Larry Ponemon, chairman and founder of independent data privacy and research organization Ponemon Institute, has helped law firms install data security measures and policies for years. They need it, he said, recalling a memory from years ago.

As an expert witness in a trial, Ponemon stepped into a major law firm’s office—which he refused to name—and saw confidential information out in the open.