will require buy-in frommanagement, finance, and legal organizations. In the future,cyber compliance will hinge upon a simple question: arewe managing compliance from the top (an enterprise-wideapproach), rather than isolating our security efforts within the ITsignificant implications for the public and privatedepartment?from intrusions; (3) detecting anomalous activity; (4)Cyber Disputes Among Business PartnersSome of the recent mega-breaches have resulted from a weaklink in the supply chain, such as the TRICARE breach stemmingfrom a federal contractor failing to protect a laptop filled with afederal agency’s personal data for 4.9 million beneficiaries. Asa result of such losses, breaching companies have had currentbusiness cut off and future business sent elsewhere, while beingcalled to indemnify business partners from losses due to thesecurity breach. As a result, the litigation forecast for comingyears is hot: business partners will sue each other, federalregulators will take action against businesses, contractors willsue federal agencies, insured companies will pursue insurers,businesses and cloud service providers will fight, and more.In this volatile environment ripe for disputes, every businessmust zero in on the allocation of cyber risks. For those blindlyaccepting all of the risk, the questions are two-fold: will thecompany bearing the massive cyber loss survive; and will theperson signing off on that risk have a job tomorrow?sectors alike. It follows the 2013 Presidential ExecutiveOrder -- Improving Critical Infrastructure Cybersecurity-- which recognized cyber threats as “one of the mostserious national security challenges we must confront.”The Framework consists of a set of voluntary standardsand processes that private industry, particularly criticalinfrastructure, can use to address these cyber risks.The main structure of the standard is the “FrameworkCore,” which outlines the five primary functionsnecessary for cyber resilience, as well as the typesof actions each function may entail: (1) identifyingrisks and vulnerabilities and implementing policies toaddress those issues; (2) protecting data and networksresponding to incidents and recovering from intrusionsby restoring systems; and (5) incorporating lessonslearned. To guide companies seeking to implement theFramework, NIST also established an “ImplementationTiers” classification system that provides context onhow an organization views cybersecurity risks andthe associated processes to manage those risks. Alsoaccompanying the Framework Core is general guidanceinstructing companies to incorporate privacy protectionsinto cybersecurity programs.Although the Framework features considerable industryinput, many questions remain, including furtherdefining voluntary adoption and incentives for adoption,the impact on government contracting, and how thestandard may be used by third parties. Those questionswill likely continue to drive further development of theFramework.Data Law Trends and Developments: E-Discovery, Privacy, Cybersecurity & Information Governance7

social mediaSocial media has become ubiquitous in today’s society, with both individuals and businessesof all sizes embracing its use. Social media use implicates important information governanceconcerns, such as privacy, and has yielded a whole new area of electronic discovery, includingchallenges regarding preservation, production, admissibility, and even ethics. The applicablelaws and procedural rules have struggled to keep up with the growing use of social mediain legal proceedings. The legal landscape in this evolving area has been most prominentlyshaped in the contexts of the employer-employee relationship and discovery.By: Justin P. Murphy & David D. CrossSocial media presents unique legal risks for employers,Act because the policies’ limitations and controlsand the legal issues that arise are receiving increasingregarding use of personal social media accountsattention in litigation. For example, the Nationalwent too far. Companies need to be particularlyLabor Relations Board (NLRB) is hearing more andcareful when disciplining employees using personalmore cases involving employees’ social media use.social media accounts to complain or criticize theThese cases are helping to clarify the dividing linecompanies, especially where an employee previouslybetween what social media related conduct by anmade complaints or engaged in such discussionsemployee is protected and what is not, with thein the workplace. The NLRB general counsel haskey takeaway being that context matters greatly. Inissued three reports on social media cases, mostsome cases, companies’ social media policies haverecently in May 2012. And, in January 2014, NLRBbeen found to violate the National Labor RelationsChairman Mark Pearce confirmed in an interviewSEC Netflix Investigation ReportNetflix’s CEO announced on his personal Facebook account how many hours of content had been streamed bycustomers the prior month, which drove Netflix’s stock price up because the information had not yet been publiclydisclosed. The SEC clarified that social media posts by a company or its executives will be treated as any other electroniccorporate disclosure of material, non-public information and that companies are to advise the investing public about themethods of communication that they might use to make such disclosures, including corporate web sites, social media,blogs, or otherwise.Gatto v. United Air LinesThe court granted an adverse inference instruction as a sanction because the plaintiff failed to preserve a relevantFacebook account.Teagle v. MorganA former employee sued her former employer for locking her out of her LinkedIn account and illegally using itfor commercial gain after terminating her. The court found the employer liable for various torts in part becausethe company did not have a social media policy informing employees that their LinkedIn accounts were theemployer’s property.Bland v. RobertsThe Fourth Circuit held that “liking” a Facebook post is protected free speech where a deputy sheriff was firedby the incumbent sheriff running for re-election because the deputy “liked” a Facebook page of an opposing campaign.8Data Law Trends and Developments: E-Discovery, Privacy, Cybersecurity & Information Governance

