Study: The Market for Data Privacy Legal Services

Transcription

1 Study: The Market for Data Privacy Legal Services

2

3 2 Executive Summary: The demand for privacy and data protection legal counsel has grown along with the complexity of the global regulatory scene. Worldwide, we have seen enterprises increase in-house privacy staff at a rate of as much as 33 percent year over year (see IAPP-EY Annual Governance Report, 2015 ), and increasingly provide privacy training to nonprivacy personnel. Nonetheless, companies still need expertise and representation from outside counsel at certain times for certain functions. When do they engage these outside attorneys, and for what kinds of privacy tasks? How much do they pay for these tasks? Are they satisfied with the results? When might they prefer a consultant instead? To explore these questions and more, in January 2016 the IAPP and Bloomberg Law conducted a survey of 353 privacy professionals and identified 181 in-house privacy professionals who self-identified as currently employing outside counsel, shopping for external counsel, or having employed outside counsel in the last year. This revealed a number of interesting findings. We found that a significant percentage of corporate respondents 76 percent are currently using outside counsel for privacy and data security matters, with nearly two-thirds employing them as needed (63 percent), and an additional 13 percent on a retainer basis. U.S. companies are even more likely than non-u.s. companies to be using outside counsel (84 percent vs. 62 percent), as are those in medium and large corporations as compared to smaller ones (83 percent and 82 percent respectively vs. 68 percent). The market couldn t be considered large by the standards of much more established practice areas, like intellectual property or mergers and acquisitions, but it s clearly substantial and growing. We found that a significant percentage of corporate respondents 76 percent are currently using outside counsel for privacy and data security matters. In general, 61 percent of our survey respondents reported spending less than $99,999 on legal fees annually; however, 29 percent reported spending between $100,000 and $499,999, and nine percent spend more than $500,000. If we consider only U.S. respondents, they spend considerably more on attorneys than their non-u.s. counterparts on average over twice as much annually ($194,457 vs. $85,960). Outside the U.S., a full 66 percent of our survey respondents spend under $49,999 on attorney fees each year and no respondent reported spending more than $500,000.

4 3 Executive Summary Large corporations spend more than small ones, and outside legal budgets are more likely growing than staying the same or decreasing. A full 49 percent of respondents reported spend growth for outside counsel last year, and 45 percent believe their budget will increase for Just eight percent expect a decrease. Qualitatively, due to the small non-u.s. base size, a higher proportion of non-u.s. corporations expect 2016 budget increases than U.S. (59 percent non-u.s. vs. 40 percent U.S.). On average, businesses are paying their external counsel $623 per hour for specialized privacy and data protection matters, such as preparing binding corporate rules, $539 per hour for litigation in the privacy space, and $474 per hour for transactional assistance, which would include preparation of contracts and vendor management. Overall, respondents are most likely to be willing to pay outside counsel a premium for litigation (43 percent) and for interacting with regulators (39 percent). Additionally, U.S. respondents were more likely than non- U.S. respondents to pay a premium for interacting with regulators (45 percent U.S. vs. 24 percent non-u.s.), perhaps reflective of the more robust enforcement environment that exists in the United States than in many parts of the world, including Europe. How do in-house privacy professionals find these outside attorneys? Largely through referrals from external and internal colleagues, or through inheriting a law firm their company already engages. If shopping for a new lawyer, they turn to referrals from other outside counsel or to personal relationships with private practice lawyers. Lawyers speaking at events, writing articles, or giving personal pitches can sometimes raise their profiles with inside privacy pros if a relationship isn t already established. And what s most important in the firm they eventually settle on? Not surprisingly, responsiveness to client demands is at the top of the list, but the next most important quality identified by 81 percent of respondents is a dedicated privacy team. This is not a place for solo operators and one-offs. In fact, 22 percent of respondents are working with a boutique firm specifically dedicated to privacy matters. Clients also want their attorneys to offer thought leadership in privacy (72 percent), have relationships with regulators (69 percent), and know how to handle a data breach (65 percent). Privacy professionals generally do not hire outside attorneys for operational tasks like privacy impact assessments and privacy by design. Tasks outside lawyers are most often hired to perform are litigation, drafting and reviewing contracts and vendor agreements, interacting with regulators, and assisting with trans-border data transfer transactions. Respondents agreed that the market for these services is mature and they have many high-quality options when seeking external counsel to perform them. Privacy professionals generally do not hire outside attorneys for operational tasks like privacy impact assessments and privacy by design, however, and very few companies have begun to hire outside lawyers as their outside privacy officer or DPO. Respondents also perceive the external market for these services as underdeveloped at least at law firms. Outside the U.S., moreover, privacy professionals report a weak external counsel market for breach preparedness and breach response services; the U.S. market for these services is perceived as relatively strong.

