2025 Year In Review • December 2025

Cybersecurity and Data Privacy

Written by Shawn E. Tuma

AI in the Practice of Law—Attorneys Are Ethically Responsible for Accuracy
Artificial intelligence (AI) is all the rage but, unfortunately, too many lawyers (and even a few judges) seem to forget that it is not infallible and will always give an answer, even if it has to make one up. Several courts at the state and federal level have local rules and standing orders to mandate an essential principle set out in Ethics Opinion 705,¹ which is that AI should be used as a tool only and that a human stays in the loop and remains ethically responsible for verifying the accuracy and authenticity of all content.²

Disgruntled Former Employee Accessing Organization’s Dropbox to Provide Information to Investigator Violated Hacking Law and Is Not Protected by Immunity
The Texas Health and Human Services Commission (THHSC) was embroiled in a dispute with the Heidi Group (Heidi) and a disgruntled former employee of Heidi that retained access to Heidi’s Dropbox account (after authorization was terminated) and, over months, repeatedly accessed the account and passed sensitive financial information to THHSC at its investigator’s request. The court engaged in a lengthy analysis of several issues, two of which were holding: (1) Heidi had a reasonable expectation of privacy in its documents and files, which was violated;³ and (2) the former employee’s accesses to the Dropbox account were unauthorized accesses that violated Texas’ Harmful Access to Computers Act (HACA)⁴ and were not good-faith acts and, therefore, not protected by qualified immunity.⁵

TUTSA Does Not Preempt HACA When the Harm From the Hacking Is Distinct From the Use of the Information Hacked
El Paso Disposal sued its competitor Ecube Labs alleging that Ecube operated a fraudulent scheme involving a network of agents who posed as El Paso’s customers to allow them to obtain information giving them access to El Paso’s online customer portal more than 2,500 times to obtain confidential and trade secret information, including contract pricing and service terms to solicit defections. El Paso alleged, among other things, violations of HACA, which Ecube moved to dismiss arguing that the Texas Uniform Trade Secrets Act (TUTSA)⁶ preempted HACA. The court denied the motion finding TUTSA does not preempt a “HACA claim [that] is about the harm wrought by Defendant accessing their customer portal without authorization, rather than the damage done by the ensuing misappropriation of customer information from that portal.”⁷

Jury Awards $50,000 Against e-Discovery Vendor for Exceeding Collection Protocol in Violation of HACA
Parties to a case agreed to a collection protocol limiting what Consilio, an e?discovery vendor, could acquire from the plaintiffs’ personal Gmail account. Plaintiffs sued Consilio alleging that it disregarded the limits and downloaded the entire mailbox for the date range, capturing privileged communications, protected health information, Social Security numbers, and non?party family emails. A jury returned a $50,000 verdict against Consilio finding that it violated HACA by knowingly accessing a computer, computer network, or computer system without the effective consent of its owner.⁸

SHAWN E. TUMA is an attorney widely recognized in cybersecurity, data, and privacy law, areas in which he has practiced since the late ’90s. He is the managing partner in the Collin County office of Spencer Fane and is co-chair of the firm’s Cyber, Data, Privacy, & AI Practice Group.