Are You Smarter Than a Real Estate Attorney?

Lots of attorneys are breathing a sigh of relief right now: “I am so glad that I don’t practice residential real estate.” If you are not a real estate attorney, you may not be aware that new federal regulations coming down the pike from the Consumer Financial Protection Bureau (CFPB) will impact how real estate attorneys practice every day. If you are a real estate attorney, you should be (or will soon be) very familiar with these regulations that require extra protections for your office, your data, and your financial systems.

Despite being a burden on many real estate attorneys, and even putting some of them out of the real estate business, many of the requirements are good practical advice for all attorneys to follow. The CFPB regulations may not apply to your practice area right now, but, the regulations are not unreasonable to help keep your data and your client’s data protected. Take a page from the Boy Scouts: be prepared!

As a little background, the CFPB is forcing the financial industry to comply with regulations that protect consumer’s private information as it flows through their system. Residential real estate attorneys, as agents in the real estate process, are also subject to these regulations. While there has been lots of speculation about these regulations, suggestions of how to comply, and “Best Practices” recommendations, real estate attorneys are now under a deadline for compliance—October 1st.

So what does this have to do with non-real estate attorneys? Lots.

The steps for compliance are centered on the American Land Title Association’s (ALTA) “Best Practices Pillar #3: Privacy and Information Security.” This recommendation deals with technology and the protection of Non-Public Information (NPI), which is data like social security numbers, bank accounts, financial records, and any personally identifiable information that is not publicly available. Sound familiar? It should. Bankruptcy, family law, and wills and estates attorneys are just a few practice areas that deal with NPI. No, they are not subject to these regulations, but they could be in the future. You may want to consider implementing some of these best practices now, before they are forced upon you.

These practices to protect client data are not unreasonable from an IT point of view, but may be quite burdensome to a real estate practice that is behind on technology. Many are written policies and procedures that are important to maintain the health of your firm, while others are solid technology processes a firm would benefit from implementing. In fact, these regulations might be beneficial for your firm to consider now as part of a firm’s annual technology review process (you do that, don’t you?).

This is not a comprehensive list of all of the requirements of Best Practices #3, but it will give you a good idea of the type of regulations that real estate attorneys will be subjected:

  1. Create and implement a written Privacy and Information Security Policy which describes how Non-Public Information (read client data) is protected. This policy should include data stored on mobile devices.
  2. Obtain an Information Security Risk Assessment to verify where data is stored, processed, transmitted and disposed—including external threats to data exposure.
  3. Verify that your data security system is regularly tested and any issues resolved.
  4. Create an Acceptable Use Policy that is annually reviewed, updated and verified by employees including use of the internet, email and company resources.
  5. Confirm that data is only available to authorized users, including procedures for removing terminated employees. (Lock down your network and don’t give everyone access to all of the firm’s data unless they need it).
  6. Create, test and implement complex password policies.
  7. Create and implement a policy regarding removable media and restricted use of USB drives.
  8. Provide encrypted email and encrypted hard drives.
  9. Document intrusion detection and security alerts. If this has been outsourced, have external party provide reporting of detection and security.
  10. Verify physical security to the office, server room and other data (offsite storage) is limited to authorized personnel.
  11. Create and implement a Clean Desk Policy.
  12. Create, implement and test a Disaster Recovery Plan.
  13. Create and implement policies for hardware and software updates and modification.
  14. Create, implement and test backup procedures to prevent data loss, including if this is done through a third-party backup company.
  15. Require third-parties that have access to your data that they comply with all of the same security procedures.
  16. Create and distribute a Privacy Policy to your clients.
  17. Include a privacy statement on your website and describe how the data that is collected on your website is protected.
  18. Create and implement a policy for record retention and destruction, including these same policies for third parties that retain and destroy firm data.

This is only an example of one of the seven of the Best Practices to which real estate attorneys will be subjected. Given this one, would your firm be compliant? Few are right now, and real estate attorneys will need to comply with all of them.

One of the other Best Practices that you should consider involves formal processes for any of your financial transactions, trust transactions, three-way reconciliation and limited access to your financial system. We need to talk about that another time—that is Best Practice #2.

I encourage you to begin implementing many of these policies and procedures. Even though you do not have a federal agency forcing compliance, these best practices are sound advice to protect your clients and your firm from data theft or physical loss. However, unless you have all of these procedures in place, you will not be smarter than a real estate attorney—they will be ahead of the curve.

About Pegeen Turner

Pegeen Turner
Pegeen Turner is the President of Legal Cloud Technology, a legal technology firm based in Raleigh, North Carolina. Her firm works with small and medium-sized law firms as they start-up, as well as firms that need help maintaining and integrating legal technology into their practice. In addition, she helps firms understand the risks of cloud computing and how to incorporate cloud computing into their practice. Email | Website | Twitter

Check Also

Managed Services Provider

Choosing the Right IT Managed Services Provider Is Crucial

Information security is one of the top priorities of most organizations today. Securing networks and the data that travels through them is of paramount concern.

  • Dobie Gillis

    Interesting that the Federal Government who can’t prevent the loss of more than 21 million social security numbers, etc. but can place liability upon real estate attorneys to do so or face the consequences. Perhaps, maybe, they should follow some of their own regulations.

  • Raymond Dowd

    Real estate attorneys job can help individuals with all property-related legal issues. Lawyers can also assist property owners with addressing issues and appealing property tax assessment.

  • John B.

    A “Clean Desk Policy?” I’m toast.

  • William Rosenfelt

    I practice family law in Central Florida and have a fairly strong RE background pre-bubble in FLA. One of the things that bothers me is that people think that practicing family law is “easy.” Moreover, there are a number of companies that are commoditizing legal services; if not simply selling forms. We see this happen most frequent in FLA in family law and and estate planning.

    The public now primarily is now using online reviews and third party legal directories in connection with retaining counsel. Whether purchasing a vacuum cleaner or retaining counsel, they want to see the reviews.

    Was curious if any of you have used AVVO before. I’m quite troubled by Mark Britton’s statements that “UPL should be abolished.” Moreover, I wrote AVVO on July 28th, 2015 in connection with my concerns about unethical conduct of attorneys while posting on AVVO, etc. Received an email from Josh King, (GC) for AVVO on the 4th of August. I’m interested in discussions regarding how Mark Britton is going to play this out after the IPO; not formally planned but it’s inevitable.

    Kind Regards,

    Bill Rosenfelt

  • Being an attorney and a good one is tough task, but practice makes a man perfect.

  • LevyR

    Man, I had no idea that property lawyers had to do so much work. At first glance you just think they have to read over a few contracts and then get people to sign them. In fact it seem like they do a lot more than that. http://www.davidgibbs.com.au/DavidGibbsAssociates2308/Page/25706/Legal+Services.aspx

  • markevans333

    Oh, its nice to read. I never knew we can’t deal with real estate properties without an interference of an estate lawyer. I must start searching for a good lawyer now as I need a property in Montreal. Can you recommend me a best? How about this http://jfbmontreallawyer.com