5 4 Executive Summary In the U.S., lawyers still have a strong market position relative to consultants for a variety of privacy tasks regardless of the attorney-client privilege except for PIAs and privacy by design. Outside the U.S., again with only a small sample size to provide directional conclusions, lawyers are preferred for drafting vendor agreements, assisting with crossborder data transactions, preparing privacy notices, and interacting with regulators, but for many other tasks such as developing internal privacy policies, serving as official outside privacy officer/dpo, and working on breach preparedness matters non-u.s. companies prefer consultants to lawyers. All in all, most people are satisfied with their privacy counsel: A full 86 percent told us their lawyer was worth the money. In this full report on how organizations use privacy and data protection counsel, we ll look into the details of what these firms are doing for their clients and what value organizations are extracting. Conclusions There s significant demand for experienced outside privacy counsel, and the demand is growing. When privacy pros shop for external counsel, they rely largely on referrals and personal relationships, unless they inherit the law firm their company already engages. The most important qualities in external counsel? A dedicated privacy team and subject matter expertise, alongside basic care and feeding of the client. Privacy pros hire attorneys for litigation, contract negotiation, working with regulators, and managing cross-border data transfers, and they generally do so regardless of the attorney-client privilege. There are plenty of good choices and a mature, competitive market for outside counsel to perform a variety of privacy and data protection services, although there are indications the market is more mature in the U.S. than outside the U.S. for everything but cross-border data transfers. Data breach response in particular appears to have a more robust market in the United States. U.S. companies are more likely to pay hourly rates for external legal services than fixed fees per project. Non-U.S. companies also prefer hourly rates for most legal engagements but are more open to fixed-fee billing. On average, corporations spend nearly $170,000 annually on outside counsel handling privacy and data protection matters. U.S. businesses spend on lawyers more than twice what non-u.s. companies spend, and larger companies far outspend smaller ones. Across the globe, budgets for outside counsel are increasing year over year. Outside privacy attorneys command high hourly rates an average of $474 for transactional services, $539 for litigation, and an average as high as $623 for specialized services in privacy and data protection. Clients are generally satisfied across all subgroups, 86 percent reported that their outside privacy counsel is worth what they spend.

6 5 STUDY: The Market for Data Privacy Legal Services METHODS In February 2016, we surveyed 353 privacy professionals and identified 181 in-house privacy professionals and legal counsel who are currently employing or shopping for outside counsel, or who engaged attorneys in the last year, for privacy and data protection matters. The survey took approximately 15 minutes to complete. No incentives were offered and responses were completely anonymous. DEMOGRAPHICS Approximately two-thirds of participants work at a U.S.-headquartered corporation, while a third of participants are headquartered outside the United States largely in the EU (20 percent of all respondents) and Canada (6 percent of all respondents). Two in five participants worked at small enterprises (1-5,000 employees), a quarter at medium-sized ones (5,001-25,000 employees), and a third at large businesses (25,001+ employees). Over half of participants lead or work on a privacy team outside the legal department, while roughly twofifths work as in-house legal counsel with privacy duties.

7 6 Lawyers are in demand: There s significant demand for experienced outside privacy counsel, and the demand is growing. More than three quarters (76 percent) of survey respondents are using outside counsel for privacy and data protection matters. They are more likely to use their lawyers as needed (63 percent), but some law firms are employed on a retainer basis (13 percent). Of course, a survey of IAPP members might skew these numbers higher than the population as a whole, but it s clear a significant percentage of large organizations, especially in the U.S., have a privacy attorney on speed dial. In fact, when we look just at just U.S. companies, the percentage employing outside counsel climbs to 84 percent, while only 62 percent of non-u.s. companies currently use external counsel regularly. Non-U.S. companies are more likely to declare they don t need outside lawyers at this time (23 percent vs. just 9 percent of U.S. companies). Do you currently employ outside counsel for Privacy and Data Security matters? BASE Yes, as needed/ on a retainer basis (NET) Yes as needed Corporation Primary Location Global Corporation Size NON SMALL MEDIUM % 84% 62% 68% 83% 82% 63% 72% 49% 58% 66% 69% Globally, large and medium-sized companies report a much greater likelihood of using outside lawyers (82 percent and 83 percent, respectively) than small companies (68 percent), although small companies like non-u.s. respondents are more likely to believe they can do without. This is perhaps counter-intuitive. One common narrative in the industry is that smaller companies are less likely to have dedicated privacy counsel on staff, and are therefore more likely to use outside counsel for their privacy issues, but we do not see that play out in the numbers. Yes on a retainer basis No, but did within the past year/ but we are shopping (NET) No but did within the past year No but we are shopping 13% 7% 5% 3% 12% 4% 2% 2% 13% 12% 8% 4% 10% 9% 5% 4% 17% 7% 5% 2% 13% 4% 3% 1% Rather, it seems to simply be a matter of size and budget. If they can afford it, and they need it, they employ outside counsel. Smaller companies make do with what they ve got in house. No, we don t have the budget for one No, we don t need one 3% 14% 2% 9% 3% 23% 4% 18% 2% 7% - 14% As we ll see later in this report, many respondents report their budgets for outside counsel have increased recently and are likely to continue to grow. THOSE WHO indicated they either do not need external counsel for privacy and data protection matters or do not have a budget for external counse did not complete the remainder of the survey.

