Risk Update

Risk Reading — Lawyer Departure Ethics Opinion Issued, IG Thinking on AI Risk Management, Firm Hit With Class Action Over Data Breach

Posted Dan Bressler

Leigh Isaacs, Sr Director Info Governance at DLA Piper US, sends word of this report produced by the Law Firm Information Governance Symposium (LFIGS), which she authored with several colleagues: “Generative AI and Law Firm Information Governance” —

  • “This paper covers the use of artificial intelligence (AI), and in particular, Generative AI in law firms. Whereas AI usage is similar across industries, law firms have some unique characteristics because much of the data belongs to the clients and there is an extra obligation to keep it safe and private. This paper covers both unique and non-unique challenges of AI as it pertains to information governance (IG) in the legal community. It begins with a brief definition of AI, followed by benefits to the legal community, information governance-specific considerations, policy considerations, general advice, and guidance.”
  • “Another important consideration is balancing privacy rules and regulations with system capabilities. Currently, there is no way to remove data from the system. This has led to concerns about ethical issues, IP usage, bias, and consent. As a result, many firms are taking a conservative approach to using generative AI technologies. Some firms have banned the use of their data, while others have not yet adopted the technology. As the technology evolves, so too will the restrictions and usage guidelines around it… A good  resource that offers insight into the early views on regulation between the EU and the US can be found HERE. In fact, using proprietary data is best done through APIs, as described in section 5.”
  • Clients are starting to issue requirements around AI usage guidelines and/or restrictions where their data is involved. Audit and assessment questions will quickly start to include AI usage queries, as will cyber insurance renewal applications.”

“Orrick Hit With Class Action Over Breach Affecting 153,000” —

  • “Orrick, Herrington & Sutcliffe LLP failed to protect the personal information of nearly 153,000 people that was exposed in a March data breach, a proposed federal class action said.”
  • “Dennis Werley alleged that the international law firm failed to implement reasonable measures to ensure their computer systems were protected, take adequate steps to prevent and stop the breach, or provide timely notice to victims.”
  • “Information exposed in the incident included names, addresses, dates of birth, and Social Security numbers, according to a complaint filed Aug. 11 in the US District Court for the Northern District of California.”
  • “Orrick declined to comment.”
  • “Werley and class members have suffered damages in the form of an increase in spam telephone calls, an increased risk of fraud and identity theft, invasion of privacy, reduced value of personal information, and lost time and out-of-pocket costs incurred mitigating the effects of the breach, the complaint said.”
  • “The lawsuit brings claims of negligence, negligence per se, breach of fiduciary duties, breach of confidence, breach of implied contract, invasion of privacy, and declaratory relief.”

Brian Faughnan notes and opines on: “Breaking? BPR Issues Two Formal Ethics Opinions” —

  • “The opinion now confirms certain core concepts in Tennessee as to departing lawyers and what the rules of the road are, including:
    • “That a joint notice to the client is preferred and that the departing lawyer and the firm should “attempt to agree” on a joint communication to the clients ‘with whom the departing lawyer has had significant contact.'”
    • “That firms ought to develop policies in advance so that lawyers can know what measures the firm will expect to implement address such situations, including issues of what kind of notice period prior to departure a firm will expect of its lawyers.”
    • “While firms can impose notice period requirements, they cannot then kneecap the departing lawyer’s ability to continue to represent clients during that time period by cutting them off from access to files or access to technology.”
  • “In other words, this opinion attempts to establish rules of the road that have as their primary purpose ensuring that clients both have full choice of counsel and are not harmed or burdened by lawyer against lawyer disputes.”
  • “Nevertheless, situations where lawyers depart firms for other private practice arrangements will likely always remain plagued by economic pressures and cutthroat instincts. Lawyers or firms that want to push the envelope may find some solace in certain parts of the opinion whether that be arguing over what ‘significant contact’means or playing coy about what constitutes attempting to agree, but this opinion offers much needed guidance.”
  • “As a lawyer who represents lawyers making moves as well as firms dealing with departing lawyers, the existence of this opinion will be very helpful in counseling lawyers.”