Practitioners’ Corner: Counsel’s Guide to Winning Friends and Influencing the Business

Practitioner’s Corner is a monthly focus on topics of interest to in-house counsel in the implementation of their privacy programs.

Your goal is to protect the company. Their goal is to execute business objectives. Are these goals compatible? Absolutely—but having an efficient discussion with business stakeholders requires laying the appropriate groundwork. In this month’s entry, I offer tips on your initial communication with your business stakeholders.

Conducting privacy impact assessments, building data maps, and evaluating compliance obligations requires a lot of facts. One of the most challenging aspects of counsel’s job is gathering accurate facts from business stakeholders. If lawyers commit to understand the product or service enough to accurately apply the law, and if the business folks are given enough information about the law to be able to extract important facts for the lawyers to evaluate, the process will be efficient and build good relationships that will redound to everyone’s benefit when future issues arise.

That process begins with a positive, to-the-point, and (where possible) educational email from counsel to the appropriate business stakeholders. In this email, counsel should demonstrate an understanding of the issues of importance to the business (often rolling out a product or signing a deal on a particular timeline) and be mindful of the fact that legal terms of art (such as defined terms in a statute) may not be understood by the business. Below, I outline suggested elements of such an email. Feel free to change and embellish as necessary.

Please don’t forget to: abide by applicable ethical standards, consider applicable law (or reach out to in-house or outside counsel first); and consider whether and how attorney-client privilege might apply to these communications and related communications between you and corporate employees and label them appropriately.

***

• Introduce yourself, explain why you are part of the project, and let the recipient know that you understand it is time-sensitive (if applicable). Build the relationship!

• Offer times to discuss the project. In my experience, an e-mail plus follow-up call is an efficient way to ensure you know the facts or at least discover whether you need to do more investigation. It also gives you another opportunity to check your understanding.

Facts

• Tell the recipient what documentation you’ve reviewed so far and set out in bullet format the facts as you understand them. Prompt the recipient to double-check your understanding.

• Pro Tip: In initial emails like this and at milestones during a project, I strongly recommend summarizing your understanding of the facts and giving business stakeholders the opportunity to verify them, especially for complex fact patterns and projects that might span months and many stakeholders.

Questions

• Take the time to lay out your most important questions in a succinct format, and make sure that you are asking clear questions (rather than implying the question and then making the recipient guess).

• Take the time to do a little bit of education with your questions. Make sure the recipient understands why the facts matter. Bring the recipient into your decision-making process and let them help you. For example, if European data is involved, you should explain that the GDPR could apply and that it would have a substantial impact on how a contract is drafted.

• If you have concerns about proposed uses of personal information, state those. For example, when a product is undergoing testing, there may be a temptation to use personal information that the company has previously collected – sometimes this is called “live” personal information (as opposed to “artificial” or “synthetic” information). Using live data is not a good idea because non-production systems that support a product may not have undergone full security vetting, creating a greater risk of data breach.

• If possible at this stage, offer solutions or alternatives to the problems you’ve identified.

These communications are an important opportunity to let business stakeholders know you are working for them. In return, you’ll get more information, creative ideas, and ultimately reach a better outcome.

Good luck!