Interestingly, the Commission also recognizes the existence of data security statutory law in a number of statesthat already requires lawyers and other organizations to maintain certain security controls: The Commission recognizes that any guidance or rule amendments that it offers would have to operate within an increasingly large body of law that governs data privacy, some of which already appli