Monthly Archives: September 2018

Reminder on the GDPR

Since May 25, the General Data Protection Regulation (GDPR) has come into force. It concerns all public or private organizations which are required to process personal data of residents of the European Union.

De facto, your law firm is subject to this new regulation and you must to comply if it's not already the case.

Chain of responsibility

Among your obligations linked to the GDPR, you must in particular carry out a map of your data processing, carry out an audit of your internal systems and ensure that your subcontractors are in compliance with the European Regulation. The latter, also affected by the GDPR, are subject to the same obligations and must carry out the same checks internally as with their subcontractors.

That's what we call the chain of responsibility: each organization subject to the Regulation ensures the compliance of its subcontractor who itself ensures that of its subcontractor and so on.

Data controller and/or Subcontractor?

Your obligations differ if you are a Data Controller or a Data Processor.

According to the GDPR, you are Responsible for treatment (ie Data Controller) when you collect personal data directly or indirectly for a given purpose. In this case, you are required to inform the person of the precise purpose of this collection, of their applicable rights and you must limit this collection to a minimum of data.

On the contrary, you are Subcontracting (ie Data Processor) if you only process data on behalf of and under the authority of the Data Controller. In this case, you must implement technical and organizational measures guaranteeing the security and confidentiality of the data processed on behalf and under the authority of this Data Controller.

In practice, the majority of organizations carry out processing both as a Data Controller (ie for their own account such as processing related to HR or customer management) and as a Subcontractor on behalf of of their customers.

Liability and risks incurred for the Lawyer

Within the GDPR framework, you must take all necessary technical and organizational measures to guarantee the integrity, security and confidentiality of the data that you collect or process.

So, if you store the data you collect yourself (on your computer, USB stick, external hard drive, local server, etc.) you are considered both a Data Controller and a Data Processor. In this case, you must guarantee the security and confidentiality of your data yourself by setting up, for example, backup, redundancy and encryption of your data, securing access to your computer terminals, etc.

In the event of non-compliance with the GDPR, you risk a fine of up to 20 million euros or 4% of your global turnover (see. Article 83 of the GDPR).

Hosted software vs. installed locally

If you are equipped with a locally installed practice management software (ie on your computer or your local server) you are therefore 100% responsible managing the security and confidentiality of your data.

Securing your data can be a long, complex and expensive process but above all very far from your area of ​​expertise. Many lawyers who use locally installed software have suffered data loss following theft, hacking, voluntary (malicious) or involuntary (water damage, fire) deterioration or obsolescence of their computer equipment.

On the contrary, if you are equipped with 100% hosted software (ie in the Cloud), like Jarvis, you delegate this role of Data Processor and no longer have to worry about directly managing the security and confidentiality of your data. In fact, it is your subcontractor who will assume this role for you but always under your authority.

Other Benefits of Hosted Software

Working with hosted software brings you many other advantages and all at a lower cost. First of all, it gives you access to professional level equipment and cutting-edge technologies. At Jarvis, your data is stored in data centers equipped with high-performance storage bays meeting the Very High Availability (THD) standard and operating on equipment and technologies developed by the biggest players on the market: Hewlett-Packard, Cisco, CheckPoint, VMWare.

Second, it gives you access to a near-military level of security. Your data is hosted in data centers (NB: at OVH in France if you are a Jarvis user) which are equipped with inverters and generators, video surveillance and movement detection systems as well as monitoring personnel. security. Their access is strictly controlled and limited to authorized personnel equipped with RFID badges and/or identified by biometric recognition.

In addition, your data is automatically backed up several times a day and replicated in geographically distant data centers (NB: the OVH data centers in Roubaix, Strasbourg and Gravelines if you are a Jarvis user). Your data is similarly encrypted using a bank-grade encryption protocol with a 4096-bit encryption key.

Finally, hosted software gives you the mobility that is so important today in the legal profession. At the office, at your home, at your client's, at the Court, in the street or in a taxi, you have access to all your firm's data from any terminal and at any time.

Data hosting and Privacy Shield

Although hosted software brings many advantages, it remains your responsibility to check the country in which your data is processed. According to the Regulation, your data must be processed in a so-called adequate country, that is to say a member of the EU or the EEA or any other country benefiting from a data protection mechanism deemed equivalent to the GDPR by the EU. At Jarvis, we have always hosted your data at OVH in France or in your country of practice when possible.

Be careful withux hosted software that processes your data in the USA within the framework of the EU-US Privacy Shield. This agreement, which replaced the Safe Harbour, was recently deemed still insufficient by the computer freedom control authorities of the member states (including the CNIL and grouped within the Article 29 or G29 Working Group). Indeed, under the pressure of this G29, on June 14, the European Parliament requested the removal of the Privacy Shield if the American government does not provide more guarantees on the protection of data transferred to the US by September 1, 2018.

Peace of mind

Hosted software like Jarvis provides you with all the guarantees in terms of security and confidentiality of your data in compliance with the GDPR. Plus, they give you access to the ultimate in equipment, security and mobility. You can concentrate on managing your files and interacting with your clients with peace of mind. Jarvis takes care of the rest.