Getting to Accountability Karbaliotis and Patrikios-Oct 22 2015

Copyright © 2015 by Nymity Inc. All rights reserved | WWW.NYMITY.COM
Getting to Accountability
Maximizing your Global Privacy Management Program
Privacy & Security Forum, Washington DC - October 22, 2015

Introductions
CONSTANTINE KARBALIOTIS
CIPM, CIPP/C, CIPP/E, CIPP/US, CIPT
Vice President of Privacy Office Solutions – NYMITY
and former CPO
ANTONIS PATRIKIOS
PhD, CIPM, CIPP/E
Partner - Privacy, Security & Information Law, Fieldfisher

“an obligation or willingness to accept responsibility
or to account for one's actions “
www.merriam-webster.com/dictionary/accountability
“the obligation of an individual or organization to account for its activities,
accept responsibility for them,
and to disclose the results in a transparent manner”
www.businessdictionary.com/definition/accountability.html
Accountability Defined

Evolution as a Privacy and Data Protection
Principle
4
Guidelines on the
Protection of Privacy
and Transborder
Flows of Personal
Data
Article 29 Data
Protection
Working Party
Opinion
3/2010 on the
Principle of
Accountability
PIPEDA
Schedule 1 4.1
Principle 1:
Accountability
U.S. Federal
Trade
Commission
Enforcement
Actions
APEC Privacy
Framework
Canada: Getting
Accountability Right
With a Privacy
Management Program
OECD
Revised
Guidelines
Columbia: Guide for the
Implementation of Accountability
in Organizations
EU: General
Data Protection
Regulation
Hong Kong: Privacy
Management
Programme Best
Practice Guide
Australia:
Privacy
Management
Framework
EU: General
Data Protection
Regulation
1980 2000 2005 2010 2011 2012 2013 2014 2015

New kid on the block: Accountability à la européenne
• Obligations for data “controllers” and data “processors”
• Apply to any company that offers goods or services, or monitors the
behavior of, EU residents
• Not enough to be compliant, also be able to evidence compliance
• As a minimum, this requires:
– keeping extensive documentation and records;
– implementing data security requirements;
– performing data protection impact assessments (DPIAs) in
certain cases;
– prior authorisation / consultation with the supervisory
authority in certain cases; and
– compulsory designation of a Data Protection Officer in certain
cases.

FTC – Elements of a Comprehensive Privacy Program
• FTC has stated that the Google Order is intended to “serve as a guide”
to industry
 Facebook Order similar
• Requirement to establish and maintain a comprehensive privacy
program:
 Designate an employee to be responsible for the privacy program
 Identify reasonably-foreseeable, material risks
 Design and implement reasonable privacy controls and procedures
 Regularly test or monitor the effectiveness of the safeguards’ key
controls and procedures
 Manage third-party risk through due diligence and contractual
obligations
 Evaluate and adjust privacy program on an ongoing basis

Compliance – an Outcome of Accountability
“An accountable organization must have in place appropriate policies
and procedures that promote good practices which, taken as a whole,
constitute a privacy management program. The outcome is a
demonstrable capacity to comply, at a minimum, with applicable
privacy laws.”
The Office of the Privacy Commissioner of Canada (OPC), and the
Offices of the Information and Privacy Commissioners (OIPCs) of
Alberta and British Columbia
https://www.priv.gc.ca/information/guide/2012/gl_acc_201204_e.pdf

Accountability and Compliance
The evolving privacy landscape
COMPLIANCE ACCOUNTABILITY
SHIFT
TOWARD
Privacy Program Outcomes Privacy Program Infrastructure
 Laws and regulations
 Enforcement actions
 Binding Corporate
Rules
 Responsibility
 Ownership
 Evidence
• Moving beyond simple compliance means a capacity to meet regulatory
changes
• Accountability means doing things that yield the right results

Compliance on a global scale. Is it possible?