8 Lawyers: What are THEY good for? Privacy pros hire attorneys for litigation, contract negotiation, working with regulators, and managing cross-border data transfers, and they generally do so regardless of the attorney-client privilege. 7 We ve seen any number of large consultancy firms adding staff around the globe, and one industry narrative runs that consultants have grabbed market share with tasks traditionally completed by attorneys. However, our numbers don t yet bear out that attorneys have been replaced by consultants for many privacy and data protection legal matters at least not in the U.S. and not in traditional areas of legal practice. Respondents are most likely to use outside counsel often or always for litigation (47 percent), assisting with trans-border data transfers (33 percent), interacting with regulators (30 percent), or drafting/reviewing contracts and vendor agreements (26 percent). This pattern holds relatively true regardless of company size except in the case of contract and vendor agreements, in which case smaller companies are significantly more likely (34 percent) to use external counsel often or always, whereas mediumsized organizations do so only 23 percent of the time and large companies apparently manage such tasks mostly in-house (using lawyers often or always only 18 percent of the time). The next tier of tasks lawyers are hired to perform often or always are: developing internal privacy policies (22 percent); working on breach preparedness matters (20 percent); and preparing privacy notices (20 percent). Again, these patterns generally hold true regardless of company size, except there is anecdotal indication that small companies are more likely than larger ones to hire attorneys to assist with breach preparedness. Lawyers are least likely to be engaged to serve often or always as an outside privacy officer or DPO (9 percent) or to conduct privacy impact assessments or other operational tasks (7 percent). Privacy veterans should receive these findings with little surprise. What will bear watching is the outside DPO role, which has been established in the EU s GDPR. Will this function jump significantly in three years when the legislation s mandatory DPO provision truly comes into force, or will companies choose to keep that DPO function in-house? For what tasks do you engage external counsel often or always?

9 8 LAWYERS: WHAT ARE THEY GOOD FOR? Corporation Primary Location Global Corporation Size UNITED STATES CORPORATION SIZE For what tasks do you engage external counsel often or always? BASE Litigation Assisting with trans-border data transfers Interacting with regulators Drafting/reviewing contracts and vendor agreements Developing internal privacy policies Working on breach preparedness matters Preparing privacy notices Responding to information security incidents Consulting on privacy engineering / privacy by design Serving as official outside privacy officer / DPO Conducting PIAs and other operational tasks NON SMALL MEDIUM SM / MED CORPS CORPS 47% 53% 33% 43% 50% 50% 52% 56% 33% 33% 31% 30% 32% 37% 33% 35% 30% 33% 22% 26% 27% 37% 29% 42% 26% 24% 31% 34% 23% 18% 30% 12% 22% 24% 18% 29% 23% 13% 28% 16% 20% 21% 18% 26% 14% 18% 22% 21% 20% 21% 18% 22% 16% 20% 19% 23% 18% 18% 16% 14% 23% 18% 18% 19% 14% 13% 15% 18% 14% 8% 17% 7% 9% 5% 18% 12% 5% 8% 6% 2% 7% 3% 16% 8% 9% 5% 4% 2% When we include tasks outside counsel is at least occasionally rather than simply often or always engaged to perform, priorities change a bit. The number one reason to hire outside counsel remains litigation (82 percent), but the next most common reason is for contracts/ vendor agreements (76 percent overall), driven mostly by the needs of medium companies (who rank this as their most likely legal need at least occasionally more than litigation) and small companies (for which this is the second most important occasional need after litigation). Those in larger corporations are significantly more likely than those in smaller ones to use outside counsel at least occasionally for interacting with regulators, assisting with trans-border data transfers, and working on breach preparedness matters. These are all priorities that are much more likely to rise to the fore in large companies, obviously, but this might also offer a budget map for growing companies. As they enter new markets around the world, compaines often need outside legal assistance to comply with various data protection laws.

10 9 LAWYERS: WHAT ARE THEY GOOD FOR? Even accounting for mere occasional use, outside counsel are still not likely to be engaged for consulting on privacy engineering/privacy by design (49 percent), conducting PIAs and other operational tasks (34 percent), or serving as official outside privacy officer/dpo (25 percent). For what tasks do you at least occasionally engage external counsel? BASE Litigation Drafting/reviewing contracts and vendor agreements Interacting with regulators Assisting with trans-border data transfers Working on breach preparedness matters Preparing privacy notices Developing internal privacy policies Responding to information security incidents Consulting on privacy engineering / privacy by design Conducting PIAs and other operational tasks Serving as official outside privacy officer / DPO Those in the U.S. were significantly more likely to use outside counsel at least occasionally to respond to information security incidents (71 percent U.S. vs. 45 percent non-u.s.), while those not in the U.S. were more likely to use outside counsel at least occasionally for Corporation Primary Location NON SMALL Global Corporation Size MEDIUM % 84% 78% 79% 82% 87% 76% 75% 78% 75% 84% 72% 71% 74% 65% 66% 64% 83% 71% 70% 73% 57% 80% 82% 66% 69% 58% 68% 55% 72% 64% 66% 60% 65% 66% 62% 64% 67% 58% 65% 66% 62% 63% 71% 45% 58% 68% 65% 49% 47% 53% 55% 43% 45% 34% 29% 45% 34% 30% 38% 25% 23% 31% 26% 16% 32% conducting PIAs and other operational tasks (45 percent vs. 29 percent). This supports our finding that breaches are most feared as a privacy risk in the United States, with its myriad notification laws. The majority of respondents would use attorneys rather than consultants across most of the privacy and data protection tasks, and attorney client privilege is not taken much into consideration other than when choosing external counsel for litigation (42 percent) and when interacting with regulators (even then, only 27 percent); regardless, privilege is never identified as the primary factor by more than half of respondents. The two services for which consultants are used more often are work on privacy engineering/ privacy by design, and conducting PIAs and other operational tasks. Additionally (and directionally only given the sample size), non-u.s. companies are more likely than U.S. ones to hire consultants over attorneys for developing internal privacy policies, serving as official outside privacy officer/dpo, and working on breach preparedness matters.

