6. Information Management from US

Question 1

What are the roles of a privacy professional?

Answer 1

1. Research- laws, guidelines, common practices and tools. Monitor current events and changing guidelines
2. Education- Educate the organization about privacy laws, polices, risks and recommended practices
3. Polices and Procedures- Designing and recommending
4. Monitoring- Monitoring internal and external threats to privacy. Monitoring and managing organizational risk

Question 2

What are the four types of risk?

Answer 2

1. Reputational Risk
2. Investment Risk
3. Legal Risk
4. Operation Risk

Question 3

What is Reputational risk?

Answer 3

• Damaging trust in the brand: Organizations can face both legal enforcement and reputational harm if they do not adhere to their stated privacy policies

Question 4

What is Investment Risk?

Answer 4

• Hampering the ability of the organization to receive an appropriate return on its investments in information, IT and information processing programs

Question 5

What is Legal Risk?

Answer 5

• Not complying with privacy laws (state, federal and international)
• Not fulfilling contractual commitments

Question 6

What is Operational Risk?

Answer 6

• Affecting efficiency

* Inhibiting use of personal information that benefits the organization and customers

Question 7

What are the four steps in developing and information management program?

Answer 7

1. Discover
2. Build
3. Communicate
4. Evolve

Question 8

In developing and information management program, what all should be done in discover?

Answer 8

The process of information management program development begins with “discovery.”

Consider:
• Accountability
• Company policy goals
• PI data inventory
• Data locations
• Data sharing
• Data transfers
• Data flows
• Data classification
• Data risk

Tasks include:
• Self-assessing and identifying privacy risk
• Classifying PI according to sensitivity
• Developing and documenting best practices

Question 9

In developing and information management program, what all should be done in Build?

Answer 9

Once an assessment of practices and goals is complete, determine how best to meet those goals by building a privacy program that both facilitates and restricts the flow of personal information (as appropriate).

This includes:
1. Internal privacy policies:
o Enforceable legal documents (contracts)
o Policy reviews
2. External privacy notices
o Common practices, sometimes required by law
o Promises to consumers
o Notices that accurately reflect policy and practices
o Version control
o Accessible online

Question 10

In developing and information management program, what all should be done in Communicate?

Answer 10

Even a well-constructed privacy program will not be successful if those involved in handling PI are not fully trained.

Communication is key, as well as:
• Documenting and updating policies and procedures
• Conveying policies, procedures and goals to decision-makers and consumer-facing employees
• Training and awareness programs for staff and management
• Individual accountability for compliance

Question 11

In developing and information management program, what all should be done in Evolve?

Answer 11

Information management practices evolve in response to changing technologies, laws, market conditions and other factors. Once an information management program is established, there must be a process for review and update. Failure to do so can
result in a company falling out of compliance with its public privacy promises or failing to meet other organizational goals.

Key actions include:
1. Affirmation and monitoring
o Do policies and practices still comply with law, conform with company needs and support incident response programs?
2. Adaptation
o What changes are necessary to comply with new laws, current company goals and industry practices?

Question 12

What are the steps in an Incident response program?

Answer 12

1. Preparation
2. Identification
3. Containment
4. Eradication
5. Recovery
6. Lessons Learned