UK Data Protection
Act
 Rule 4
 Rule 1
 Rule 2
 Rule 3
 Rule 5
Binding Corporate
Rules
 Rule 1
 Rule 2
 Rule 3
 Rule 4
 Rule 5
EU General Data
Protection Reg.
 Rule 1
 Rule 2
 Rule 3
 Rule 4
 Rule 5
Hong Kong
Ordinance
 Rule 1
 Rule 2
 Rule 3
 Rule 4
 Rule 5
Mexico Data
Protection Act
 Rule 1
 Rule 2
 Rule 3
 Rule 4
 Rule 5
Traditional Compliance Assessment Approach
Assess compliance with each requirement individually
PHI Policies & Procedures
Audit and Monitoring
Many Regulatory Requirements Many Privacy Programs & Activitiesto
Training and Awareness
Company Policies and
Procedures
Complaints and Investigations
Records Management
Information Security
Vendor Management
Human Resources
Legal

Fieldfisher’s principles of global privacy regulatory risk
1. The increasing value and production of data will inevitably
lead to more, and stricter, regulation.
2. Technology will always evolve, and sometimes disrupt.
3. Law and regulation will never catch up with technology.
4. Technology is global. Law and regulation are not.
5. So technology will never stay in compliance with law and
regulation.
6. The risk for businesses will increase.
7. Privacy regulators are resource-limited and cannot enforce
all the regulations they create.
8. The perceived impossibility of compliance will give rise to a
degree of tolerated non-compliance.

Fieldfisher’s principles of risk-based approach to compliance
1. Transnational, principle-based, accountable approach
2. Don’t cross the red lines
3. Risk of harm to individuals v benefit for individuals
4. Transparency is key - no surprises
5. Choice (consent when required by law)
6. Proportionality
7. Security
8. Manage the flashpoints: incident response; access requests
and other data subject rights; complaints; dispute resolution
9. Be prepared to justify and evidence your approach

Accountability Based Approach
Leverage evidence of accountability to demonstrate compliance
Evidence of Privacy Management Activities
exists throughout the organization (within the
Privacy Program as well as Operations)
Evidence is collected in a centralized
repository, structured in line with the 13
Privacy Management Processes
Evidence of
Accountability is
mapped to
requirements,
allowing the
organization to
Demonstrate
Compliance
with laws and
regulations
on-demand,
supported by
Evidence
UK Data Protection
Act
 Rule 4
 Rule 1
 Rule 2
 Rule 3
 Rule 5
Binding Corporate
Rules
 Rule 1
 Rule 2
 Rule 3
 Rule 4
 Rule 5
EU General Data
Protection Reg.
 Rule 1
 Rule 2
 Rule 3
 Rule 4
 Rule 5
Hong Kong
Ordinance
 Rule 1
 Rule 2
 Rule 3
 Rule 4
 Rule 5
Mexico Data
Protection Act
 Rule 1
 Rule 2
 Rule 3
 Rule 4
 Rule 5
One Accountable Privacy Program Many Regulatory Requirementsto

x = Law/regulation contains compliance requirements related to the Privacy Management Process
Accountability Goes Above and Beyond Compliance
Accountability Compliance
Privacy Management Processes BCR UK South Korea Mexico
1 Maintain Governance Structure X X X X
2 Maintain Personal Data Inventory X X X X
3 Maintain Data Privacy Policy X X X X
4 Embed Data Privacy into Operations X X X X
5 Maintain Training and Awareness Program X X X
6 Manage Information Security Risk X X X X
7 Manage Third-Party Risk X X X X
8 Maintain Notices X X X X
9 Maintain Procedures for Inquiries and Complaints X X X X
10 Monitor for New Operational Practices X X
11 Maintain a Data Privacy Breach Management
Program
X X
12 Monitor Data Handling Practices X X
13 Track External Criteria X

