New Companies House search facility

First impression of the new free access to UK company data

The new Companies House search facility, giving free access to information on UK companies and copies of filed documents, has been launched in beta here.

My first impression is that it's excellent - immediate one-click access to documents, a huge improvement on the previous elaborate process of selecting, paying for and downloading documents through the public Webcheck facility and the subscription services used by business customers.

The only downside I can see is that information is now so easily accessible that I'm sure there will be an increase in abuse. There appears to be no attempt to prevent automated services harvesting information, which is now all free of charge, which could be used to assist in identity fraud, to identify targets for spam, or to put together more sophisticated abuses. the information was all there before, but was only available if you knew you wanted it and  were prepared to pay your quid per document.

Data protection: enforced subject access requests

Demanding CRB checks now an offence

Employers and service providers requiring individuals to obtain and disclose certain protected data, such as criminal records checks or barring records, will commit an offence from 1 December 2014.
Only employers in certain sensitive occupations can lawfully obtain enhanced criminal record checks from the Disclosure and Barring Service (still often called "enhanced CRB checks"). Some employers and service providers, such as insurance companies, have developed a practice of insisting that applicants exercise their rights under the Data Protection Act to obtain their own sensitive personal data, then provide a copy of the report to the company. The report might be from the Disclosure and Barring Service (which replaced the Criminal Records Bureau and the Independent Safeguarding Authority), the police or the government.

Many businesses will have to change their practices as a result. Some unfortunately have not realised that rights to privacy are now real and are here to stay, even relating to important matters such as serious criminal records or preventing insurance fraud.

There are exceptions where the company is authorised by law to obtain the information or where obtaining them is in the public interest, but in most cases it will no longer be possible to circumvent the restrictions on who can access this sensitive data.

Out of court

Problems with expert determination clauses

A very common clause used to establish the value of shares or other assets is defective, according to a recent Court of Appeal decision[1].

Contracts and company articles of association often refer share valuation issues to an independent expert accountant. Similar forms of clause are used to settle the accounts of a business, and in property documents to refer valuations or rent reviews to an independent surveyor. The usual form of clause says that an independent expert is to be agreed or, if not agreed, chosen by the President of the Institute.

In this case the court held that both parties have to agree not only to the selection of the expert, but also to all the terms of the appointment, even if he is chosen by the President. So by withholding agreement to the engagement letter, a party could bring the whole process to a halt. The court said the process should be “formal and precise” and, in litigation that had already lasted four years, would only help by declaring that the parties could not unreasonably withhold consent. This case potentially gives the whip hand to the truculent and unreasonable.

I have devised wording to avid the effects of this case and keep disputes out of court. Anyone who might need to rely on an independent expert clause should have it reviewed before a dispute arises.

Non-disclosure agreements (NDAs, also confidentiality agreements or secrecy agreements) are used in a number of commercial contexts, from deal negotiations to technology sharing. But are they worth the paper they are written on? It is sometimes said that the cost of enforcement makes them useless, at least to small businesses.

There are benefits in having an NDA even if you are not likely to sue on it. Foremost is deterrence, and making the other party more aware of the need to respect confidentiality. The biggest downside, in my view, is not cost but evidence, as it's very difficult to prove a breach and even harder to show loss justifying substantial damages. Injunctions aren't much good if the information has already been disclosed (though they can restrain other abuses). I often advise clients not to disclose their "crown jewels" information even if they have an NDA in place.

---

[1] Cream Holdings Ltd v Davenport [2011] EWCA Civ 1287

This article in shorter form was originally written for the
Excello Law Limited newsletter and website

Putting the Djinn back in the bottle

Is an NDA worthwhile?

Non-disclosure agreements (NDAs, also confidentiality agreements or secrecy agreements) are used in a number of commercial contexts, from deal negotiations to technology sharing. But are they worth the paper they are written on? It is sometimes said that the cost of enforcement makes them useless, at least to small businesses.

There are benefits in having an NDA even if you are not likely to sue on it. Foremost is deterrence, and making the other party more aware of the need to respect confidentiality. The biggest downside, in my view, is not cost but evidence, as it's very difficult to prove a breach and even harder to show loss justifying substantial damages. Injunctions aren't much good if the information has already been disclosed (though they can restrain other abuses). I often advise clients not to disclose their "crown jewels" information even if they have an NDA in place.

I drafted one for a client only yesterday, though.

