Please note that information contained on this site does not constitute legal advice, or any other kind of advice. Information about your particular situation may lead to advice which might contradict the information herein, which is provided for general knowledge purposes only. Caveat emptor.
A promise to keep data safe and secure might seem like exactly the needed solution, particularly with safety-related or financial data which must be kept private. However, if relations break down, storing this kind of information in a truly secure way can turn into a legal nightmare. First, there are the practical matters of security:
- First, true security requires a certain amount of obscurity. Certain things might not be written down, such as exactly what the data is, or where it is stored, or how to get at it. Every piece of information about how to get at the data makes the data less secure, which defeats the purpose of trying to secure the data.
- Few people will have control over the "keys to the castle". There may be established ways to obtain the data, but if a client chooses a non-established way, such as filing for a court order, this form of request is likely to take a long time to satisfy, and lead to a measure of frustration.
Second, there are the optics:
- For a solutions provider to be unable to return protected data can be seen as a 'refusal' to return protected data. If relations have broken down, then the client of the solutions provider is not likely to give the solutions provider the benefit of any doubt as to the exact situation. Absent convincing documentation to the contrary, a judge may have to side with the client on this matter.
- Other solutions providers, motivated by self-interest, or unaware of the nature of the earlier request, may make statements to the effect of saying that it ought to be easy for the solutions provider to comply with such a request, even though if that were true, then the measures taken to keep the data safe must logically have been inadequate and negligent.
There are also practical issues, in a breakdown of relationship situation, such as what courts may order if they feel the optics do not make them comfortable. For instance:
- They may not believe that it must be difficult to obtain the requested information, even though creating this level of difficulty is exactly what the clients asked for.
- They can make orders going outside the scope of what was contracted, with extraordinary costs that would not have been calculated into the price of storage.
- For instance they may order a forensic investigation of server hard drives and backup hard drives, leading to
- Possible prolonged interruption of service, which will be unacceptable to other clients
- Gross invasion of privacy, and possible loss of protection of confidential information, and loss of protection of trade secrets, for any company, even third parties, sharing the same server as the upset client
- Costs of up to $45,000 or more
- The necessity for other clients to retain lawyers and become ready to object to gross violations of this nature
While a reasonable person might expect the above seemingly-draconian measures to be possible only after careful deliberation of all the relevant facts and merits of the claims being made, in fact orders to these effects can be granted before any discussion of the merits of the case are discussed or even thought about. The exact test applied before granting an order such as for the above is:
- Is the plaintiff suffering irreparable harm (this is subjective)
- Is there a serious case to be tried (this is subjective, too)
- Will the case be prejudiced by the order (also subjective)
Unfortunately, even if these questions are asked following a short leave (a request to accelerate due process to the point where there's a better chance the other side can't be ready to answer), the decision based on these three subjective questions can essentially come down to the question of who has more money, and who has evidence (in the form of affidavits, or sworn statements) ready to present to the short-leave hearing (another function of who has more money, but also a function of who has the advantage of surprise).
Issues such as technical feasibility, whether or not there was a contractual arrangement to perform such service, etc., are not always considered, and the effect of the order can be devastating to the ones being ordered, and despite many important and relevant issues not being considered, and despite the resulting devastation, court orders are considered absolutely binding. In addition, appeals can only take into account evidence that was before the court, so a "short-leave legal ambush" attack, as this tactic might be called, can have permanent effects.
The bottom line is that storing this kind of information has a high probability of costing a lot of money, and more importantly, of becoming a concern to other clients, and this should be worked into a price and business arrangement that protects everyone's interests.
For instance, a client who needs confidential information stored should have all of their data placed on a separate server, so that any request for this confidential information in a 'short-leave' attack, or a demand for this information as part of a rapid-fire contempt attack, will hopefully have an effect only on the server that houses the contested information. This has a cost of at least $200 / month, for a low-end server, but considering that an unfortunate court order could easily cost over $40,000, plus unquantifiable damages to reputation from other clients whose expectations of privacy or information security would be shattered, this kind of isolation is well-warranted, and costs of this should be completely born by the client.
In addition, no backups of this client's information should be kept in any form. This goes against the general policies of system administrators that backups are a good thing, but taking the legal system into account, it will cost the solution provider dearly to attempt to protect its clients. The better solution, given how difficult it can be to explain technical difficulties to non-technical people, and the short amount of time given to understanding facts in the initial phases of a civil motion, is to make the privacy-seeking client absolutely and completely responsible for backups, and to disclaim any liability, responsibility, or possibility for the solution provider to be responsible for lost data.
Furthermore, clients interested in this level of privacy should pay a fee relative to the value of the information stored into a "legal protection fund", which is essentially a trust account containing funds from the client for the purpose of defending against the same client's later actions using the legal system. In addition, clients interested in this level of privacy should sign documents guaranteeing that they will not later seek access to this data through legal claims, and that they will instead request it patiently and provide a reasonable length of time to respond, and pay for any costs related to attempting to circumvent security measures put in place.
Another issue arising for solutions providers regarding the storage of confidential information, or other kinds of information which might be claimed by a client or other interested party, comes from the necessity to separate the intellectual property of the solutions provider from the information claimed by the client. Whether or not it can be truly said that the client owns that information, the main problem is that before the case can be tried, short order motions can be granted giving the client exactly what they want, even though these orders may be impossible to satisfy due to the earlier requests of that client.
Thus a second separate server must be employed for the client, separating it from the intellectual property not owned by the client, so that there is a clear separation between the intellectual property, which in no circumstance can be owned by the client unless and until it is assigned through a normal contract negotiation process, and any information pertaining to the client's business, which, even if it might not REALLY belong to the client, is plausibly enough related to the client that a judge given only 60 minutes to decide, and not considering the merits of the case, might make a binding order that this information, which the client might never have seen before, and which might be highly encrypted, must be immediately delivered up to the client.
Another complicating factor in intellectual property disputes is that a short-leave motion, not taking into account the true merits of the case, might inadvertently create an order that the very property that the solutions provider may be seeking to protect, be delivered to the client making the false or dubious claims, and if this is done, then the horse has left the barn, so to speak. At that point the client might as well just drop the case because they have already obtained exactly what they wanted, without even getting to the merits of whether or not they should have gotten it in the first place. It can be very difficult, if not impossible, to close pandora's box, so to speak. Likewise, an order by short-leave, can prejudge the entire trial in an intellectual property dispute, before the facts can even be considered.
