(Note, this post first appeared in the Operational Privacy blog on CIO.com) Data Privacy Day (DPD), held every January 28 and coordinated by the National Cyber Security Alliance (NCSA), is an international effort highlighting “Respecting Privacy, Safeguarding Data and Enabling Trust.” DPD p...

Recently I saw an interesting image on twitter from @darrencauthon.  The image was a television with an alleged FBI notice notifying the individual that their new smart TV had “suspicious files” and that they were being penalized $500 before they could use their TV again.  All of this is accompan...

Within 24 hours, I have had some interesting interactions with strong, or sometimes not-so-strong, passwords.  I figured now was a good time to go over some of the pitfalls you might encounter when trying to implement a new password policy for your customers or employees.

A few weeks ago, I was auditing a CIPP/US class that Bob Siegel was teaching on behalf of the IAPP.  Someone brought up the idea of openness and allowing individuals access to the data you have about them.  At this point, Bob discussed the principles behind this, such as how the OECD Guidelines a...

Recently, a large number of YouTubers and other celebrities have been “hacked” or lost control of their accounts.  The truth of the matter is that they aren’t being hacked, but instead the person taking control of these accounts is just having others do it for them.  The people and groups helping...

If you attended our most recent quarterly data breach review, you probably heard a new term: “metagame.”  The idea, put in its simplest form, is to take information from outside a scenario and use it to influence your choices.  It is amazing how using information that is not necessarily inside yo...

Irony is a state of affairs or an event that seems deliberately contrary to what one expects and is often amusing as a result.  So when I got a phone call asking to speak with Bob Siegel about his room for the upcoming IAPP Summit, I was surprised by the ironic situation I was faced […]

Very common questions we get from clients are how much information should they collect and how long they should keep it.  The standard answer is always to collect only what you need to do business and get rid of it when you no longer need it.  Now the questions become what information is truly ne...