Nymity’s Accountability Approach
https://www.nymity.com/getting-to-accountability.aspx
Nymity Accountability Status Workbook
Nymity Privacy Management Accountability Framework™
Privacy Management Processes and Activities
Status Owner(s)
Resources to
Implement
Resources to
Maintain
Business
Case
Core?
(Y/N)
Description/
Comment
Evidence
8. Maintain Notices
Maintain notices to individuals consistent with the data
privacy policy, legal requirements, and operational risk
tolerance
Maintain a data privacy notice that details the organisation’s
personal data handling policies
Implemented Privacy Office Compliance Y Privacy Notice
Provide data privacy notice at all points where personal data is
collected
Implemented Business Units Identify all forms
and contracts
that collect
personal data
Compliance Y PIA Guidelines,
Templates
Provide notice by means of on-location signage, posters N/A
Provide notice in marketing communications (e.g. emails, flyers,
offers)
Implemented Marketing Compliance Y
Provide notice in all forms, contracts and terms Desired Business Units Periodically
review. Have a
process for new
forms.
Compliance Y Marketing Guidelines
Maintain scripts for use by employees to provide the data privacy
notice
Desired Privacy Office Process update
from Customer
Service/ Call
Centre Team
Risk
Management
N Sample Language
Maintain a data privacy notice for employees (processing of
employee personal data)
N/A Scripts
Maintain a privacy Seal or Trustmark to increase customer trust N/A Call Centre Work Flow
Provide data privacy education to individuals (e.g. preventing
identity theft)
Implemented Business Units Alignment with
Business
Objectives
N Web Application
Content

Accountability as a Framework for Privacy & Security
• For security, a basis for
‘talking’ to privacy
– Activities focused
– CIA+A – accountability
• Provides a structure for
linking security and privacy
organizations
• Increasingly important as
part of joint goal of security
and privacy to get
organizational
accountability for data
protection

Privacy Management Program Strategies

Documentation as Evidence
• The documentation to be
used as evidence already
exists: documentation is a
by-product of
implemented privacy
management activities.
• You don’t create evidence
just for the sake of
demonstrating
accountability/
compliance. You just
identify and log the
evidence that already
exists.
Privacy Management
Activities
Evidence/ Documentation
Maintain a data privacy
policy
Data Privacy Policy
Integrate data privacy into e-
mail monitoring practices
E-mail monitoring policy and
procedure
Measure comprehension of
data privacy concepts using
exams
System generated report of
data privacy exam scores
Provide notice in all
marketing communications
(e.g. emails, flyers, offers)
Examples of e-mail marketing
communications

Planning: Selection and Prioritization of Activities which
demonstrate Accountability
Compliance with Laws
and Regulations
Privacy Risk Management Select Activities Based on
Business Objectives
Prioritize Based on
Resources
Understanding
Expectations from
Privacy and Data
Protection Regulators
Understanding the Law
• Risk of harm to the individual
data subject
• Risk of enforcement due to
non-compliance or
complaints
• Risk of unauthorized use of
personal data
• Risk of loss to the
organization
• Risk of breach due to stolen
data
• Risk of misuse of personal
data
• Risk of class-action lawsuit
• And others (see page 48)
Align privacy management
program strategy with
organizational objectives such
as:
• Global expansion goals
• Moving to paperless
record keeping
• Mergers and acquisitions
• Competitive advantage
• Product innovation
• Cloud computing
• Others?
• Determine your
resource profile
• Leverage existing
resources
• Prioritize what
can be
supported
• Prioritize what
can be
maintained

Use case
• You are the CPO of a US data analytics company with a global
customer base.
• Following the invalidation of the EU- US Safe Harbor by the
CJEU, the business has come under intense pressure by its EU
customers and prospects to provide an alternative solution.
• Negotiations on new deals have frozen and a key client has
said they will not commission new projects unless your
company can keep their data in the EU.
• Your CEO wants to hear the plan of action this evening.
• Use the Nymity workbook to solve the problem.

