During the IAPP’s most recent Privacy Summit, I was approached with an interesting question. “I am a privacy professional and I know why GDPR is important. I know about the fines and requirements for compliance, but few others at my company do. How do I explain GDPR to my colleagues effectively?” I responded with a quick and simple answer that probably did not cover all the bases, so I wanted to write up some deeper thoughts on the subject.
Unfortunately, it is a given that as an organization you will receive a notice from a third party that they had an incident or breach that may have compromised personal or sensitive employee or customer information. A majority of the breach laws require immediate notification or notification within a 24hr to 48hr timeframe, not including notification times from a contractual perspective. The question then becomes what does the third party need to provide, the level of assurance in order for an organization to re-establish connectivity and/or to use third-party moving forward.
In the past, despite numerous bills being submitted to it, Congress has not had much of an appetite for enacting a federal data privacy and breach notification law, choosing instead to leave it to the States. In light of the recent Cambridge Analytica fiasco and the massive Equifax data breach, the time might now be ripe for concrete action by Congress. Indeed, immediately following the commencement of the Congressional Hearings in which Mark Zuckerberg was the main attraction, two Democratic Senators (Ed Markey from Massachusetts and Richard Blumenthal from Connecticut) proposed the Customer Online Notification for Stopping Edge-provider Network Transgressions (or, for short, the “CONSENT Act”), which would expand the authority of the Federal Trade Commission (“Commission”). In today’s digital parlance, an “edge provider” deals with internet content (whether as a provider, website, application, host, etc.) as opposed to an internet service provider. Edge providers include the Big Dogs of the internet: Google, Facebook, Amazon, etc.
May has many holidays; Mothers Day, Memorial Day, Cinco de Mayo, Star Wars Day (May the fourth), and, of course, the new GDPR Day. Almost everyone is ready for the first four, but we continue to get calls from those GDPR procrastinators to help them prepare. With less than a month left to GDPR Day, what is a procrastinating business to do? Here are six ways to get started.
Continue reading this post…
I have previously written about the importance of a privacy program to in part, manage trust between an organization and its customers. As more data breaches occur and privacy is made more of an issue that is embraced and examined by the general public, this trust will become more important. One example of this is the evolving situation at Facebook.
So, you have a formal data breach response plan in place or an informal plan of action in mind….now what? With Alabama and South Dakota in a race to become the 49th state to enact data breach notification legislation (for sure, no one wants to be the “last man standing” in this scenario!), it may be a good time to review your plan. Continue reading this post…Posted on April 9, 2018 by Kelly Cheary - No Comments
The privacy landscape shifts, it seems, every week. The changes may come from new laws or regulations, changes in public opinion, expansion (or contraction) of your business, or the introduction of new technology to your infrastructure. Throughout this turmoil you need to have a privacy program that is resilient, adaptable, and agile so it can take the buffeting from these shifts while continuing to provide guidance to your organization. Continue reading this post…Posted on March 23, 2018 by Bob Siegel - No Comments
It’s that time of year again; time for the IAPP’s Global Privacy Summit. Yes, I pack up this weekend to head to Washington, DC for training, seminars and, of course, networking. Continue reading this post…Posted on March 17, 2018 by Bob Siegel - No Comments
On our last webinar (as of this writing) I discussed how a company can handle data subject’s rights requests under GDPR. Many of these requests are going to require attention, such as those ‘right to be forgotten’ requests. Others may seem daunting but can be handled easily and may not require any direct participation from your end. Continue reading this post…Posted on March 8, 2018 by Ben Siegel - No Comments
Security metrics are somewhat of an enigma. Executives want something tangible to speak to and analyze yet they are not easy to define or measure. Most likely you will hear examples such as ‘number of laptops stolen’ or ‘number of servers with known vulnerabilities’, but what do those numbers mean? Why do we or should we care about them? Yes, they will help to indicate areas of risk or improvement, possible ROI, but before you start the never-ending process of defining security metrics, it is beneficial to understand your organization’s security level of maturity by utilizing CMMI maturity levels.
April 16, 2018
April 30, 2018Continue reading this post...