11 10 LAWYERS: WHAT ARE THEY GOOD FOR? Corporation Primary Location Corporation Primary Location Are you likely to use Attorneys or Consultants? NON CONTINUED NON BASE Drafting/reviewing contracts and vendor agreements Attorneys regardless of privilege Attorneys but only because of attorney client privilege Consultants Assisting with trans-border data transfers Attorneys regardless of privilege Attorneys but only because of attorney client privilege Consultants Preparing privacy notices Attorneys regardless of privilege Attorneys but only because of attorney client privilege Consultants Interacting with regulators Attorneys regardless of privilege Attorneys but only because of attorney client privilege Consultants Developing internal privacy policies Attorneys regardless of privilege Attorneys but only because of attorney client privilege Consultants Litigation Attorneys regardless of privilege Attorneys but only because of attorney client privilege Consultants % 78% 64% 18% 18% 18% 8% 4% 18% 73% 79% 62% 12% 14% 10% 15% 7% 29% 68% 72% 58% 10% 10% 10% 22% 18% 32% 58% 60% 53% 27% 31% 18% 14% 9% 29% 57% 65% 37% 8% 9% 6% 35% 26% 57% 56% 59% 47% 42% 41% 44% 3% - 9% BASE Serving as official outside privacy officer / DPO Attorneys regardless of privilege Attorneys but only because of attorney client privilege Consultants Working on breach preparedness matters Attorneys regardless of privilege Attorneys but only because of attorney client privilege Consultants Responding to information security incidents Attorneys regardless of privilege Attorneys but only because of attorney client privilege Consultants Consulting on privacy engineering / privacy by design Attorneys regardless of privilege Attorneys but only because of attorney client privilege Consultants Conducting PIAs and other operational tasks Attorneys regardless of privilege Attorneys but only because of attorney client privilege Consultants % 56% 32% 24% 31% 12% 29% 13% 56% 41% 46% 29% 25% 26% 20% 34% 28% 51% 40% 43% 34% 39% 44% 26% 21% 13% 39% 36% 39% 28% 11% 14% 3% 53% 46% 69% 24% 20% 30% 16% 18% 12% 61% 62% 58%

12 11 WINNING MORE OF THE PIE Operational privacy tasks that have traditionally been performed internally things like privacy impact assessments, training, data inventory and mapping are activities that outside attorneys are hired to perform only rarely. In each of these areas, and in particular among non-u.s. companies, our data shows consultants have made greater inroads with clients. The question is: Why? Is it that privacy professionals don t want lawyers helping with these tasks, or is it that privacy professionals don t think law firms provide these services in the first place? The most significant opportunities for lawyers to expand their revenue may be in advising on privacy engineering and privacy by design, as well as helping with PIAs and other operational tasks. Survey respondents universally indicated they hire consultants more often than attorneys for these functions. Of course, respondents indicated they do not generally seek out attorneys for these tasks, but perhaps that is due to a perceived lack of supply rather than a lack of demand. Performing these functions requires a deeper knowledge of the client s operations and path to market than perhaps more traditional legal services such as litigation, breach response, or drafting and reviewing vendor contracts. Our survey also reflects that businesses are less likely to pay a premium for these tasks, and when looking outside the U.S., are likely to prefer fixed-fee or retainer payments for these tasks. These factors may reduce the incentives for mature privacy and security law practices to expand into PIAs and privacy by design. At the same time, they may present opportunities for new market entrants and perhaps boutique law firms seeking to differentiate themselves and win market share. The most significant opportunities for lawyers to expand their revenue may be in advising on privacy engineering and privacy by design. Small companies valued their outside counsel s vertical market expertise and in-house non-legal capabilities relatively high, at least directionally, compared to medium and large-sized companies and compared to other services lawyers offer. It seems, therefore, that small companies and especially those with regulatory and contractual pressure to demonstrate commitment to privacy and security, such as those in health care or financial services industries may be the most inclined to outsource DPO duties, PIAs, privacy by design and operational functions to their law firms. However, it would seem that consultancies have staked out their turf. They are likely ready to defend it.

13 COMPANIES PAY THEIR OUTSIDE PRIVACY LAWYERS WELL AND ARE GENERALLY QUITE SATISFIED 12 companies are more likely to pay hourly rates for external legal services than fixed fees per project. Non- companies also prefer hourly rates for most legal engagements but are more open to fixed-fee billing. After years of trying out new and alternative fee arrangements, it seems most clients and their outside counsel prefer the time-tested hourly fee method, at least for privacy and data protection matters. Only when we look at non- U.S. companies separately do we see (at least directionally) an overall increased appetite for fixed fee arrangements. Non-U.S. companies seem somewhat more open to fixed-fee or per-project billing for tasks like preparing privacy notices, developing internal privacy policies, or consulting on privacy engineering/privacy by design, tasks only occasionally performed by outside counsel in the U.S. Non-U.S. clients also appear to prefer fixed fees to hourly rates for conducting PIAs and other operational tasks, and for serving as official outside privacy officer/dpo, once again services more likely to go to a consultant than an attorney anyway. Of course, these conclusions are directional only given the small sample size. NON- HOURLY RATES FIXED FEE RETAINER HOURLY RATES FIXED FEE RETAINER HOURLY RATES FIXED FEE RETAINER Litigation Drafting/reviewing contracts and vendor agreements Interacting with regulators Assisting with trans-border data transfers Working on breach preparedness matters Preparing privacy notices Developing internal privacy policies Responding to information security incidents Consulting on privacy engineering/privacy by design Conducting PIAs and other operational tasks Serving as official outside privacy officer/dpo 70% 23% 8% 75% 19% 7% 58% 32% 10% 75% 18% 7% 82% 13% 5% 58% 31% 11% 78% 13% 8% 83% 10% 6% 64% 21% 14% 69% 28% 3% 74% 24% 3% 59% 38% 3% 69% 26% 5% 71% 25% 4% 62% 29% 8% 66% 30% 4% 74% 23% 3% 43% 50% 7% 63% 35% 2% 69% 30% 1% 46% 50% 4% 83% 12% 5% 89% 7% 4% 58% 32% 11% 64% 29% 7% 73% 21% 6% 45% 45% 9% 46% 40% 14% 59% 34% 7% 29% 48% 24% 34% 37% 29% 43% 26% 30% 17% 58% 25%

