Besides giving the Information Commissioner tougher powers, organisations will need to improve transparency and accountability when dealing with personal information.

From the website, Jack Straw Justice Secretary said:

‘As new technologies have developed, the secure storage and careful sharing of personal information held by both the public and private sectors has become paramount.

Strong regulation and clear guidance is essential if we are to ensure the effective protection of personal data.

The changes we propose today will strengthen the Information Commissioner’s ability to enforce the Data Protection Act and improve the transparency and accountability of organisations dealing with personal information. This is very important if we are to regain public confidence in the handling and sharing of personal information.’

So now organizations will also have to add ‘sharing of personal information’ to their corporate governance policy or other ‘know your customer’ or ‘know your data’ policies. How organizations will deal with the data protection, privacy and sharing requirements will certainly add more drama to the arena of edisclosure or ediscovery.

Pretty soon organizations will also have posters on ‘Beware of Data!’. With a list of Do’s and Don’ts (like the ‘Health and Safety’ Notice). I hope the Do’s and Don’ts won’t be 100 pages like the guide from the Information Assurance Advisory Council (UK) (IAAC).

The IAAC published the Second Edition of the Directors and Corporate Advisors to Digital Investigations and Evidence. According to the IAAC website, the purpose of this guide is to make directors and, managers and their professional advisors aware of the issues involved in collecting, analysing and presenting digital evidence. The report can be downloaded here.

A great pity that the guide uses the terms ‘Forensic Computing’ and ‘Forensic Readiness Plan’’and at the same time stipulated that: ‘Although this guide is designed for use within the United Kingdom and the descriptions of the law refer to English law, many of the principles are universal in all jurisdictions’.

I just did a book search using ‘ediscovery’ on amazon.co.uk and got 12 books related to the subject matter. On ‘edisclosure’ I got none. There’re couple of books listed when I used the search term ‘electronic disclosure’ but only one is available on the amazon.co.uk site.

So, the IAAC Second Edition guide is a useful starting point for organisations looking for reliable sources of information on digital investigations and evidence. What’s more it’s free!
Many thanks to the work of the IAAC and to Professor Peter Sommer.

According to the draft, the model is based on ‘the Plan-Do-Check-Act model (PDCA) used in the majority of management system standards’.

In the ediscovery arena, there is the Electronic Discovery Reference Model (EDRM) which was setup due to the lack of standards and guidelines in the electronic discovery market. The EDRM is a generic practical process model.

Also, there is another ‘closed’ (non lawyers are not welcome) working group looking at protocols to supplement the CPRs.

What an interesting mix of views/perspectives?!

What are the challenges of electronic disclosure?

According to the speakers/presenters from the legal world, the challenges are explored by themes which are;

Implications of the latest electronic disclosure developments
Minimising costs associated with eDisclosure
Best practices for managing and preserving electronic information
Developing litigation response strategies
Tips and traps for records management
Litigation strategy
Plus much more…

Not unusual that the legal world have tips and traps for records management.

On the subject of record management, I went to a talk & workshop on records management only last week, conducted by IT/Software professionals. The presenter actually raised some very interesting questions (no tips and traps) for the workshop discussions. One discussion topic was on ‘how to manage across boundaries (inside and outside the organisation)?’

Records management is not a challenge in edisclosure. Records management is already defined by the rules of the games i.e. the CPRs and the various procedures/processes for edisclosure. Ah! Maybe the rules of the games need to be reviewed or re-learnt/re-visited (by lawyers?) or maybe the lawyer’s interpretation of records management is different from what the IT/Software people viewed as records management. For the record, even within the IT/Software community records management have generated heated discussions especially when viewed in terms of knowledge management. Edisclosure is getting ‘relevant/needed/asked for/disputed/evidential’ (or any other keywords searched for) information from knowledge workers to other knowledge workers (or information seekers). Information is knowledge/power.

To me, this is the real challenge. It will involve not only strategy but the art of getting these knowledge workers to really want to collaborate. Who will be responsible for getting the information? Who will be fined? Knowledge workers or their managers?

Maybe the next Lawyer Conference will start to address the real challenges of edisclosure.

Sounds an interesting presentation from the flyer which says ‘the presentation will explain in depth the approach taken by the Serious Fraud Office in the collection, analysis, investigation and presentation of digital evidence for the purposes of achieving successful criminal prosecutions. The presentation will also cover the interrelationships between digital forensics as a science, and the investigation as an art.’

It would be interesting to see what topics and/or papers will be generated.