social mediathat the Board would continue to focus on social media casesand would apply existing standards to new technologies andcommunication tools used by employees.Numerous states have adopted laws protecting privacy rightsattendant to personal social media use by employees. Inresponse to some well-publicized cases where employersrequired employees to grant the employers access to personalfacebooksocial media accounts, states have started passing laws1.15500access to login credentials for their employees’ personal socialgoogle linkedinmedia accounts. These include Arkansas, California, Colorado,500238poised to follow suit, and even Congress is considering ainstagrampinterestsimilar law. These laws generally proscribe any employer130protecting the social media privacy rights of employees. Atleast thirteen states have passed laws restricting employers’Illinois, Maryland, Michigan, Nevada, New Jersey, New Mexico,Oregon, Utah, Vermont and Washington. Other states appearmandate requiring an employee or applicant to disclose hisor her personal social media login credentials, to grant theBillion Million Million twitterMillion Million 70Million employer access to the employee’s account, or to add theemployer as a friend or contact on a social media platform.On the flipside, businesses are facing new legal hurdles withtheir own social media accounts, which are created, operated,and managed by employees. These accounts and the conductof employees with access to them present a whole newSource: As posted by www.digitalbuzzblog.com from datasourced from www.facebook.com, www.expandedramblings.com,www.mediabistro.com and www.socialmediaexaminer.com.area of liability for companies turning to social media formarketing and other business purposes. Companies mayis subject to the same disclosure requirements as otherbe held responsible for content posted by their employees.ESI. Companies, however, do not always immediately thinkUnfortunately, employees sometimes approach social media,about their social media accounts when considering whatespecially applications such as Twitter , with the same levelinformation may be relevant to an anticipated or pendingof informality and candor with which they approach emailslitigation or investigation. But these accounts can containamong friends or colleagues. Yet, social media, even ifrelevant information that must be preserved and produced.restricted to “friends” or “followers,” is not private in the wayIndeed, courts have sanctioned parties for failing to preserveemails can be, which presents exposure for businesses thatpotentially relevant social media content.employees do not always appreciate.When facing disclosure requests for social media content,Mandatory disclosures in litigation and governmentparticularly for employees’ individual social media accounts,investigations present further challenges and risks forcompanies need to be cognizant of attendant privacy rightscompanies using social media. Social media content generallyand object as appropriate. Fortunately, courts increasinglyData Law Trends and Developments: E-Discovery, Privacy, Cybersecurity & Information Governance9

