The File on the Shared Drive
You run a two-investigator firm. A client sends you a USB drive containing 4,000 pages of employment records, including medical notes, disciplinary letters, and salary data for 60 employees, only 3 of whom are relevant to the matter. You copy the drive to a shared cloud folder that both investigators and a part-time administrative assistant can access. The assistant works from home on a personal laptop. Six months later the retainer ends. The client asks you to 'just keep everything, we might need it later.' Your insurer asks about your records practices.
1. Identify the privacy and records-management failures in this file.
Read the worked answer
Several failures stand out.
Excess collection. The client sent 4,000 pages for 60 employees when only 3 are relevant. You should have scoped the request, asked the client to narrow production, and segregated irrelevant personal information rather than copying it wholesale. Data minimisation is a core privacy principle.
Access control. A shared folder open to both investigators and an administrative assistant gives the assistant access to sensitive medical and salary information she does not need. Access should be role-based and limited to those who need it.
Personal device. An assistant working from a personal laptop on a shared cloud folder raises questions about device security, encryption, and whether firm data should be on personal equipment at all. There should be a written policy.
Retention. Keeping everything indefinitely because the client 'might need it' conflicts with retention limits. Personal information should be kept only as long as necessary for the purpose, then securely destroyed under a documented schedule, subject to any legal hold.
2. What should you do now, and what policies should the firm adopt?
Read the worked answer
Immediate steps. Inventory what you hold, identify the 3 relevant employees' records, segregate or destroy the rest (subject to any litigation hold), remove the assistant's access, and confirm where copies exist (including the assistant's laptop and any downloads). Document each step. Tell the client in writing what you will retain, for how long, and why, and get instructions on return or destruction. Confirm secure deletion and keep a certificate of destruction.
Policies. Adopt a written privacy and records policy covering: scoping and minimisation at intake; role-based access; encryption and secure storage; rules for personal devices and remote work; retention periods and destruction methods; breach response; and staff training. Have a designated privacy lead. Review the policy annually. Your insurer will want to see that these controls exist and are followed, and a regulator will judge you on documented practice, not intentions.