Reminder on the GDPR
Since May 25, the General Data Protection Regulation (GDPR) has come into force. It concerns all public or private organizations which are required to process personal data of residents of the European Union.
In fact, your law firm is subject to this new regulation and you need to comply if you are not already in compliance.
Chain of responsibility
Among your obligations linked to the GDPR, you must in particular carry out a map of your data processing, carry out an audit of your internal systems and ensure that your subcontractors are in compliance with the European Regulation. The latter, also affected by the GDPR, are subject to the same obligations and must carry out the same checks internally as with their subcontractors.
This is what is called the chain of responsibility: each organization subject to the Regulation ensures the compliance of its subcontractor, who in turn ensures that of its subcontractor, and so on.
Data controller and/or Subcontractor?
Your obligations differ if you are a Data Controller or a Data Processor.
Under the GDPR, you are the Data Controller when you collect personal data directly or indirectly for a specific purpose. In this case, you are required to inform the individual about the precise purpose of this data collection, their applicable rights, and you must limit the data collected to a minimum.
Conversely, you are a Data Processor if you only process data on behalf of and under the authority of the Data Controller. In this case, you must implement technical and organizational measures to ensure the security and confidentiality of the data processed on behalf of and under the authority of that Data Controller.
In practice, the majority of organizations carry out processing both as a Data Controller (ie for their own account such as processing related to HR or customer management) and as a Subcontractor on behalf of of their customers.
Liability and risks incurred for the Lawyer
Under the GDPR, you must take all necessary technical and organizational measures to ensure the integrity, security and confidentiality of the data you collect or process.
So, if you store the data you collect yourself (on your computer, USB stick, external hard drive, local server, etc.) you are considered both a Data Controller and a Data Processor. In this case, you must guarantee the security and confidentiality of your data yourself by setting up, for example, backup, redundancy and encryption of your data, securing access to your computer terminals, etc.
Failure to comply with the GDPR may result in a fine of up to 20 million euros or 4% of your global turnover (see Article 83 of the GDPR ).
Hosted software vs. installed locally
If you are equipped with practice management software installed locally (i.e. on your computer or local server), you are therefore 100% responsible for managing the security and confidentiality of your data.
Securing your data can be a long, complex and expensive process but above all very far from your area of expertise. Many lawyers who use locally installed software have suffered data loss following theft, hacking, voluntary (malicious) or involuntary (water damage, fire) deterioration or obsolescence of their computer equipment.
Conversely, if you use 100% cloud-based software, such as Jarvis, you delegate this Data Processor role and no longer have to worry about the direct management of your data's security and confidentiality. Indeed, your data processor will assume this role for you, but always under your authority.
Other Benefits of Hosted Software
Working with hosted software brings you many other advantages and all at a lower cost. First of all, it gives you access to professional level equipment and cutting-edge technologies. At Jarvis, your data is stored in data centers equipped with high-performance storage bays meeting the Very High Availability (THD) standard and operating on equipment and technologies developed by the biggest players on the market: Hewlett-Packard, Cisco, CheckPoint, VMWare.
Second, it gives you access to a near-military level of security. Your data is hosted in data centers (NB: at OVH in France if you are a Jarvis user) which are equipped with inverters and generators, video surveillance and movement detection systems as well as monitoring personnel. security. Their access is strictly controlled and limited to authorized personnel equipped with RFID badges and/or identified by biometric recognition.
In addition, your data is automatically backed up several times a day and replicated in geographically distant data centers (NB: the OVH data centers in Roubaix, Strasbourg and Gravelines if you are a Jarvis user). Your data is similarly encrypted using a bank-grade encryption protocol with a 4096-bit encryption key.
Finally, hosted software provides the mobility so crucial in today's legal profession. Whether at the office, at home, at your client's office, in court, on the street, or in a taxi, you have access to all your firm's data from any device, at any time.
Data hosting and Privacy Shield
Although hosted software brings many advantages, it remains your responsibility to check the country in which your data is processed. According to the Regulation, your data must be processed in a so-called adequate country, that is to say a member of the EU or the EEA or any other country benefiting from a data protection mechanism deemed equivalent to the GDPR by the EU. At Jarvis, we have always hosted your data at OVH in France or in your country of practice when possible.
Be wary of software hosted in the USA that processes your data under the EU-US Privacy Shield. This agreement, which replaced Safe Harbor, was recently deemed insufficient by the data protection authorities of the member states (including the CNIL, the French data protection authority, and members of the Article 29 Working Party, or G29). Indeed, under pressure from the G29, the European Parliament called on June 14th for the removal of the Privacy Shield if the US government does not provide stronger guarantees regarding the protection of data transferred to the US by September 1, 2018.
Peace of mind
Hosted software like Jarvis provides you with complete guarantees regarding the security and confidentiality of your data, in compliance with the GDPR. Furthermore, it gives you access to cutting-edge equipment, security, and mobility. You can focus on managing your files and communicating with your clients with complete peace of mind. Jarvis takes care of the rest.