14 COMPANIES PAY THEIR OUTSIDE PRIVACY LAWYERS WELL AND ARE GENERALLY QUITE SATISFIED 13 Outside privacy attorneys command high hourly rates nearly $500 per hour on average for transactional matters, and even more for specialized privacy and data protection services. On average, corporations are paying their external counsel $623 per hour for specialized privacy and data protection matters, like developing binding corporate rules, for instance; $539 per hour for privacy and data security dealing with litigation; and $474 per hour for privacy and data protection transactional matters, such as contract and vendor management tasks. Corporation Primary Location NON SMALL Global Corporation Size MEDIUM U.S.-based businesses are likely to spend more money on specialists, litigation, and transactional privacy and data security matters than those outside the U.S. Larger corporations are also more willing to pay higher hourly rates than small and medium-sized businesses. As we discuss later, this is consistent with large corporations greater willingness to hire prestigious global firms as well. On average, corporations are paying their external counsel $623 per hour for specialized privacy and data protection matters. Specialist $100 - $249 $250 - $499 $500 - $749 $750 - $999 $1,000 or more Litigation $100 - $249 $250 - $499 $500 - $749 $750 - $999 $1,000 or more Transactional $100 - $249 $250 - $499 $500 - $749 $750 - $999 $1,000 or more $623 $653 $534 $560 $613 $709 1% - 4% 2% % 24% 48% 46% 23% 15% 43% 46% 32% 32% 62% 41% 21% 24% 12% 12% 12% 38% 6% 7% 4% 7% 4% 6% $539 $571 $451 $499 $557 $582 6% 5% 10% 9% 11% - 41% 35% 57% 46% 33% 40% 37% 40% 29% 37% 33% 40% 12% 14% 5% 6% 17% 16% 4% 5% - 3% 6% 4% $474 $514 $339 $442 $469 $524 15% 8% 41% 19% 15% 10% 42% 41% 45% 43% 38% 45% 34% 41% 9% 36% 42% 24% 6% 7% 5% - 4% 17% 2% 3% - 2% - 3%

15 COMPANIES PAY THEIR OUTSIDE PRIVACY LAWYERS WELL AND ARE GENERALLY QUITE SATISFIED 14 Sometimes companies might be willing to pay an hourly premium for certain legal services, chiefly for litigation (43 percent) and for interacting with regulators (39 percent), places where the risk attendant with a bad result is greater. Respondents from U.S. companies are statistically more likely to pay a premium for interaction with regulators (45 percent) than non-u.s. respondents (24 percent). This again seems to reflect the more aggressive nature of regulator interaction in the U.S. than around the globe. FOR WHICH SERVICE WOULD YOU PAY A PREMIUM? BASE Litigation Interacting with regulators Responding to information security incidents Assisting with trans-border data transfers Working on breach preparedness matters Drafting/reviewing contracts and vendor agreements Consulting on privacy engineering / privacy by design Serving as official outside privacy officer/ DPO Developing internal privacy policies Preparing privacy notices Conducting PIAs and other operational tasks None of the above Corporation Primary Location NON SMALL Global Corporation Size MEDIUM % 42% 45% 44% 41% 43% 39% 45% 24% 34% 43% 42% 29% 31% 24% 31% 36% 20% 20% 21% 20% 21% 16% 23% 11% 7% 20% 10% 9% 13% 9% 6% 16% 9% 16% 5% 9% 8% 11% 13% 7% 5% 9% 10% 9% 10% 7% 10% 5% 3% 9% 9% 2% 2% 5% 3% 9% 5% 7% 3% 4% 5% 4% 8% - 3% 28% 25% 33% 27% 25% 30% Generally, however, companies engaging outside counsel for privacy and data protection matters seem to feel they are already paying enough and aren t eager to pay a premium for legal services for relatively routine matters. On average, corporations spend nearly $170,000 annually on outside counsel handling privacy and data protection matters. businesses spend on lawyers more than twice what non- companies spend, and larger companies far outspend smaller ones. Across the globe, budgets for outside counsel are increasing year over year. On average, corporations are spending $168,577 a year on outside counsel for privacy and data protection matters. U.S. companies are spending, on average, over twice as much annually on external counsel than non-u.s. corporations ($194,457 vs. $85,960).

