How legal teams can embrace the challenges of operating within the public sector

What unique challenges do you face providing legal expertise to a company that operates in the public sector?

The challenges [for in-house lawyers] are very similar whether you're in the private or the public sector, in the sense that we're all faced with a balancing act. On the one hand, we need to consider the company's interests, but on the other hand, we also need to think about the interests of the colleagues we’re assisting, helping them sell the products or services they want to sell. Sometimes there is a conflict [between these two things], where a good lawyer knows how to balance the risks and the rewards.

Specifically, when it comes to the public sector, we might be dealing with an additional element that our counterparts in the private sector are not facing. That is, understanding the frameworks within the public sector, which are slightly different to the private sector. Where [legal teams] operating in the private sector might be able to push their paperwork and their terms and conditions, in the public sector, organisations are often less open or receptive to accepting terms and conditions from their service providers. Public sector organisations like to work with their own generated frameworks, and sometimes, these frameworks do not align with the company’s risk matrix or risk appetite. That's the additional element that we, as lawyers working with the public sector, are facing. Also, [within the public sector] there might be a more complex and convoluted procurement process for purchasing products or even renewing contracts – [lawyers] need to understand that. To tackle these processes and procedures, which also differ from one public body to another, as a legal function, you need to have patience. Patience with your colleagues, who will come to you with all these challenges and questions, and patience with your counterparts in the public sector. They have a lot of restrictions in the ways in which they can work, so rather than push back, [in-house counsel should] be a little bit more patient and supportive of them. You need to learn to compromise, and even if you take a small win, see that as a big success.

What are the data-sharing requirements in the public sector? What tips do you have for other in-house legal teams about managing compliance with these rules?

Data-sharing requirements in the public sector are quite complex. On the one hand, there is legislation in place that encourages and mandates public sector organisations to share data. For example, in the UK the Digital Economy Act 2017, aims to facilitate data sharing between public authorities for specific purposes, such as improving public service delivery, research and policy-making. In 2020, the UK National Data Strategy was introduced to set out a framework for unlocking the value of data across the economy and society, including the public sector. It emphasised the need for data sharing, interoperability of systems and ethical data use, to unlock the value of data.

But on the other hand, the public sector (just like the private sector) needs to take into account the Data Protection Act 2018 and UK GDPR in order to find the right balance between data sharing and determining how our data is being used. By and large, we all want our public sector to improve public services and delivery, and organisations can only do that if they have the right tools in place, which clearly includes data-sharing.

Lawyers need to understand these regulatory regimes, which apply both to the private and public sectors, to disburse legal advice. They need to understand how the data was collected and what consent mechanism was at play, whilst keeping to the data minimisation principles and purpose limitation. Once the nuances are understood, the team can use this to the team, who in turn can advise their clients accordingly.

How important is it for companies operating in the public sector to help build trust around data sharing, and why? What steps should companies take to help build this trust?

Trust is enormously important. Trust enables more effective public services and better outcomes. From a business perspective, trust is fundamental to winning and retaining government contracts, protecting the company’s reputation and brand value, as well as, enabling innovation and growth in public sector services. When citizens trust data-sharing arrangements, they're more likely to provide accurate information and participate in programmes. This leads to better policy decisions and more effective service delivery. Businesses need to communicate the tangible benefits and positive outcomes resulting from data-sharing initiatives, such as improved public services, better policy making or advancements in research and innovation. Businesses should showcase real-world examples and case studies of how data-sharing has benefited citizens and communities.

They also need to implement robust data protection measures, such as encryption, access control measures, and anonymization techniques, to protect personal and sensitive data. Adopt the “privacy by design” approach, ensuring that privacy considerations are embedded throughout the data life cycle: collecting, sharing and disposing. Companies also need to regularly conduct security audits and assessments to identify and mitigate potential vulnerabilities or risks.

What are your top three tips for in-house legal teams at companies providing services to the public sector?

DR: Thinking of the three tips that I would give, the first one is to understand the public sector regulations and contracting processes. If you are just starting your in-house career, you can gain a lot by speaking to colleagues who have been working with the public sector for years. If you are lucky enough to have a bid team or a procurement team, they will be able to point you to resources that they have picked up along the way. Also, understand the technology behind the product or services that the company is providing, ‘look under the bonnet’, and try to understand what the proposed technical solution to that customer’s problem is. Visit your company’s literature (marketing collateral) and see what research has been carried out and what resources have been used for that research. Look at your own terms and conditions and see if they meet the current legislation and case law, and make sure they comply with your internal needs. Leverage any relationship that your company has with external advisors and see if you can participate in any seminars or events that they provide. This is a great way to validate your work.

Engage early and often with the relevant government stakeholders, both at the contracting level and operationally, so you'll be able to ensure alignment and set clear expectations.

Ensure that your team is well-versed in the nuances of government contracting, including the bid process, compliance obligations and reporting duties. As I said at the beginning of this conversation, we always have a balancing act: to engage the clients that you’re working for versus the interests of your company and make sure you’re setting expectations that align with your company's interests.

How is the emergence of AI going to impact data sharing in the public sector? What steps should companies take to meet these new challenges?

DR: That's a very good question and very timely because, as we speak, the UK government is setting out its AI objectives. AI is definitely going to be a very important factor within the public sector and for all those companies that provide products or services to the public sector. AI could be a game changer, but we need to ensure that it’s handled with care. AI relies on large language models (LLMs), so we need to ensure there is no bias in training models. We need to ensure that the data being used is relevant and robust and we need to adhere to the principle of non-discrimination.

We also need to ensure that there is no output hallucination and always have a human in the loop as a check and balance. In other words, to be transparent about data-sharing practices, the purposes for which data is being shared and the safeguards in place. Clear accountability mechanisms, audit trails and grievance redressal processes should also be established.

AI can play a vital role in helping government agencies to enhance their operational efficiency by automating and simplifying time-consuming tasks. It can help agencies to better understand their communities and deliver more relevant customer experiences, it can improve measurement of service delivery and community sentiment while maintaining strict privacy and security standards. For example, Granicus has a public sector-trained AI digital assistant for residents and visitors. It provides quick, accurate and contextual answers to questions, offering step-by-step guidance, accessing and understanding information, and completing common tasks such as applying for permits or finding local services.

Do you have any examples of best practices to help legal teams adhere to that principle of non-discrimination?

It’s really about the data you're using to train AI. AI technology is only as good as the input you use; there might be certain biases in the data, as I mentioned, which could reflect a certain bias or discrimination that was inputted by various users – it doesn't need to be from one source. It could be from many sources, but at the end of the day, you will need to examine whether there were any [AI-generated] outcomes that could result in discrimination.

For example, in HR processes, if you're using AI for recruitment, you could have input in the form of postcode data that maybe indicates that one postcode has a high level of criminal activity, and therefore you decide that you don’t want to consider applicants from that particular postcode – you decide to paint everyone within the same brush. So that would be one use case where, if an AI generated that sort of output, it would be discriminatory and unfair. You need to ensure that those sorts of practices aren’t happening.

Keep Calm