Privacy Ref and CyberDefenses Bring Privacy and Security Together

There is a saying that you can have security without privacy, but you cannot have privacy without security. While privacy and security are both concerned with the protection of information held by an organization, security provides the means to meet the business requirements identified to meet pr...

Privacy Impact Assessments: Organization-specific or Generic PIAs

I recently had a conversation with a colleague about privacy impact assessments, PIAs, and the tools available to administer them. We quickly became philosophical, trying to weigh whether a generic tool would work or if something that is organization specific is necessary.

Safe Harbor Found “Invalid”, Now What?

Transferring personal information from the EU to the US has been a challenge. Today it may have become more difficult with the EU Court of Justice finding that Safe Harbor is invalid. For those 4,000 or so businesses that use Safe Harbor for data transfers the question  is how to go ahead.

Tom Brady, Joe Namath, and Privacy

Like many Americans I grew up idolizing football players, quarterbacks in particular. Joe Namath and Tom Brady are among those I have enjoyed watching play. Who would of thought that these two men who played in different eras would provide examples for a privacy discussion for business.

Crisis Communication Plans and Data Breaches

Think of a data breach as not only a possibility, but also a likely crisis scenario for your company. A breach will cost your company not only money but can deeply damage its reputation. When was the last time your company reviewed its crisis communication scenarios and, most importantly, added d...

“It’s only an email address!”

Facebook, Ubisoft, and Morningstar are all recent examples of data breaches that involved the unauthorized release of email addresses. In one of several conversations I have had about these events some people could not understand why others were upset about the release; after all, they are only e...

Privacy and the Cloud

Cloud computing provides an opportunity for businesses to lower costs and increase their computing infrastructure’s flexibility. When utilizing a cloud service provider for additional storage, computing power, or a full application you should look into the privacy implications as these are ...

SMB privacy: no free pass

Like larger enterprises, small and medium businesses (SMBs) collect personal information about their customers, employees, vendors and other stakeholders; it is just part of doing business. Establishing an SMB privacy program would be very beneficial for these businesses, but for the majority of ...

Don’t be too quick to publish a privacy notice

Having a privacy notice for customers to review is an essential part of any privacy program. When Delta Airlines added a privacy notice to their mobile app, “Fly Delta”,  to comply with California law, the policy did not reflect reality. When creating a privacy notice you need to say ...

Personal Information From Above

As a child growing up in New York City I always wanted to go to the Macy’s Thanksgiving Day Parade. The floats, the balloons, the clowns, the celebrities, the marching bands, the scraps of personal information….wait…personal information?