 

Tea and cookies

Should the law demand the impossible?  

Today the law on cookies changes [1].

Cookies are small files downloaded to a user’s computer or phone when they visit a website or use an online service. Most are completely harmless, and many are essential to the operation of the site, or improve the user experience by, for example, recognising you when you return.

The new law, based on a change to the underlying European directive, requires the user’s explicit consent before a cookie can be transferred to his or her computer. But how is that to work? Government advice confirms that relying on the site terms and conditions is not enough; nor can you rely on the user having set the browser to accept cookies, as that is not specific enough. You must actually ask and get informed, explicit consent.

Easy enough, perhaps, if you have a site that requires people to register or log in; you can get their consent as part of that process. But what about a straightforward information website? The ICO guidance offers a few possibilities, but none of them is satisfactory. Use of pop-ups, for instance, is defeated by users with pop-up blockers. Banners are technically difficult to implement and take up precious space on the site. Demanding consents will put people off using your site, and may drive them to competitors who do not comply. A small business with a website hosted on its ISP’s servers often does not have any facility for the necessary technical measures, or for storing users’ consents. It will simply have to stop using cookies (including inspecting cookies provided by other sites). Many small businesses use ready-made website packages or authoring software and will have no idea whether their sites use cookies; they may have to spend money finding out.

Technically, the exchange of cookie information happens as soon as a website has been accessed – before any information has been displayed. How do you get consent without displaying any text? How do you check if a user has consented to inspection of the cookie on his computer without inspecting the cookie?

The ICO has said that it will not rigorously enforce the new law in the first year, allowing businesses time to comply. That in itself is unsatisfactory – either the law is in force or it isn’t. The regulations were only published three weeks ago.

But the main concern is that it is impossible to comply fully with the regulations. It is this sort of legislative mess that brings business regulation into disrepute, and encourages the impression of thoughtless legislation from Brussels.

The other change made by the regulations is to introduce a new power for the ICO to fine businesses up to £500,000 for breach of the rules. No surprise there.

---

[1] Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 which amend regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003

Where’s my Blackberry?

Data protection comes of age – is your law firm taking it seriously?

It’s hilarious, isn’t it? MI6 officer leaves his laptop in a cab. HMRC loses unencrypted data disk in the post. Building society employee’s computer is nicked from his home. Medical records found in car park. Council loses children database on memory stick. Only this week, sensitive Scottish court records discovered at recycling bank. There are so many of these stories, and we all enjoy a laugh at the incompetence of these large organisations in protecting our personal information. After all, this only applies to big, faceless institutions managing huge databases – doesn’t it?

Data protection law has been around for a long time, but it hasn’t been taken terribly seriously by anyone outside of large data centres – except as an excuse to not tell anyone anything: “can’t answer that – data protection”. We used to tell our clients not to worry unduly – make sure you register, but if you get anything wrong all you will get is a telling-off and guidance on how to do better next time.

But now data protection has come of age. Sit up and take notice. In November the Information Commissioner’s Office (ICO) levied its first fines, under stronger powers given it last year. Hertfordshire County Council was fined £100,000 for inadvertently sending child protection case papers by fax to the wrong number. Who hasn’t sent a fax or email to the wrong address? Yet the council should, apparently, have had procedures to stop this happening. What procedures, exactly?

The second fine was even more concerning for businesses. A private company, A4e, was fined £60,000 for the loss of a laptop, stolen from an employee’s house, containing unencrypted data on 24,000 people.

Data protection doesn’t only apply to big databases – the Hertfordshire case concerned only a handful of people, though the information was of the most sensitive kind. It doesn’t only apply to professional data processors; it can apply to any business. And good intentions aren’t enough: failure to have adequate security and procedures can lead to large fines, even with the intervention of errors or criminals. Keeping data on a PC inside a locked private house wasn’t good enough protection.

That led me to think about the attitude of the legal world. Solicitors take client confidentiality very seriously, in terms of their own conduct, but many have not translated that into action on data security or, for that matter, physical security. They think of it as a duty to the client, but not about the other data subjects who may be referred to in their files. Legal practices hold vast amounts of personal data, much of it of a highly sensitive nature. Deeds and will may be kept in a safe, but there is little or no security on paper files, which are stored openly, carried around on public transport and taken home. Many lawyers’ computer systems have no security on internal access to data beyond an access-level password. They have firewalls and virus protection. But usually no protection at all against unauthorised access or copying by legitimate users of the system, or anyone in possession of their passwords. Data is not segmented or internally password-protected.

