Law firm fudges mailing list privacy and its own reputation

I received an interesting email this morning referring me to an email which a local law firm distributed to subscribers of its property-related mailing list. Ordinarily that isn't the sort of thing which would garner much interest from me - property law is somewhat outside my usual scope. What caught my eye is the way this law firm emailed this particular issue. It listed every email address in the mailing list in the "To" field and the result is something like this:

If you are wondering what the blue fuzz is, it is a partial screen shot of the distribution list, zoomed out to obscure the individual email addresses. The recipient whose response to the law firm was forwarded to me along with the original email had the following to say in his reply to the firm (this is a direct quote):

I find it extra-ordinary that your firm has revealed the private contact details of 1378 of your clients.

I am not a lawyer but I am pretty sure as a law firm that this is a MASSIVE breach of ethics and I certainly NEVER wish to be affiliated with your firm again. I am horrified my personal email address has been revealed by your firm to every person on this mailing list. There are VERY VERY VERY strict rules as to the data protection of your clients' information but it seems your firm has opted to ignore these basic rules.

If this is how you treat my private email address goodness knowshow else you are treating your clients information!!!

The massive conflicts this emailcould create is shocking and I ask your firm to kindly remove my email address with immediate effect and not to EVER contact me again!

This blunder raises a number of legal issues. The one issue raised in the quote is legal professional privilege (commonly known as attorney-client privilege) which vests in attorneys' clients. This privilege places restrictions on what information attorneys can disclose about their clients and the work they are doing. What is a concern about this email is that it potentially discloses information about the firm's clients through their email addresses. That said, names of clients may not fall under legal professional privilege although this depends on the nature of the work being done for the client and any contractual restrictions between the client and the attorney.

Disclosing email addresses and, indirectly, clients' identities may be a breach of confidentiality which is an implied term of an attorney's contract with his or her client; a breach of non-disclosure provisions where the client has required the attorney to sign a non-disclosure agreement protecting its identity from disclosure.

Another concern is the simple disclosure of the recipients' email addresses to each other. The mailing list apparently contains roughly 1 378 recipients and some of those recipients may prefer that their email addresses not be disclosed to each other. I hope the firm's privacy policy covers this sort of disclosure and can sympathise with recipients who, like the recipient I quoted, are dismayed that their personal information could so easily be disseminated.

Of course this doesn't reflect well on the firm itself which could easily lose a number of clients outraged at this blunder. The firm could also suffer reputational harm should these recipients discuss the blunder with their colleagues, friends and other parties. This disclosure could also easily undermine what must have been a fair amount of work that went into the database's compilation and any goodwill the firm garnered through its publication in the time it has been distributed.

Leaving aside questions of confidentiality (and they are potentially very serious), not taking care to protect an email database from this sort of public disclosure could have equally serious privacy and reputational consequences for an organisation. I certainly would not want to be the firm's directors when clients start calling about this.

Smart companies are embracing innovative legal solutions

I noticed that what companies were talking about started to change towards the end of 2010. I noticed that companies were talking to me about how they can best manage the inevitable risks their employees pose as more and more employees embrace and use social media services like Twitter. What I found especially interesting was a growing number of companies are acknowledging that simply cutting off access to social services can be detrimental to their businesses overall for a variety of reasons and that moderate access to social services may even be a requirement for their employees to work better and smarter.

Another trend I noticed and find fascinating is how companies are embracing necessitate fairly innovative solutions for challenges which are starting to emerge as they either adopt social services like Twitter and Facebook in their communications strategies and become more aware of the potential impact their employees may have in their own right. This point may seem like a duplication of my previous one but companies shouldn't just be concerned about implementing adequate internal policy frameworks like social media policies to govern how employees use social media and are made accountable to their employers for that usage. Companies should also take into account the possible implications employees' tweets may have with respect to 3rd parties who follow them. Should an employee's tweets have contractual significance that could bind the company? To what extent should employees clarify their relationship with the company and their ability to represent the company in their LinkedIn profile?

The Wikileaks debate focused a spotlight on radical transparency in the context of organisational and governmental information but what about all those mini-Wikileaks that have arisen and are bound to emerge as time goes on? What impact could an individual armed with sensitive corporate information and a distributed Internet-based publishing network have on the company? "Internet-based publishing network" sounds like a pretty involved and hard to obtain thing but that is pretty much what an average social network on the Web is, especially if it comprises interconnected social networks like Twitter, Facebook and LinkedIn. Individuals' reach is growing as their networks grow and just as social networks can be a powerful force for positive change, they can also be mis-used to disseminate secrets maliciously.

While there is considerable debate about whether something like Wikileaks should be permitted to exist and whether it provides a valuable service to us all, Wikileaks has shown us that the tools to replicate its work are pretty readily available. This doesn't necessarily mean that there will be a million more sources of government information being leaked but it does mean that sensitive information could leaks could, and probably have already, occur on smaller scales. This potential could change how companies interact with their customers, how people perceive their brands. The radical transparency Julian Assange works towards could become a new paradigm brands will have to adapt to.

More and more companies are embracing the social Web in their marketing and general communications activities. At the same time the social Web is continuing to grow, evolve and become more complex and this means that the challenges companies are facing are, themselves, becoming more complex. New services are gaining traction. Consider Quora, a social question and answer service which a remarkable number of Web and technology thought leaders are participating in. It is very sticky, contains a growing body of collective knowledge and its not really surprising that it was created by a former Facebook stalwart. Facebook itself is the single biggest only social network on the planet and well on its way to becoming one of the largest communities humanity has ever known. It is also becoming a fundamental part of its users online identity, if not their core online identity. It could become more valuable and useful than national identity. What does that mean for the social Web and the legal solutions necessary to accommodate these developments?

What is clear is that the social Web is a challenging and exciting space, the legalities that accompany its evolution are becoming increasingly complex and the solutions companies will require must be innovative. More of the same from your lawyers has never really been sufficient and it most certainly won't be this year or the years to come.