BTO CyberProtect In this digital age, no business is immune to cyber risk. What is more, the financial and reputational impacts of cybercrime, business interruption and privacy breaches can be immense. BTO’s CyberProtect team was created to protect businesses from the impact of system failures, security and data breaches and related claims. We offer practical, cost-effective advice which will allow you and your customers to stay in control and on the right side of data protection law, avoiding reputational damage and the often substantial fines and claims incurred when things wrong. In the event of a cyber incident occurring, we offer a ‘Rapid Response’ service.
Rapid Response
“pragmatic and strategic” (The Legal 500)
BTO CyberProtect PREVENT BTO’s CyberProtect team forms part of a tri-partite cyber breach response service which includes one of the most respected counter fraud experts in the UK. BTO manages and advises on the legal aspects of a cyberattack or data breach and handles subsequent claims. A specialist London firm provides the forensic computer capability. An experienced PR agency addresses the press management issues.
PREVENT
RESPOND
DEFEND
BTO Cyber Protect
Our prevention product is a fixed fee service:
IT Security Audit, in conjunction with IT security specialists, to identify vulnerabilities. Recommendations for strengthening systems and procedures against breaches. Training to ensure compliance with the GDPR and Data Protection Act 2018. Access to RGDP LLP (Really Good Data Protection), a standalone company set up by BTO which provides cost effective outsourced Data Protection Officer (DPO) services. RGDP’s qualified DPOs work in close association with BTO’s data protection experts and one of the most respected data protection trainers in Scotland: www.rgdp.co.uk
RESPOND Our ‘Rapid Response’ team provides guidance on:
What should be done in the event of a cyber breach incident. What to expect in the aftermath of an incident, which regulators will be involved and what powers they have. How best to: deal with clients/customers, handle any media attention and minimise reputational damage. Accessing expert witnesses in the field of cyber liability.
‘Rapid Response’ can be offered on a fixed fee basis for an initial triage assessment and thereafter on an hourly rate as required.
DEFEND Uniquely amongst Scottish solicitors, we believe, our Data Protection Solicitor Advocate appears at the First Tier Tribunal (GRC) (Information Rights) to conduct data protection and PECR appeals against ICO counsel from 11KBW Chambers. BTO’s solicitors regularly conduct cases in all the Scottish courts. We can pursue or defend your and your insureds’ rights in respect of any relevant claims for negligence or data breach damages. Our team will:
Provide guidance through any subsequent regulatory investigation and enforcement action to best protect your/your insureds’ businesses and minimise any fines from the regulator. Investigate how a breach occurred and provide advice on how best to mitigate losses and seek recovery of lost or misappropriated data or funds Advise on any potential civil liabilities and recovery strategies. Minimise your exposure to claims for data that has been compromised. Advise on measures to PREVENT a future recurrence…
Recent Experience
Ransomware: Advising clients on an urgent / out of hours basis where their systems had been compromised, under particular reference to the effects of hacking or ransomware. Also advising on practical steps to be taken to minimise risk including drawing up a breach response plan, with valid contact information, making and checking regular backups and penetration testing.
Phishing attacks: Advising on how to avoid / what to do in the event of an attack.
Data Breaches: Liaising with the Information Commissioner’s Office (ICO) in respect of complaints and investigations. Acting as the interface between our clients and the ICO in terms of assessing whether a breach is self-reportable, drafting the necessary reports and advising whether the data subjects require to be informed.
Fines: BTO has the only team of lawyers in the UK who have experience of successfully cancelling a fine imposed by the ICO (Information Commissioner’s Office) for a breach of the Data Protection Act 1998 (DPA).
Appeals against ICO monetary penalty and enforcement notices (DPA and PECR).
Compensation Claims: Unique experience in Scotland in relation to pursuing and defending compensation claims resulting from data breaches.
Advising the private and public sectors on SARs and claims raised by data subjects.
