The most widely read magazine for Canadian lawyers
Issue link: https://digital.canadianlawyermag.com/i/50842
says, noting the process takes about four hours to wipe 100 drives. Indeed, it's the data that is of value these days, not the machinery itself, which has become disposable. While practitioners may face the double threat of rebuke from the law society — for violating solicitor-client confidentiality — and from provincial or federal priva- cy commissioners, the real damage will be to their reputation, says David T.S. Fraser, a Halifax-based lawyer special- izing in privacy issues at McInnes Coo- per. "Doctors may not make house calls these days, but lawyers are much more mobile," says Fraser, noting medical files are probably the closest parallel. "Unfor- tunately, technology also increases the risk, because people can leave thumb drives [small USB storage devices] lying around and people walk out of offices with laptops." Awareness of the issue is also key, he says, noting paper files or bankers' boxes are rarely targeted for theft. But laptops are easy marks in coffee shops, airports, and busy court hallways. "Lawyers know because of client con- fidentiality they shouldn't discuss a file with a friend or neighbour, or that we don't throw files out on the street and leave then lying around," says David R. Canton, lawyer, trademark agent, and blogger (www.canton.elegal. ca) at Harrison Pensa LLP who specializes in technology issues and privacy. "But as we migrate files from paper to electronic — in any number of platforms — sometimes we may forget about the old rules. Not just lawyers, but everyone." The virtual, intangible nature of electronic files — in e-mails, on Black- Berrys, or in documents on laptops — doesn't remove any of the responsibility, however. And as Canton points out, lawyers aren't alone; data loss is a massive head- ache for the private and public sector globally. A mobile workforce means more workers equipped with the neces- sary tools: laptops, smart phones, PDAs, and USB memory sticks. While Canadians don't face all the burdens of disclosure faced by their counterparts in the U.S. (that is, there is no requirement outside of certain pieces of industry-specific legislation, such as Ontario's Health Information Protec- tion Act, to report to a public agency in the event of a data loss), there are still prudent steps to take, says Fraser. "There isn't a legal obligation but there may be a common law obligation if the release of information could cause harm to the person. So you should notify that person of the harm," says Fraser, who also blogs on privacy issues at www.privacylawyer. ca/blog. While neither Canton nor Fraser has heard of any cases or pending litiga- tion related to lawyers losing files, they note that suing for loss or exposure of personal information is more problem- atic in Canada than in the U.S. Here in Canada, the plaintiff has to show harm or direct financial loss. While the damage to a law firm's repu- tation is a high price within the profes- sion, mitigating liability through direct and timely disclosure to those involved is a must, they add. An ounce of prevention, however, still holds, says Richard Giroux, IT manager at Whitelaw Twining Law Corp. in Vancouver. Best practice in technology means ensuring everyone whether they are at their desks or work- ing from clients' offices or their homes — they must log in using a Citrix sytem, a sophisticated, industry-standard secu- rity platform that has high-level pass- word protection. In addition, he says, all the USB ports on computers have been disabled, mean- ing no files can be surreptitiously copied and any CDs brought into the firm must first be cleared through IT to ensure they are virus free, since the only thing worse than losing a file by theft or negligence is to have it wiped out by malware. "Black- Berrys are a huge risk," he says, "But if we lose one — and we had someone leave theirs in a cab — I can use the remote- access feature from the servers here to remotely access it, freeze it, and then have it wipe itself clean the next time someone turns it on." Indeed, while technology is root of the risk, it also offers myriad solutions, from the capacity to remotely wipe laptops and BlackBerrys clean to fingerprint scanners that allow only the registered user of that laptop to access it. Manufacturers, too, have stepped up when you drill it in front of the client." — JOSEPH BOZIC, DATAXILE CORP. has done their part to ensure security of data at all levels. While the "human element" will al- ways be the weakest link, heads-up thinking from the outset can prevent a lot of problems. "The challenge is that everyone wants access to all the data but no one wants anyone else to have that access," he laughs. "Luckily, computers can do that, so my approach is that you can't lose it if you can't take it with you." He's rigged the firm's system so that all files stay on the servers inside the build- ing. When lawyers want to access files — "There's a peace of mind to protect data. Big three makers Lenovo, Dell, and Hewlett-Packard, for example, all offer business laptops with fingerprint scanners as a standard feature, along with encrypted hard drives that are keyed to the machine. The data on the hard drive can only be accessed if the user logs on with the appropriate fingerprint and password, and it will remain encrypted even if removed from the laptop and installed on an- other machine. In addition, third-party sup- pliers like LoJack, made by Vancouver- based Absolute Software Corp., sell a tracking system that can locate a stolen laptop via IP address when it's logged onto the Internet, Still, despite the best planning, some- times things go wrong. "This whole thing was a positive, though," says CBA's Hoyles. "No one's credit cards seem to have been tampered with and we learned that regular security checks are a good thing. Still, it taught us that even if you are as close to perfect as possible things can happen." www. C ANADIAN mag.com APRIL 2008 33