16 COMPANIES PAY THEIR OUTSIDE PRIVACY LAWYERS WELL AND ARE GENERALLY QUITE SATISFIED 15 Not surprisingly, moreover, spend on external counsel increases along with company size, although medium sized corporations are the most likely to have increased budgets from 2014 (65 percent reported either an increase between one and 20 percent or greater than 20 percent last year) and to project increased budgets in 2016, followed closely by small companies (approximately 50 percent increased external counsel budget last year and intend to increase again this year). In fact, across the globe, external counsel budgets for privacy and data protection matters are increasing year over year. The data directionally suggests that budgets outside the U.S. are growing at a slightly higher rate (59 percent non-u.s. vs. 41 percent U.S.), which could imply that the rest of the world is playing catch up with the U.S., as more jurisdictions, particularly, add breach notification and other data protection laws that may require the attention of a specialized external attorney. Spend on external counsel increases along with company size, although medium sized corporations are the most likely to have increased budgets. WHAT DO YOU SPEND ANNUALLY ON EXTERNAL PRIVACY AND DATA SECURITY COUNSEL? BASE $1 $9,999 $10,000 $99,999 (NET) 10,000 49,999 50,000-99,999 $100,000 or more (NET) $100,000 - $499,999 more than $500, 000 Mean EXTERNAL PRIVACY COUNseL SPEND Corporation Primary Location Global Corporation Size NON SMALL MEDIUM % 7% 12% 14% 7% 3% 53% 48% 69% 70% 50% 36% 33% 27% 54% 44% 30% 22% 20% 22% 15% 26% 20% 14% 39% 45% 19% 16% 43% 61% 29% 33% 19% 16% 30% 44% 9% 12% % 17% $168,577 $194,457 $85,960 $81,976 $194,333 $250,555

17 COMPANIES PAY THEIR OUTSIDE PRIVACY LAWYERS WELL AND ARE GENERALLY QUITE SATISFIED 16 Compared to 2014, by how much did your budget for external counsel increase or decrease in 2015? BASE Corporation Primary Location NON SMALL Global Corporation Size MEDIUM What percentage change do you anticipate in 2016? Corporation Primary Location NON SMALL Global Corporation Size MEDIUM Increased greater than 20% Increased 1-20% Stayed about the same Decreased 1-20%, Decreased greater than 20% (NET) 12% 12% 12% 11% 24% 5% 36% 36% 36% 39% 41% 28% 43% 42% 45% 50% 21% 51% 9% 9% 6% - 15% 15% 9% 9% 9% 9% 14% 3% 37% 32% 50% 39% 43% 28% 47% 50% 38% 49% 34% 56% 8% 10% 3% 4% 9% 14%

18 COMPANIES PAY THEIR OUTSIDE PRIVACY LAWYERS WELL AND ARE GENERALLY QUITE SATISFIED 17 Clients are generally satisfied across all subgroups, 86% reported that their outside privacy counsel is worth what they spend. The vast majority of respondents believe their privacy and data protection external counsel is worth every penny. This is true whether or not the client is based in the U.S., and regardless of size. IS YOUR SPEND ON EXTERNAL PRIVACY COUNSEL WORTH IT? Corporation Primary Location Global Corporation Size ROLE TYPE BASE NON SMALL MEDIUM LEADING OR IN-HOE LEGAL WORKING ON A COUNSEL WITH PRIVACY TEAM PRIVACY DUTIES 155* YES NO 86% 86% 86% 89% 83% 84% 81% 92% 14% 14% 14% 11% 17% 16% 19% 8% *Those who reported don t know were removed from calculations. Non-attorney privacy professionals are slightly harsher critics than their in-house legal counterparts 81 percent of non-legal privacy team leaders indicated their satisfaction while a staggering 92 percent of inhouse lawyers are pleased with their external privacy and data protection lawyers. This, perhaps more than any other indicator, shows there is yet some way to go in the market for external counsel before it is truly a competitive space.

19 WHAT MATTERS IN CHOOSING EXTERNAL COUNSEL 18 When privacy pros shop for external counsel, they rely largely on referrals and personal relationships, unless they inherit the law firm their company already engages. Methods used when shopping for external counsel SELECT ALL THAT APPLY BASE Referral from other counsel within my company External colleagues referral Inherited law firm my company already worked with Personal relationship From attending events Competitive RFP (pitch contest) From reading publications Law firm websites The lawyer/firm contacted me LinkedIn/Social media Internet search IAPP vendor directory Corporation Primary Location NON SMALL Global Corporation Size MEDIUM % 47% 35% 36% 36% 57% 32% 35% 25% 34% 32% 30% 55% 59% 47% 45% 57% 67% 40% 44% 33% 43% 36% 40% 24% 25% 22% 29% 23% 18% 19% 18% 22% 5% 32% 28% 16% 17% 13% 18% 16% 13% 6% 6% 7% 5% 5% 8% 6% 4% 9% 6% 5% 5% 3% 1% 9% 5% - 3% 3% 2% 5% 6% - 2% 2% 2% - 3% - 2% Considering the relative youth of the privacy legal services marketplace, we were interested in the market pipeline. How do business relationships develop and how are connections made? We asked respondents what methods they typically use when shopping for external counsel. They were allowed to select more than one method. The most prevalent method used to find outside counsel is referrals. Privacy professionals rely on referrals either from other counsel within their company (43 percent) or external colleagues (32 percent). Fifty-nine percent said they do both. As we ll see later, price is not a motivator. If a company is already using a particular lawyer or firm, chances are better than average (55 percent) privacy pros will continue to work with that lawyer or firm. In fact, 67 percent of those working at large companies said they simply took advantage of an existing relationship. Our respondents also rely on personal relationships (40 percent) when shopping for a new lawyer. These relationships may form when attending an event, as almost a quarter of respondents (24 percent) find attorneys through networking.

