In the UK, at the start of the year the EU passed a new amendment on privacy relating to online cookies. Under the European E-Privacy Directive’s new provisions web users must explicitly consent to their information being tracked by text files (cookies). Before the provisions were passed in May 2011 consent was implicit meaning users would have to opt out of the tracking, but now they have to opt in. Users must now be fully informed about what information has been gathered during tracking and how it was obtained. Implementation of the European E-Privacy directive has been slow in the EU states; most have failed to make the changes promptly.

In the UK, implementation took place in late May and has consequently created a lot of compliance work, first and foremost from the Department of Culture Media and Sport (DCMS), which is producing guidance on what businesses need to do to comply with the new rules. There is little doubt that the requirements will be more onerous than the previous system: it will no longer be enough to tick a box. The downside is that the delay in providing the guidance means uncertainty for companies, but the upside is that the information commission (which produced its own code of practice in summer 2010, largely directed at data breaches within the NHS) will not take enforcement action on breaches in the short term. In another 12 months or so internet regulation lawyers in the UK expect enforcement challenges to be the bulk of their practice.

Companies have tried to stay one step ahead of the changes, and lawyers have been at the forefront of their new and improved protection processes. Early this year Google launched Google Chrome, which automatically opts their users out of cookies, and Mozilla is working out a similar add-on device.

IT is such a fundamental part of any business that companies have to invest in good advice and processes even in dire economic times. As the number of users has grown, so has the work, and in some cases, so have the number of lawyers who are devoting more time to this practice area.

Lawyers in other European countries explained that the data protection changes have spawned a host of regulatory and e-commerce issues previously unseen in 2009.  According to lawyers in Belgium, litigation is a minefield: big players such as Google have been involved in online and data liability issues (Google Streetview technology was alleged to have inadvertently picked up fragments of private data when registering local wifi names) that have generated work for lawyers in other European countries. Data protection is not an area that is systematically taken into account during internet advice and matters, according to one Luxembourg lawyer, but the new directive has prompted awareness of its importance to company operations. In Germany, data protection as an industry was propelled by a series of internet scandals in 2009, which prompted more discussion and stringent enforcement. Equally, in Italy and Ireland security and compliance are the key issues in the market.

The general consensus is that the advancement of technologies and the global spread of users along different distribution lines will inevitably bring forth new legal issues, some of which may concern cyber security. Clients will expect lawyers to provide comprehensive advice in this area and be in a position to recognise and advise on multi-jurisdictional matters. The reforms are a positive development as they foster a strong consumer interest, but the challenge is their delayed and sometimes difficult application. The solution for European countries is to ensure that data privacy regulation is up to date with new technology and in compliance with their countries’ business models.

REST OF THE WORLD

The trends elsewhere are in keeping with those we have identified in the European research. The changes to regulatory and legal requirements in this field and the globalisation of technological advancements, is most evident in Asia.

In May, India adopted new data protection rules to govern the collection and processing of personal data. Under India’s Information Technology (Amendment) Act 2008, penalties will be imposed for companies that do not implement reasonable security practices and procedures. This is expected to produce more compliance work for Indian lawyers as it forces companies operating in India, and those looking to set up businesses in India, to put in place comprehensive protection strategies. It is a welcome development, according to the Indian lawyers we spoke to: the country experienced a long slump in related legal work between 2002-2009, as reflected in the low inclusions in our 2008 and 2009 research of three and four lawyers respectively. But since the last quarter of 2009 the airline and travel industries have picked up and created a significant uptick in work. For political and security reasons, the safe processing and storage of technological data in those industries had to be ensured. Work has been pretty constant as a result, as shown in the 2010 edition, which featured seven Indian lawyers, and this year eight.

Singapore is another country that has enjoyed steady activity in this practice area, fuelled by disputes and non-contentious transactions in e-commerce and data protection. Lawyers reported that they have been working on a combination of cross-border compliance in relation to online gambling (largely with EU countries), software infringements and public domain names, but the critical concern is the cost of litigation in this area. One lawyer explained that clients are reluctant to approach their domestic expertise because of its very competitive nature, for example sourcing the right expert witness is difficult, time consuming and costly. However, globalised deals have meant an increase in demand for local expertise, and lawyers with experience in international matters. This has resulted in law firms investing in their international capabilities thereby stimulating expansion in the industry. This is reflected in the number of lawyers in our research, which has grown from five last year to seven this year.

