Information Management in Telco A Legal Perspective Sheila

Information Management in Telco: A Legal Perspective Sheila Tormey Barlow Lyde & Gilbert LLP Ronan Lupton Barrister at Law 17 September 2009 7062785

Information Management l Information is a key asset of every business l Technology has revolutionised our ability to access, create, store, search and communicate information l Information Management is in its infancy and lagging behind technological development “the stone age was marked by man's clever use of crude tools; the information age, to date, has been marked by man's crude use of clever tools”

Storing up trouble… 10, 000 8, 000 6, 000 4, 500 4, 000 3, 500 3, 000 2, 500 2, 000 1, 500 1, 000 500 0 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015

Inside of an IT storage system

Why is this a problem? l The acquisition of and failure to discard, possessions that are useless or of limited value due to a fear of losing things perceived to be important. = “PATHOLOGICAL HOARDING DISORDER”

Law and Information Management DPA IPRs Others e. g DDA, Confidence etc

Data Protection Act l Data Protection Act 1998 l EC Directive – EEA wide application l Policed in the UK by the ICO l Protects ‘personal data’ – electronic mainly (but also paper in some cases) l ‘data controllers’ must ‘process’ in accordance with the DPA l ‘data subjects’ get a number of rights under the DPA l Establishes “Principles” to abide by

The Data Protection Principles Specific purpose Adequate, relevant and not excessive Accurate and up to date Rights for Data Subjects under the Act Technical and organisational measures EEA Not kept longer than necessary “fairly and lawfully processed”

Consequences of breaching DPA l Reputational damage l Fines l Criminal offences l ICO increasing policing and enforcement and taking a harder line

5 Key Legal Impacts 1. Security/confidentiality obligations 2. What information can/must be stored 3. Exploitation of information 4. Who has a right to access information 5. Dealing with 3 rd parties

1. Security/Confidentiality l Common law confidentiality l Contractual – agreed standards l Data Protection Act – Principle 7 l Applicable IT standards “keeping up to date” - adequate technical and organisational (= security) measures – e. g. BS 10012 l Practical measures and security standards

2. What Can/Must Be Stored l 800+ specified retention periods fixed by statute/common law l VAT records 6 years l Contractual claims 6 years (12 years if a deed) l Data Protection Act l Processing fairly and lawfully l Adequate and not excessive l Accurate and up to date l Not for longer than necessary l IPRs

3. Exploitation of Information l Copyright l Arising automatically in original works l Lasts for a set number of years l Generally owned by creator – (including ‘employer’) l Database rights l Arises where "substantial investment" in obtaining, verifying or presenting the contents of the database l Owned by the maker l Data Protection l “fairly and lawfully”

4. Who has a right to access? l Confidentiality – who can it be given to? l DPA l Fairly and lawfully processed l EEA l Subject Access Request l Litigation – duty to provide even if detrimental l Regulatory investigation

5. Dealings with 3 rd Parties l See 1. to 4. above: l Security l Storage l Exploitation l Access l DPA issues need to be dealt with explicitly in contracts l Liability/Indemnity/Insurance l Right to audit/access and have information returned l Information management policies

Telco Top Ten l Data Retention Enforcement Directive – DRED l Challenge of dealing with different retention periods across multiple jurisdictions l Data or paper trails, post accessing by a Law Enforcement Agency – LEA l Cost control and recovery *(Where applicable) l DP Subject Access Requests l Timelines, deletion policy and corporate controls l WEEE and Ro. HS l Supply and Export Controls, EPA and EU Reporting “Good citizen requirement” l Copyright and illicit content controls – l “mere conduit” status erosion, litigation, telco innocence, where to next?

Top Ten Cont’d l Network Privacy / Traffic Management l DDo. S Implications – Fraud and IP Addressing l Nomadic Service Requirements l Address locations and Emergency Access e. g. , Vo. IP Jurisdictional controls, no one size fits all l Interception – Next Generation, to include IP interception l Billing – Achilles Heel of most telco’s l Corporate Compliance l Security and outsourcing

Information is your greatest asset, but also your biggest risk. . . l Not just the Data Protection Act 1998 l There is no “magic bullet” solution l A multi-faceted approach is needed: l Contractual and legal protections l IT security and solutions l Practical policies and procedures

Policies l Make it an employee issue not a corporate problem: l Written documents that explains practical day-to-day procedures and rules for use of the data (including communications, storage, passwords, access, home working etc) l Provided to all employees who have to sign and comply with them (part of employment / outsourcing contract) l Will reduce the real risk of a leak occurring l Will increase chances of compliance with law and regulation l Will reduce liability l Significantly improves PR damage

Spot the difference if lost…. . B A and

Questions?