20 19 WHAT MATTERS IN CHOOSING EXTERNAL COUNSEL Most influential source of information when selecting outside counsel SELECT ONLY ONE BASE Referral from other counsel within my company External colleagues referral Inherited law firm my company already worked with Personal relationship Competitive RFP pitch contest From attending events From reading publications The lawyer firm contacted me LinkedIn/Social media Law firm websites IAPP vendor directory Internet search Corporation Primary Location NON SMALL Global Corporation Size MEDIUM % 21% 18% 21% 16% 23% 10% 8% 16% 17% 5% 7% 28% 31% 20% 21% 34% 32% 18% 19% 16% 18% 18% 18% 9% 8% 11% 4% 11% 13% 4% 4% 5% 4% 7% 3% 3% 3% 2% 4% 2% 2% 2% 2% 2% 3% 5% - 2% - 5% 3% 2% - 1% - 4% 1% - 2% 1% 2% - 3% - - 1% 2% - 3% - - Occasionally, outside counsel find work through responding to a competitive RFP/pitch contest (19 percent) or from impressing a client with something they ve published (16 percent). The least likely methods privacy clients use to find outside attorneys? Law firm websites (6 percent), cold calls (6 percent), social media or random Internet searching (3 percent each), and the IAPP vendor directory (2 percent). For outside counsel looking for new clients, non-u.s. companies are slightly more open to finding attorneys through competitive RFPs, cold calls, and social media than U.S. companies. Small companies are also less likely to be captured by an existing law firm relationship and more open to finding new lawyers through attending events, reading publications, and searching online. When we asked respondents to report how they were most likely to select a law firm, they were required to choose just one option. Once again, referrals prove to be the most influential source of information for selecting outside counsel (31 percent), followed by inheriting the law firm their company already works with (28 percent) and personal relationships (18 percent). Fewer than 10 percent felt that using a competitive RFP or pitch contest helped them choose their external counsel.

21 20 WHAT MATTERS IN CHOOSING EXTERNAL COUNSEL Large and medium-sized companies are both directionally more likely than small companies to keep the status quo with an existing law firm relationship. U.S. companies are also more likely than non- U.S. companies to maintain their current outside counsel engagement. Small companies and non-u.s. companies are more likely than the others to select outside counsel from an external referral. The most important qualities in external counsel? A dedicated privacy team and expertise Privacy professionals strongly prefer outside attorneys who are attentive and deeply committed to privacy and data protection law expertise. Far and away the top quality respondents identified in their external counsel selection as important or very important (4 or 5 on a scale of 5) is responsiveness to phone calls and s (88 percent). That may go without saying. However, right behind that is a need to see a law firm s dedication to fielding a privacy team (81 percent). Privacy professionals also prefer to work with attorneys who are thought leaders in the industry (72 percent), indicating that speaking at events and publishing articles while alone not necessarily enough to get the initial engagement may make a difference when law firms pitch a new privacy client. Other important factors privacy pros consider in engaging counsel are their relationships with regulators (69 percent), their breach response experience (65 percent), and their vertical market expertise in fields such as health care, financial services, and the like (63 percent). What about cost? Privacy clients are not immune to cost, citing hourly rates as one of their top seven concerns, but it s clear the market isn t close to commoditizing yet, as other factors play a much larger role. While we ll see later than privacy professionals generally view the market as offering plenty of good options for most of their privacy legal needs, the market is not yet so mature that one firm is as good as another. Privacy clients are not immune to cost, citing hourly rates as one of their top seven concerns, but it s clear the market isn t close to commoditizing yet.

22 21 WHAT MATTERS IN CHOOSING EXTERNAL COUNSEL MOST IMPORTANT QUALITIES IN EXTERNAL COUNSEL BASE Responsiveness to phone calls and s Dedicated privacy team Thought leadership in the industry Demonstrable relationship with regulators Breach response experience Vertical market expertise (health care, financial services, etc.) Hourly rate Alternative fee structure Geographic location Perceived prestige of law firm Number of cases litigated in the privacy space Certifications held In-house, non-legal expertise (PR, IT, etc.) Number of law offices globally Number of attorneys in practice group Membership in association of law firms Use of term breach coach Number of law offices in your country Corporation Primary Location NON SMALL Global Corporation Size MEDIUM % 87% 89% 87% 89% 88% 81% 85% 71% 71% 91% 85% 72% 75% 65% 69% 73% 75% 69% 72% 62% 65% 61% 80% 65% 70% 53% 66% 64% 63% 63% 64% 60% 68% 68% 53% 61% 62% 58% 64% 61% 57% 45% 46% 44% 43% 39% 53% 42% 37% 53% 43% 39% 43% 36% 37% 35% 30% 30% 50% 34% 37% 25% 25% 30% 48% 30% 27% 38% 34% 30% 27% 30% 27% 38% 36% 23% 28% 28% 29% 25% 17% 32% 38% 21% 24% 15% 13% 23% 30% 17% 16% 20% 14% 18% 20% 13% 12% 15% 17% 7% 12% 11% 12% 9% 12% 2% 17% Just as interesting as what matters to privacy clients is what doesn t matter as much to them when they select or rate the quality of their external counsel. Overall, the majority of privacy clients are not as concerned about a law firm s perceived prestige, or number of offices domestically or globally, or even the size of its privacy practice group. When we filter for what large companies value, however, we find that relationships with regulators ranks very high on their list of priorities with 80 percent calling it important or very important. This conforms with prior research showing that larger companies are more likely to be targets for investigations (see How IT and Infosec Value Privacy ), and presumably have more to lose in fines and brand tarnishment from an enforcement action. Large companies also anticipate more litigation, with 48 percent placing a high value on a law firm s privacy litigation experience compared with 34 percent of overall respondents.

