GRC Journal - (Page 17) Governance, Risk & Compliance be aware of in order to protect their information and maintain legal requirements? Not long ago, I co-authored a book called, “Information Nation Warrior,” that advanced the idea that proper information management requires the collaborative and concerted effort of four separate groups – IT, legal, records management, and business professionals. I don’t believe that you can properly manage information without considering the various issues, complexities, and sometimes competing issues around the legal, information management, business, and IT challenges. For example, how would the organization deal with the employee’s desire to use instant messaging at work? From a business standpoint IM may have real value and utility – increasing productivity and communication among employees, partners, and customers. But from a records management perspective, IM traffic may be considered to have record value – but do the employees know it must be retained or does the technology allow its proper retention? The lawyer may worry about whether the IM content has contractual or legal significance, or whether its capture and storage without notifying the parties to the communication violate the law. My point is simple. The four perspectives – IT, legal, records management, and business – are essential to address and ultimately manage this new e-information. Otherwise, the information is likely mismanaged. While statutes and regulations remain at the forefront of legal restrictions, case law maintains an underlying presence in regard to information management. How does case law differ from statutory law and what should IT professionals be aware of when incorporating an information management platform? At Kahn Consulting, we look to regulations, laws, and also case laws to guide our clients. With case law, a particular opinion may not bind your company, as it may be a case from a particular jurisdiction or particular state or court within a state, but such rulings can help us glean insight into where other courts may go with the similar fact patterns or legal issues. In that sense, the case law is “a legal best practice,” providing guidance, though not necessarily legal precedent. For example, in a case that became very popular in New York, a judge issued a ruling that indicated companies should have a legal hold policy for its employees from the law department when information was needed for a lawsuit. That opinion went on to say that telling employees to preserve information was not enough, but that the law department should follow up to ensure that the employees got the notice, understood the notice, were following the directives and, most importantly, making sure the information was being preserved. While this court case may not bind an individual or corporation outside of New York, it was useful. Based on the court opinion, we may change our guidance to our clients. Again, laws always have to be followed; case law may or may not apply, but it’s definitely useful to look at to understand what the courts are saying on the issues of the day and how your conduct may be viewed in a court. A couple years ago, California passed a law – Senate Bill 1386 – stating that if you have personal identifiable information in a computer that is not encrypted, and it gets exposed, you may have an affirmative duty to notify all those who may be impacted by the disclosure. The law makes clear that no matter where you’re located, if you’re doing business with California residents or have California residents’ personal identifiable information, the law applies to you – even if you’re not physically located in California. There are other laws that clearly state that they regulate a particular industry under a particular jurisdiction. And it’s essential today for IT departments and IT professionals to understand that their world is increasingly regulated, and they need to work in close collaboration with the company lawyers to ensure that what they do, the system they buy, and the policies they have in place satisfy current, and even future legal Randolph A. Kahn, ESQ., founder of Kahn Consulting, Inc., is an educator and author of dozens of published works, and was the recipient of the Britt Literary Award in 2004 and 2005. He is an internationally recognized authority on the legal, compliance, and policy issues of information technology and information, and trusted advisor and consultant to Fortune 500 companies, governmental agencies, and court systems. Q1 2007 | www.btquarterly.com BTQ Business Trends Quarterly 51 http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.