An Internet-free approach to data privacy compliance
[Editor’s Note: EDRM is proud to amplify our Trusted Partner, OpenText, in this timely post.]
eDiscovery technology continues to evolve to meet the realities of litigation, investigations and regulatory compliance requirements in the age of information. The most noteworthy over the past decade is the introduction and application of machine learning—known in the legal industry as technology-assisted review or predictive coding—to prioritize documents for review and expedite the manual effort, cost and time associated with eDiscovery reviews.
Air-gapped eDiscovery is a stand-alone, fully functional and portable instance of an eDiscovery product, without any form of Internet connectivity, that can be used to conduct an end-to-end eDiscovery project on-premise (and when complete, the technology is forensically wiped).
A parallel development in eDiscovery technology—specifically, how it is deployed—is evolving to meet three concurrent challenges:
- New and increasingly stringent data privacy and isolation laws prohibiting cross-border transfer of specific types of data;
- The rise of cybersecurity threats; and,
- The need for organizations to conduct holistic reviews when some of the data is held on-premise and some of the data is held separately in cloud services.
What is air-gapped eDiscovery?
The security options available on the Internet are sometimes insufficient for data privacy and high-risk content. Air-gapped technologies are fully functional appliances that can operate while being physically isolated from unsecured networks—including the Internet. Air-gapped eDiscovery is a stand-alone, fully functional and portable instance of an eDiscovery product, without any form of Internet connectivity, that can be used to conduct an end-to-end eDiscovery project on-premise (and when complete, the technology is forensically wiped).
The following use cases are examples of the challenges that portable eDiscovery can solve.
Compliance with Data Localization Laws
Data localization laws are a subset of broader data privacy regulations. Whereas GDPR and CCPA, for example, regulate how organizations collect, use and manage personal information, data localization laws govern where specific types of sensitive data can be stored and prohibit the transfer of that data across national borders, states or jurisdictions. Here are a few examples:
- Australia: Personal health records cannot exit the country.
- Canada: Two provinces (British Columbia and Nova Scotia) have enacted laws dictating that personal data held by public organizations be stored and accessed only in Canada.
- China: Data from specific sources critical of the Chinese government is restricted from entering China. E-banking, personal financial, medical, and PII data held by businesses cannot leave China, among others.
- France: Data produced by any government entity cannot be housed on non-sovereign cloud services.
- Germany: National laws include local storage of all accounting data and the restriction of telecommunications metadata within the country, among others. For the state of Brandenburg, data on residents can only be stored on cloud services within the state.
- United States: All federal tax data is restricted to within the country (includes foreign missions), and federal and state public procurement contracts are often subject to varied restrictions within the state or country, among others.
Air-gapped eDiscovery is a defensible approach to complying with data localization laws when data that is subject to discovery cannot leave the jurisdiction.
eDiscovery in isolation from cyber threats
Cyber threats are a concern across the legal sector, with law firms and corporate legal departments—which hold troves of high-value, confidential and sensitive information—increasingly seen as targets. Ransomware has been particularly rampant with high-profile cases hitting corporate counsel, law firms and government agencies alike. Air-gapped eDiscovery mitigates the risk of cyber threats because the perpetrators of malware do not have access into your projects without Internet connectivity.
eDiscovery within hybrid environments
Hybrid cloud environments are increasingly common in eDiscovery. This is because 71% of corporate law departments are standardizing on the cloud—yet 94% retain significant concerns over data security. A common method of reconciling cloud adoption with security concerns is to restrict specific high-value sensitive data to on-premise systems. But this poses some challenges for eDiscovery:
- Identical methods and technologies must be used for both the on-premise and cloud-hosted data to fulfill defensibility; and,
- The high-value and sensitive data must be assessed in isolation and de-risked by using automated redaction features—to identify, redact or remove sensitive information before porting that data to the cloud or including it in the discovery set.
Air-gapped eDiscovery accommodates these requirements: data can be assessed and de-risked in isolation using the air-gapped version of the eDiscovery system, which is a fully functional duplicate of the cloud solution.
Learn more
Air-gapped eDiscovery, effectively addresses compliance with data localization laws, isolates eDiscovery projects from cyber threats, and enables consistent holistic reviews that include high-value on-premise data and cloud-hosted discovery data in hybrid environments. To learn more, visit our OpenText website.