Access to the servers from the internet is usually tightly controlled, but once in, there are no restrictions on access to client data. Unencrypted email is universally used for almost all communication, and unencrypted attachments are sent that could include large amounts of personal data. Worst of all is the approach to home and mobile working. Data may be freely transferred to work or personal laptops and mobile devices. Mobile devices with weak passwords or PIN numbers allow access to the entire system, or at least to email records.

Solicitors have always relied on their integrity and professional conduct to enforce confidentiality. Systems are devised to prevent casual disclosure of information, but they are not designed to withstand deliberate, criminal attack. Most solicitors would feel that there is not much chance that they will be victims of deliberate espionage or malicious attacks.

Then there was the ACS Law case, in September 2010. ACS, a small law firm, acted for copyright holders trying to sue P2P file sharers for copyright infringement. It got court orders against ISP’s forcing them to disclose lists of users with details of internet usage, allegedly including their access to pornography. BT, and possibly others, sent the data to ACS as unencrypted email attachments – Excel spreadsheets. You wouldn’t have done that – would you? Then the libertarians of the file-sharing community mounted an illegal denial-of-service attack on ACS’s website. In attempting to restore the site, ACS’s IT people accidentally allowed access to internal data, including their email archive – which was promptly stolen and distributed across the net. ACS could yet be fined up to £500,000 for this breach. Clearly that should not have happened. But it was a mistake, made by a technical person. How is a law firm supposed to supervise an IT specialist to make sure he never allows external access to data?

More worrying still, the unencrypted attachments were the main source of the data stolen. What could ACS have done to protect that information? It naturally archives its emails, even if deleted by its users. It also backs up the archive and everyone’s inboxes. So multiple copies of any attachment will be created, even if the user did not save the attachment – or correctly saved it with a password.

This is the heart of the problem for law firms. We deal in evidence. We are instinctively more worried about losing access to data than we are about others gaining access. People leave, and passwords get forgotten. We lawyers hate to throw anything away. We get sued if we can’t prove exactly what advice we gave to Mrs Jones on the phone in 2005, or we can’t explain why clause 24 was deleted in draft 3, or we forgot the family history told to us five years earlier. Professional standards such as Lexcel require us to ensure that other people in the firm have access to client information if the lawyer is absent for any reason. The drive to be efficient and keep costs down requires us to share information quickly.

Part of data protection is the deletion of data that is no longer required, but I have yet to meet a lawyer who thought that any document or record could be discarded. Try persuading them that they should be deleting all records of incoming emails from the other side in litigation because they contain personal data! It’s evidence in the case.

So what should we be doing? The ICO’s guidance is quite clear, and it does not match with what many lawyers have been doing. Review your security with an eye on protecting the privacy of all data subjects, not just your client. Make sure your data is secure even if someone steals your PCs or servers. Identify particularly sensitive items, either because of the nature of the information or the number of data subjects, and take particular precautions, including password-protecting individual documents and preventing their removal from the office, in hard copy or unencrypted electronic form. Ban anyone from working on computers outside the office unless all client data is stored on an encrypted drive with a strong password. Prevent anyone from transferring data to CD or memory stick without getting authorisation, to include checking the security of the data. Promote a culture of data security, including password security.

For now, this will still be an imperfect solution. We need to communicate with outside parties and to transfer data to them. Email encryption is still not widely accepted in the world at large, due to the need for both parties to operate the same system, so email traffic is likely to remain vulnerable in transmission. Make sure your records of incoming and outgoing emails are stored on encrypted drives and that your access passwords are strong, and not remembered by the user’s PC – which Outlook rather encourages. Check that your backups of data are as secure as the originals. If necessary, implement a password management system to securely record the passwords needed to access protected data.

I have done all this myself, now I am working at home, to give clients and data subjects the best protection possible against unauthorised access to my home PC, laptop or smartphone, my wireless network or my email communications. I tell my clients to anonymise bulk information they may send me about their employees or customers wherever possible, and to password protect the information. But no-one has yet shown me how to prevent the mis-keying of a fax number, the loss of a document in the post or accidentally attaching the wrong file to an email. At least by being seen to try, we should be protecting ourselves from the savage criticism that will flow from doing nothing.

I should say that nothing in this article relates in any way to any of the firms I work with – I have no cause for concern about any of them.