Lexel – Resurrections and Second Comings

Lexcel and ISO27001 still enjoy a good relationship. Here, Advent IM Security Consultant, Steve Foley, has a look at the updated Lexcel…

A number of years ago a colleague published a blog addressing the ‘Rumoured’ death of Lexcel. The title to that piece was a little tongue in cheek as the content actually pointed to the continued increase in uptake of the accreditation within legal practices. Looking at present day and figures published by the Solicitor’s Regulation Authority and the Law Society suggest that of the 10,393 (May 2018) law firms registered in England and Wales 1,732, some 16 percent are accredited to Lexcel as a standard. As Information Security Consultancy is one of our core business deliverables, the blog continued to cover the correlation between that quality management standard and how it mapped across to a number of clauses within the globally recognised ISO/IEC 27001 – Information Security Management System.
Well here we are in July 2018 and the latest Lexcel Quality Management System publication has arrived to allow firms to consider and manage the impact of the following regulations and Act upon their business;
• The General Data Protection Regulation (Regulation (EU) 2016/679);
• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017;
• The European Union Financial Sanctions (Amendment of Information Provisions) Regulations 2017; and
• The Criminal Finances Act 2017.
Although the standard launched last month, members of the law society applying for initial or re-accreditation will not be assessed against the new standard until November of this year to allow time for policies to be updated and to be embedded within organisational business as usual.
Certification to recognised standards is becoming increasingly relevant to service providers as organisations look to outsource more and more of their business. As part of due diligence and adherence to relevant regulation, the level of assurance that certification can provide, certainly becomes a business enabler in assisting the tender process.
Also, customers are now savvier in regard to Data Privacy Regulation following the introduction of GDPR this May, the increase of and reporting of data breaches throughout large organisation’s and the no doubt soon to follow headline grabbing data breach fines somewhere throughout the EU. This will no doubt have an impact on which organisations the more astute choose to do business with.
On the subject of GDPR or more appropriately the UK implementation, the Data Protection Act 2018, the application of a management system will help address a number of articles contained within and will demonstrate a strong attitude to Data Privacy, Information Security and the continual improvement of such areas that in turn would help organisations be compliant against such legislation and reduce the threat of an incredibly hefty monetary charge from the ICO.
Whilst they do not marry up entirely, a large number of the requirements of Lexcel do map to ISO/IEC 27001, this relationship between the two standards will be strengthened later this year with the introduction of ISO/IEC 270552 – Enhancement to ISO/IEC 27001 for privacy management.
The overall take away is to choose a suitable standard to certify against as the benefits must be considered to outweigh the risk of having nothing in place. The benefit of demonstrably setting your organisation apart from other legal practices within the country, demonstrating that the sensitive nature of the data you hold is recognised and you treat it safely and securely and being certified to a recognised standard will allow you to tender for numerous contracts where certification is a pre-requisite.

ICO “Sounds the alarm” over escalating levels of law firm data breach

istock_000011991144medium.jpgRather than issue financial  penalties, the Information Commissioners Office (ICO) has opted for a subtler approach to law firm data breach. The information watchdog has the power to issue fines of up to £500k for serious breaches of the Data Protection Act but has chosen instead to issue a warning and reminder to law firms instead. This ‘warning shot across the bows’ comes after fifteen breaches over three months from UK law firms.

MP900175622The ICO has had its fair share of criticism when it comes to issuing financial penalties; many of those critics site the bias toward public bodies that have been singled out for fines. But this is a clear warning that the ICO has the personal data handlers of all sectors in its sights and fifteen breaches in three months is surely a trend that needs halting immediately.

Without a doubt, some of the information collected, stored, managed and deleted by law firms has to be among the most sensitive and personal of all data. The need for solicitors and barristers to be paragons of data protection virtue is clear. We are experiencing rising levels of cybercrime, fraud and hacking but there is also increasing awareness of how to report it and businesses are now looking to the law to support them and gain legal redress when their own or their supply chain data is breached or hacked. So the implications are far reaching; not only from the perspective of the data subjects who may be breached by their solicitor’s information handling practices, but from the commercial considerations for solicitors. Not only could they be facing an eye-watering and potentially practice-closing fine, but even a smaller fine or ICO notified undertaking could result in loss of credibility and therefore business.

Advent IM Data Protection Consultants

Law firms need to up their Data Protection game, according to the ICO