Information Management From A US Perspective Flashcards
What risks should a company consider in designing a privacy program?
Legal - compliance with laws, contracts and industry standards
Reputational - protect company reputation
Operational - ensure privacy program is administratively efficient
Investment - receive return on investments in light of privacy regulations
What are the 4 steps for information management?
Discover - what are the companies practices and goals
- determination of best practices
- issue identification and self - assessment
Build - how to meet those goals
- procedure development and verification
- full implementation
Communicate - internally and externally
- documentation and education
Evolve - review and update program based on changes in technology laws etc
- affirmation and monitoring
- adaptation
What controls / practices should orgs use for managing PI?
Data inventory - inventory PI an organization collects
**identifies risks that could affect reputation or legal compliance
Data classification - classify data to determine appropriate level of protection
** helps an org address compliance audits for a particular type of data respond to legal discovery requests and use storage resources in a cost effective manner
Documenting data flows - systems / apps / processes for handling data
- ***helps identify areas for compliance attention
Determining data accountability - ensuring compliance with privacy laws and policies
When to have one or two privacy policies?
1 - if the org has consistent set of values and practices for all its operations
2 - org that has well defined divisions of lines of business who uses data in different ways, doesn’t share data and is perceived as a different business
Privacy policy review and approval
Needs legal consultation and executive approval
If a policy needs to be revised the org should announce the change first to employees and then to customers
Companies should obtain opt-in or consent before making material retroactive changes to privacy (sharing consumer data with 3rd parties)
How to communicate privacy policies through a notice?
Make the notice available online
Make the notice accessible in places of business
Provide updates and revisions
Ensure that the appropriate personnel are knowledgeable about the policy
Policy version control best practices
Ensure all locations where policies are stored are updated systematically
Include revision dare and a version number
Save and store older versions of privacy policies and notice
What is opt-in?
Or affirmative consumer consent or expressed consent
Affirmative indication of choice based on an express act of the person giving the consent.
Selecting a checkbox.
What is opt-out?
A choice that can be implied by the failure of the person to object to the use or disclosure.
“Unless you tell us not to we will share your data”
Unchecking a box
What legal acts require opt-in?
COPPA
HIPAA
FCRA
What is no option?
No consumer choice
Companies do not need to provide choice before collecting and using consumers data for practices that are consistent with the context of the transaction, consistent with the companies relationship with the consumer, or as required by law
What are challenges for managing user preferences?
- The scope of an opt-out or another user preference can vary
- The mechanism for providing an opt-out or another user preference can also vary
- Linking a users interactions through multiple channels
- The time period for implanting user preferences
- Third party vendors processing on behalf of the company
What laws give consumers the right to access PI held about them?
FCRA HIPAA OECD guidelines APEC principles Privacy shield
What should be included in a contract with a vendor?
Confidentiality provision No further use of shared information Use of subcontractors Requirements to notify and disclose a data breach Information security provisions
What vendor due diligence standards should a company consider using?
Reputation Financial condition and insurance Information security controls Point of transfer / secure transfer Disposal of information Employee training and awareness Vendor incident response Audit rights / assessments (ISO Sox etc)
GDRP requirements
Notification of security breaches Requirements for processors Designation of a DPO Accountability obligations Rules for international transfers Sanctions of up to 4% of a companies revenue DSRs Data protection by design and default principles
What are the lawful bases for transfer between the US and EU?
Privacy shield
Standard contractual clauses
Binding corporate rules
What is privacy shield?
Commitments by US companies wishing to import personal data from the EU accept obligations on how the data can be used which are legally binding and enforceable
Standard contractual clauses
A company contractually promises to comply with EU law and submit to the supervision of an EU privacy supervisory agency
Binding corporate rules
A multinational company can transfer data between countries after certification of its practices by an EU privacy supervisory agency
What are threats to online privacy
Unauthorized access Malware Phishing Spear phishing Social engineering Technically based attacks
Unauthorized access
When there is unauthorized access to a website or computer system this access may be criminal behavior such as fraudulent use of identity credentials and related financial information.