FOISA requests: Advising several public sector organisations in relation to complex and controversial Freedom of Information (Scotland) Act requests, supporting their governance procedures when an exemption applies. Also advising third party private organisations to provide comment when a request has been made for their information after it has been provided to a public sector body.
Payment Instruction/Diversion Frauds: Regularly acting in claims intimated to insurers following the perpetration of a payment instruction fraud, where large loss is incurred to the insured or their client or supplier. These claims require a rapid response from our team to carry out detailed investigations and to then guide and advise on how to respond to the claim. Our advice covers policy coverage, liability issues and also consideration of possible recovery action to be taken.
BTO’s expertise and breadth of skills means that we are uniquely placed to respond to and advise on claims and investigations and offer ongoing compliance services. With unrivalled practical experience in Scotland of litigating data protection cases, our hands-on involvement at the “coal face” of data protection is second to none, making us one of the leading data protection teams in the Scottish, if not the UK, legal market. Our relationship with RGDP provides clients with the opportunity to use tailored Data Protection Officer services via a flexible range of feeing methods - transparent and fixed in advance where possible. This alliance allows you to access expert legal advice and ‘on the ground’, practical DPO services at competitive rates. Our CyberProtect team has significant experience in dealing with cyber incidents and fraud claims and our longstanding experience in insurance work enables us to deal with high volume work and class actions, seamlessly servicing client needs. Where a large number of claims or litigations arise from a particular circumstance, we are available to handle all aspects on a bespoke basis to suit your needs – offering delegated authority and full reporting services as required. BTO always has the right person for the job...
Key Contacts Paul Motion, Partner, prm@bto.co.uk / 0131 222 2932
Accredited by the Law Society of Scotland as a Specialist in Data Protection and Freedom of Information law - the first in private practice. Solicitor Advocate with rights of audience in the highest civil courts in Scotland since 1998. Former Chairman of the Scottish Society for Computers and Law (SSCL). Authored the original Law Society of Scotland Cloud Computing Guidance.
Lynn Richmond, Partner, lyr@bto.co.uk / 0131 222 2934
Certified Specialist in Cyber Security Scottish Representative: FOIL’s Cyber & Digital Liabilities Sector Focus Team. WS accredited in Commercial Litigation Board member of SSCL for 10 years until 2020. Regularly advises clients operating in a variety of sectors regarding cyber incidents and data breaches, dealing with urgent advice in relation to damage limitation, regulator reporting and investigation, audits and damages claims for unauthorised disclosure of, or access to data. Regular speaker at events dealing with cyber risks.
Lynne Cardow, Partner, lca@bto.co.uk / 0141 225 5318
Certified Specialist in Cyber Security Regularly instructed to deal with claims against professional firms arising out of incidents of fraud perpetrated against those firms. Experienced in acting in cases involving a variety of different methods of fraud, which are becoming ever more sophisticated. Increasingly acting in claims where it is the client of the professional firm who is the primary target of the fraud, in addition to, or instead of, the professional firm - fast acting with meticulous investigation skills and always alert to the sensitivities involved in each case. The “go to” solicitor for such cases for BTO’s insurer clients / policyholders.
Stephen Bryceland, Partner, sbr@bto.co.uk / 0141 225 5289
Manages a first class claims handling and volume litigation team dealing with all types of claims. From pre-litigation outsource to low cost economic litigation solutions, Stephen’s team has a track record of achieving excellent results.
“very strong commercial instincts.” “peerless at anticipating and managing risks.” “drive to achieve the best possible outcome.” - BTO Clients
"deep technical knowledge ... communicated simply, with precision." (BTO Client)
Rapid Response
BTO Solicitors LLP (SO305583): 48 St. Vincent Street Glasgow G2 5HS, T: 0141 221 8012 One Edinburgh Quay Edinburgh EH3 9QG, T: 0131 222 2939
www.bto.co.uk
Twitter: @btodataprotect