Remote controls

‘How does an organisation maintain resilience when everything it designed and built was for a different way of working?’ asks DWF’s global head of data protection, privacy and cybersecurity, Stewart Room. As the world battles a pandemic, organisations around the globe are turning homes into offices and personal devices into office tools. The sudden change in the way businesses operate brings with it added cyber and information security risks, particularly via emails to spread malware, as workers in many organisations access confidential business data remotely.

As a result in-house legal teams are revisiting home working policies and keeping their private practice advisers busy. ‘I’m certainly being asked to give a lot more advice on homeworking policies,’ comments Bristows partner Robert Bond. ‘But the challenge is to strike a fair balance between the needs of the business versus the expectation of privacy in the home environment.’

Bad actors

Data breaches due to employee error, such as following auto prompts on emails or the failure to manage paper records properly are considered low-level breaches and will inevitably increase as many continue to work from home. The interception of confidential business information through phishing attacks is also a common threat. Another threat on the rise is so-called spear-phishing, targeted at executives and specific individuals within organisations that may occur in the form of a link in an email that installs malicious software used to steal data.

Industrial cyber espionage on a global scale is also a major risk for business. ‘It’s often nation state-sponsored organisations seeking business- confidential information in a form of cyber espionage, as opposed to the bad actors who are making mischief and socially engineering or downloading malware,’ says Bond.

‘In the last 12 months we’ve seen targeted, sophisticated intelligence-gathering ransomware attacks where the attackers have scoped out the organisation and have been inside the network for weeks or months,’ says DAC Beachcroft partner and cyber and data risk team lead Hans Allnutt. ‘They want to understand how to cripple the organisation and then demand high-level ransoms that are sometimes paid.’

The recent changes to working environments have further challenged in-house teams, who are finding it difficult to respond to the sheer number of low-level and advanced cyber attacks that have become common in the last five years, adds Allnutt. Organisations are therefore looking to increase employee monitoring and scanning tools that, although requiring some level of intrusive monitoring, are needed to preserve the confidentiality of data. However, the shift to remote working means in-house teams risk losing control of records management and will likely not have a centralised view of personal data or information as it is now on various devices and locations, notes Bond.

Organisations can mitigate risk with a combination of IT security, scanning networks, encrypting traffic but also by focusing on the human aspect and training employees on how to store and share data. The National Cyber Security Centre has advised that there should be more stringent homeworking policies during the coronavirus lockdown, with more focus on managing multiple devices and the risks around using removable media.

Another pressure point is the difficulty that often falls on in-house counsel to report data breaches to regulators within 72 hours of discovery, unless it is a negligible risk. This is beyond the obvious duty to report cases of high risk, with the cyber attack on British Airways a recent example and the Information Commissioner’s Office (ICO) beginning to take enforcement action on those that do not fulfil this duty. In July 2019 the ICO said it intended to fine the airline £183m for data breaches after hackers stole customer records and similarly the Marriott hotel group is facing a fine of £99.2m, although fines in both cases have been delayed until later this year. The main issue for in-house counsel is the need for clear guidance and protocols for when to report a breach and who to report it to.

Furthermore, the EU’s General Data Protection Regulation (GDPR) and similar style legislation have proliferated across the globe and are keeping in-house teams on their toes, including the California Consumer Privacy Act in the US and the yet-to-be implemented Brazilian general data protection law, the Lei Geral de Proteção de Dados Pessoais (LGPD). Large corporate groups are faced with the challenge of grasping the intricacies of diverse regulations that, if misunderstood, can carry severe financial penalties. Dentons global privacy and cybersecurity group co-chair Nick Graham reflects: ‘The key issue is the percolating of data privacy law across increasing numbers of jurisdictions with rules that say similar but subtly different things. The challenge then is how to comply and how to set the risk radar to identify jurisdictions likely to trigger higher enforcement risk. But it’s not just about enforcement risk; it is also about market practice in assessing risk levels.’

GDPR post-Brexit

According to a statement from Prime Minister Boris Johnson in February, the UK intends to seek ‘adequacy status’ from the European Commission by the end of the year – establishing the UK as an adequate jurisdiction for data protection, equal to the EU, enabling the continued sharing of personal data. ‘We want to be able to demonstrate that we are an adequate jurisdiction for processing data so that at the end of the transition period, the hope is that we will swiftly be given adequacy status so that it will be easy for personal data sharing to continue,’ says Graham.

If the UK does not receive adequacy status, then there is a possibility that it will be difficult for UK businesses to obtain personal data from the EU, which may trigger other mechanisms enabling organisations to access data, such as EU-style standard contractual clauses for data sharing. However, in practice, nothing about the UK’s data protection regime is expected to change immediately after the EU transition period.

Recent changes to how governments operate in the immediacy of Covid-19 lockdowns and emergency measures are viewed as aiding the UK’s quest for adequacy status. ‘The UK’s prospects for getting an adequacy decision have been increased, not lessened, by Covid-19,’ argues Room. ‘Every country in Europe is defaulting to a mass surveillance programme to enable the fight against the coronavirus. Everyone is turning into Big Brother and that gives less opportunity to criticise the UK.’ It is therefore likely that as a result of the pandemic, data protection breaches will be brought to courts around the world over the next few years.

The National Cyber Security Strategy 2016-2021 outlined the UK government’s intention to invest £1.9bn into the sector to protect businesses, leading to the establishment of the National Cyber Security Centre in 2016 and programmes such as Active Cyber Defence. According to a new report from the Department for Digital, Culture, Media and Sport released at the start of 2020, the cybersecurity sector has grown significantly in the past few years with over 1,200 cybersecurity businesses established since 2017. Overall, the sector is worth £8.3bn in total revenue, up by 46% from £5.7bn in 2017.

London is seen as an attractive place for cybersecurity outfits to set up and government initiatives, such as the Cyber Academic Start-Up Programme, HutZero and Cyber101 have encouraged this but the sector is struggling to attract the right talent, particularly on the GDPR side, where the pool of experts is limited. Typically, organisations have a cybersecurity technician and a GDPR expert – sometimes a lawyer – sitting separately, but finding individuals with experience in both is proving difficult. ‘It’s a challenge to find the right data protection/data security expert and one of the key questions is the extent to which you look for people who can advise on GDPR but also have cybersecurity technical skills,’ notes Graham.

In-house counsel are faced with new challenges around how to respond to cybersecurity and data protection issues in a year sure to be utterly dominated by the Covid-19 outbreak. The use and management of workforce and customer data is a key issue as good management practice and training will likely lower the risk of cyber attacks and data breaches. However, some organisations are currently relying entirely on technology and policies will need to be reconsidered to ensure the safe security of data and software as well as the devices from which they are accessed. It is clear that more reliance on remote IT support will complicate the ability of organisations and GCs to protect themselves just as their grasp on information has never been put under more strain. No pressure then.