social mediabusiness or what the limits of any such rights are and whatuse of social media among adults67disclosure requirements they may face. Social media policiesalso should provide specific guidelines, within the bounds of71% of adult online users active onsocial media websites, by yeargoverning law, for how, and by whom, social media accountsmay be used for business purposes and what content isappropriate.2022152116181317forecastSocial media use will continue its meteoric rise,perhaps eventually surpassing email as 13Source: Pew Research Center’s Internet Project Tracking Surveys(www.pewinternet.org) , 2012-2013. 2013 data collected August07 - September 16, 2013.preferred means of communication. Companies willincreasingly use social media and authorize its useby employees for company-related business, suchas marketing, public relations, and other purposes.Historically, the Super Bowl provided one of themost significant U.S. marketing opportunities of theyear. Yet, in recent years, despite paying millionsexhibit appropriate sensitivity to these concerns andof dollars for short spots during the big game,companies increasingly release their Super Bowl permit in-camera inspection of social media content toads through social media sites in the days leading updetermine whether it must be produced. Some courts haveto the game. Controversial ads often spark a flurryeven required parties in civil litigation to make a thresholdof comments through social media applications,evidentiary showing that non-public social media contentincluding on company Facebook and Twitter contains relevant information. Some federal district courts,accounts. This trend in social media use will fuel thehowever, have rejected this approach as inconsistent withparallel trend of evolving information governancethe federal rules, reasoning that it would improperly shieldconcerns and discovery challenges, as content growsrelevant information from discovery that is not otherwiseand becomes increasingly relevant in litigation andobtainable. Ultimately, if deemed relevant, courts seemgovernment investigations.increasingly likely to order social media content disclosed,overruling privacy-related objections as a bar to disclosure.Additionally, U.S. government agencies such as theSecurities and Exchange Comission (SEC) and theNLRB as well as courts evaluating discovery andCompanies are well served adopting policies governing socialpreservation issues will continue to provide guidancemedia use by employees. These policies should clearly identifyabout how existing rules and standards apply tothe respective rights employers and employees have regardingsocial media. As a result, more and more businessesindividual and corporate social media accounts. In particular,should adopt sound social media policies to betterthese policies should alert employees either that they have noprotect themselves and their employees.privacy rights as to social media accounts used for company10Data Law Trends and Developments: E-Discovery, Privacy, Cybersecurity & Information Governance

Technology-assisted reviewTechnology assisted review (TAR) platforms, particularly those technologies commonlyreferred to as “predictive coding,” have been around for a number of years. Technologyproviders, along with early adopters, have promoted the potential for TAR to achievesignificant efficiencies, cost savings and improved results over alternative review optionsincluding keyword searching and manual review. Although there has been some concernabout whether courts would accept TAR, and what costs and burdens would be required todefend its use, the benefits of TAR so dramatically outweigh those concerns that TAR now is,or should be, the mainstream approach for document review across a wide range of differenttypes of matters.By: Jeane A. Thomas & Elizabeth A. FigueiraIn simplest terms, TAR involves the use of computerCollection. Some TAR methods use Machinesoftware to categorize documents consistent withLearning Algorithms to distinguish Relevant fromhuman judgments. A more formal definition of TARNon-Relevant Documents, based on Trainingfrom the Grossman-Cormack Glossary is:Examples Coded as Relevant or Non-Relevantby the Subject Matter Experts(s), while other“A process for Prioritizing or Coding a CollectionTAR methods derive systematic Rules thatof Documents using a computerized systememulate the expert(s)’ decision-making process.that harnesses human judgments of one orTAR processes generally incorporate Statisticalmore Subject Matter Expert(s) on a smallerModels and/or Sampling techniques to guideset of documents and then extrapolatesthe process and to measure overall systemthose judgments to the remaining Documenteffectiveness.”Da Silva Moore v. Publicis GroupeMagistrate Judge Andrew Peck in the Southern District of New York provided the first public judicialendorsement of predictive coding in a highly publicized opinion. After his initial opinion, the expe

when it is no longer needed. One recent estimate involves an organization that reduced its volume of ESI by 40 percent through more effective RIM policies, which in turn resulted in hard cost savings from processing, hosting and producing data in litigation by more than 40 per gigabyte - even before