Similarly, Malaysia’s online legal market has seen a small but significant move towards using the internet as a means of commerce, instigated by the Personal Data Protection Act 2010. It is an underdeveloped industry with few players but it is growing and we recognise a Malaysian internet lawyer in this edition for the first time. We also include the first nominee from the Philippines. Although the work in the Philippines centres on IT and outsourcing, their inclusion is a reflection of that region’s growing internet and e-commerce capabilities. According to the 2010 online survey of internet users by Yahoo! there were 29 million users of the internet in the country, which is a rise from 2009 of nearly 5 per cent of the national population. So, as the number of users increase sharply, the need for small and medium business advice and guidance becomes essential.

America has seen a big increase in data protection and e-commerce work over the past 12 months. The stimulus legislation relating to medical health required all medical files to be electronically stored - this has created a demand for lawyers who advise on data protection systems and online payment systems. However, the US lacks a general data protection law, except those relating specifically to the storage of internet and medical data, so lawyers regard the industry as largely self-regulated. But according to those we spoke with, the recent hackings (Wikileaks, Nintendo and Sony Playstation) show that the US would benefit from a European-style basic protection, which can be regulated by an independent body.

FUTURE DEVELOPMENTS AND THE FIRM PERFORMANCE

Looking back over the past three editions, the firms with established IP and technology groups enjoy the greatest number of partners selected for inclusion. As can be seen in chart 2, Bird & Bird LLP is the leading law firm for the last three years in this field, closely followed by Baker & McKenzie, while the other firms in the chart remain largely unchanged, but for the expected marginal shifts through the years.

 

Lawyers describe three key trends they expect to see in the medium-term future. Firstly, the focus will continue to be on the online transfer of data: more data protection work will be generated as insidious hacking and data theft continue to affect large technology companies globally. Businesses will require the expertise of online data protection lawyers to provide regulatory direction, service planning and quick responses to breaches. “A more robust privacy environment will encourage business into a country not discourage it”, in the words of one London based lawyer.

Secondly, the use of more cloud computing in small and medium sized companies is expected. The device can be helpful and cost-effective for entities with small operations, but the technology cannot guarantee the safety of confidential information and therefore is not a bespoke service option. Our research suggests that European lawyers do not recommend its use but in time, practitioners believe these problems will be resolved and its popularity will grow, possibly eventually leading to the use of external hosting.

Thirdly, the social media and consumer marketing sphere has created a niche industry within this area. The development of sites such as Facebook, Twitter and Renren has seen practitioners advising companies on a range of specific needs such as promoting and market games, or even monitoring the online conduct of employees. As we mentioned in our last edition in October 2010, the use of social media as a channel for e-commerce must be tempered with the need to maintain the privacy of consumers and employees. Lawyers must also keep abreast of technological advancements and changes in international regulations, in order to maintain a functional expertise.

As can be seen in chart 3, a number of the leading firms in this area tend to have significant offices in Europe, arguably the region with the most comprehensive framework for internet, e-commerce and data protection in the world. As can be seen from charts 2 and 3, Bird & Bird LLP has been the leading firm for overall inclusions for the past three years, and is the leading firm by country for 2011 with an international reach covering nine countries, with the biggest showing in England. However, by far the country with the most nominations from the leading firms is Germany, with six out of the nine firms below fielding German inclusions. Research from previous years suggest the trend will continue: European firms and offices will feature heavily in the research in the future as the European community grows and the framework in this area, and cross-over practice areas, such as patents, trademarks and competition law, is implemented in more countries. 

 

In today’s globalised world, there is an increasing need for internet, e-commerce and data protection lawyers. The regulatory changes brought in by various jurisdictions have sought to reinforce the demand created by multinational matters while ensuring privacy and security where possible. In order to meet the needs of clients there is a call for lawyers with an industry background, cross-border experience or knowledge in related practice areas. Increasingly the internet is moving away from English-language only systems to embrace more international consumers. Lawyers predict social media, privacy and data protection and storage will come to dominate the legal landscape.