A relational approach aids understanding

Eight years ago, when I was a practising lawyer, the issues around data protection and discovery were less dramatic than they are today.

There were certainly issues of confidentiality, but email, for example, was in its infancy so they were less problematic. You can now see the difficulties these issues are causing, at an operational level and more importantly at a strategic level.

Does IT understand the role of legal teams? Does legal understand the role of IT ­ and not just at an operational level, not just who comes and changes the desktop PC when it is broken ­ but who manages the strategy of risk and compliance? When that is understood, it is so much easier for the legal team to relate and make a valid and valuable contribution.

There isn’t an IT professional who wants their company to fail; or a lawyer who wants their company to fail; or a chief executive who wants their company to fail. Value each other’s contribution, which should be different, and make the whole something which is much more powerful.

There must be an engagement with IT professionals as to how, physically and practically, one can manage policy.

It is never the policy which is the issue, however, it is always how the policy is understood and how it is transferred into the world that makes it relevant and usable.

You cannot just assert compliance. You have to find the way in which it engages with an individual and, once you find that way, it is about relationships and communication ­ making the consequences of non-compliance and compliance practical and understandable.

When you do that, it is much easier to see the way forward and to allow things to work much more effectively. It has to be about that practical level of engagement and understanding how to transfer knowledge into the business.

The question that needs to be asked is: how do you know that what you have done is going to work? If an email says something inappropriate, can that email find its way to the legal team within a reasonable amount of time for some advice to be given? If the system can be tested then there is a fighting chance of keeping the regulator at bay.

There must be a point at which the lawyer takes responsibility. They may want IT to be responsible; they may want a data protection team to be responsible; they may want to outsource it; but they must have some oversight.

Paul Gilbert is chief executive of consultancy LBC Wise Counsel.

This article is based on a transcript of Gilbert speaking at the Computing web seminar “Do you know where your data is? How IT and legal teams can work together on data protection implications.”
www.computing.co.uk/webseminars