163
© 2018 Debevoise & Plimpton LLP. All Rights Reserved.
1. We will request that the arbitral tribunal
establish protocols and procedures for the
transfer of sensitive information at the
outset of proceedings, usually in the first
procedural conference. What constitutes
such sensitive information should be
defined in light of the particular
circumstances of a dispute.
a. These protocols and procedures may
include: (i) defining categories of
sensitive information, updated as
necessary through the course of the
proceeding; and (ii) agreeing on
processes for the secure transfer of
such sensitive information between
and among the tribunal and the
parties.
b. This may include barring certain
transfer methods (e.g., use of public
WiFi to access sensitive information)
or adopting certain transfer methods
(e.g., use of secure portals instead of
email).
2. We will ask the arbitral tribunal and the
parties to consider and, if appropriate,
agree to specific encryption standards for
the transmission of sensitive information.
3. We will propose and encourage arbitral
tribunals to disfavor the use of insecure
email for the transmission of sensitive
information unless additional measures
are taken to secure the information. Such
additional measures may include applying
passwords to documents containing
sensitive information that will be
transmitted via separate channels (e.g.,
texting or via a phone call).
4. We will propose that, where possible,
email accounts maintained by third party
public servers (e.g., Gmail) have additional
access protections such as multi-factor
authentication (e.g., use of a token or
similar mechanism in addition to
username and password).
5. If third-party cloud storage is used, we
will consider whether the third-party
cloud storage incorporates adequate
security protocols.
6. We will consider, and ask that the arbitral
tribunal and opposing party consider,
applicable governmental cross-border
restrictions on the transfer of sensitive
information and adopt reasonable
measures to facilitate compliance with
any restrictions.
Limited Disclosure and Use of Sensitive Information
7. Before submitting any sensitive
information to the arbitral tribunal or
opposing party, we will weigh the
sensitivity of that information against the
relevance and materiality of that
information for that arbitration.
8. We will explore with the arbitral tribunal
whether sensitive information may be
submitted in a form that is only screen
viewable (i.e., not readily downloadable or
printable). If sensitive information is
permitted to be printed, we will ask the
tribunal to establish consistent policies
and procedures related to the destruction
of printed materials.
9. To the extent practicable, we will limit the
persons who have access to sensitive
information to those persons having a
need-to-know with respect to such
information.