23 22 WHAT MATTERS IN CHOOSING EXTERNAL COUNSEL Large companies are also significantly more likely than small companies to care about their law firm s prestige (50 percent of those in large companies rated this as important or very important compared to 30 percent in small companies), to look for firms with global offices (38 percent vs. 17 percent), and to prefer firms with large privacy practice groups (30 percent vs. 13 percent). Of course, large companies are more likely to do business across the globe and have needs in more jurisdictions. Prestigious law firms may be more likely to hold sway with global regulators and with CEOs and boards looking to avoid risk. We continue to see breach as a relatively U.S. concern. In previous research (see Assessing and Mitigating Privacy Risk Starts at the Top ), we have seen breach as a larger risk factor for U.S. companies than for those outside the U.S., and here again we see U.S. organizations valuing a law firm s breach response experience more than non-u.s. organizations do. It is perhaps no wonder, considering the 47 different state breach notification laws with which U.S. companies need to comply. We will have to see if the new breach notification rules in the EU s General Data Protection Regulation move the needle on these kinds of concerns. Finally, we see a significant market in privacy and data protection law for boutique law firms defined as a collection of attorneys typically organized in a limited liability partnership or professional corporation specializing in niche (or a select few) areas of law practice. Nearly one in five companies use a boutique firm that specializes in privacy. This market is even larger outside the U.S., where almost a third of companies engage with boutique firms. This aligns with other findings that privacy and data protection is still relatively new and specialized. Anecdotally, we have seen attorneys attempt to get out ahead of the privacy market by launching firms dedicated to privacy and data protection, especially in countries where privacy legislation has only recently passed. BASE YES NO Do you engage a boutique law firm for Privacy and Data Security matters? Corporation Primary Location NON SMALL Global Corporation Size MEDIUM % 18% 29% 23% 9% 28% 78% 82% 71% 77% 91% 72%

24 23 WHAT MATTERS IN CHOOSING EXTERNAL COUNSEL There are plenty of good choices and a mature, competitive market for outside counsel to perform a variety of privacy and data protection services, although there are directional indications the market is more mature in the than outside the for everything but trans-border data transfers. The majority of respondents think there is a mature and competitive market with lots of choices for outside counsel for all but three privacy and data protection services examined. In particular, in-house privacy professionals feel they have many good options when hiring outside attorneys for litigation, vendor agreements, privacy notices and policies, and to a lesser extent transborder data transfers. Where clients feel their options for outside lawyers fall short is for tasks like conducting PIAs and other operational tasks, service as official outside privacy officer/dpo, and consulting on privacy engineering/privacy by design. These are not coincidentally the same tasks in-house privacy pros prefer to do themselves or hire consultants to perform but one wonders whether they lack confidence in their outside counsel s ability for these tasks, or whether the external counsel market is simply responding to a lack of demand. Outside the U.S., moreover, those surveyed don t tend to feel there are a lot of choices for firms working on breach preparedness matters, or for responding to information security incidents. Quality external counsel is more readily available for these tasks in the U.S. This may again simply be a demand issue, with breach not being a big concern outside of the U.S. Litigation Drafting/reviewing contracts and vendor agreements Preparing privacy notices Developing internal privacy policies Assisting with trans-border data transfers Interacting with regulators Working on breach preparedness matters Responding to information security incidents Conducting PIAs and other operational tasks Serving as official outside privacy officer / DPO Consulting on privacy engineering/ privacy by design Those finding MANY good options for quality law firms, and a mature and competitive legal market for the following legal services: Corporation Primary Location NON 78% 83% 67% 77% 81% 67% 71% 75% 61% 65% 71% 52% 60% 59% 62% 54% 56% 51% 53% 62% 33% 52% 58% 38% 30% 36% 21% 29% 35% 17% 29% 33% 20%

25 Winning CONCLION More of the Pie 24 Privacy and data protection as a specialty field for private practice lawyers is now decisively on the map. Once an add-on to intellectual property and tech practice groups, privacy and data protection matters now support dedicated teams and even boutique law firms. In the U.S., this growth is undoubtedly a feature of the myriad data breach and sector-specific privacy laws that keep lawyers busy preparing breach notices, shifting liability and risk through vendor agreements, and helping clients work with various state and federal regulators. Class action lawsuits and FTC enforcement actions have also generated demand for privacy litigation expertise in the U.S. For privacy pros benchmarking their external counsel budgets, double-digit growth is now commonplace. Outside the U.S., such as in the EU, uniform laws may contribute to a more predictable legal climate and we therefore see lower levels of external counsel engagement and overall spend. This may change a bit in the EU, however, if corporations use external counsel for mandatory DPO functions with the coming General Data Protection Regulation, or perhaps to deal with the new breach notification components of the GDPR. For privacy pros benchmarking their external counsel budgets, double-digit growth is now commonplace. For law firms deciding whether to invest in privacy practice groups, the answer may very well be yes, but make sure you know your clients regulators, have a strong litigation team, demonstrate your expertise through speaking and publishing in the field, and get to know as many other privacy pros as you can relationships matter.

26 IT MATTERED AFTER THE DATA BREACH. When our client was hacked, we had to react swiftly and with precision. That s why we rely on Bloomberg Law. Its news and unique analysis keep us ahead of fluid domestic and global privacy and data security laws and trends in managing breaches. I was able to quickly advise on how to respond, report, and comply. Bloomberg Law. Because reaction time matters. When It Matters CTOMER SUPPORT 24/7 STAY CONNECTED 2016 The Bureau of National Affairs, Inc JO-19272