Application of Accountability Approach: Service Provider
2. Maintain Personal Data Inventory Status Owner(s)
Core?
(Y/N)
Resources to
Implement
Resources to Maintain Business Case Evidence
Maintain an inventory of key personal
data holdings (what personal data is
held and where)
Desired Records
Management
Y Internal
FTE/External
Consultant,
technology to
survey or scan
Internal FTE/External
Consultant, technology to
survey or scan
Risk identification &
mitigation; compliance;
Prerequisite to other
activities
Inventory
Classify personal data holdings by type
(e.g. sensitive, confidential, public)
Implement-
ed
Risk &
Compliance
Y Internal FTE Internal FTE Supports business
processes; risk
mitigation; contract
Data Classification Policy
Sample documents
Obtain approval for data processing
(where prior approval is required)
N/A
Register databases with data
protection authority (where registration
is required)
N/A
Maintain flow charts for key data flows
(e.g. between systems, between
processes, between countries)
Desired Information
Technology
Y Internal FTE,
technology to
survey or scan
Internal FTE, technology to
survey or scan
mitigation; prerequisite
to other activities
Flow Charts
Maintain documentation for all cross-
border data flows (e.g. country,
mechanism used as a basis for the
transfer such as Safe Harbor, model
clauses, binding corporate rules, or
approvals from data protection
authorities)
Desired Information
Technology
Y Internal FTE,
business processes
Internal FTE, business
processes
mitigation; prerequisite
to other activities
Data Transfer Agreements
(model clause);
Use Binding Corporate Rules as a data
transfer mechanism
N/A
Use Standard Contractual Clauses as
a data transfer mechanism
Implement-
ed
Legal Y Research
subscriptions,
internal FTE
Research subscriptions,
internal FTE
Compliance; contract Templates
Procedural documents
Repository of contracts
Use Cross-Border Privacy Rules as a
data transfer mechanism

Application of Accountability Approach: EU based customer
2. Maintain Personal Data Inventory Status Owner(s)
Core?
(Y/N)
Resources to
Implement
Resources to Maintain Business Case Evidence
Maintain an inventory of key personal
data holdings (what personal data is
held and where)
Desired Records
management /
privacy function
Y Internal FTE
External consultant
Technology
Internal FTE
External consultant
Technology
Understanding of
information assets;
Risk mitigation;
Compliance;
Prerequisite
Inventory
Classify personal data holdings by type
(e.g. sensitive, confidential, public)
Implemente
d
Privacy function
Legal; Risk &
Compliance
Y Internal FTE Internal FTE Understanding of
information assets;
Exploitation; Risk
Data classification policy
Obtain approval for data processing
(where prior approval is required)
N/A
Register databases with data
protection authority (where registration
is required)
Implemente
d
Privacy function
Legal;
Y Internal FTE Internal FTE Compliance DPA registration certificate
Maintain flow charts for key data flows
(e.g. between systems, between
processes, between countries)
Desired Privacy function;
Information
Technology
Y Internal FTE
Technology
Internal FTE
Technology
mitigation; data
security; Prerequisite
Flow charts
Maintain documentation for all cross-
border data flows (e.g. country,
mechanism used as a basis for the
transfer such as Safe Harbor, model
clauses, binding corporate rules, or
approvals from data protection
authorities)
Desired Privacy function
Legal;
Y Internal FTE
External Legal
Internal FTE
External Legal
mitigation; Compliance
Prerequisite
PIA Report; Data Processing
Agreements (Model Clauses)
Use Binding Corporate Rules as a data
transfer mechanism
Legal;
N Internal FTE
External Legal
Internal FTE
External Legal
Data exploitation;
Compliance
BCR business case; BCR Gap
Analysis; BCR documentation
Use Standard Contractual Clauses as
a data transfer mechanism
Legal;
Y Internal FTE
External Legal
Internal FTE
External Legal
Data exploitation;
Compliance
Data Processing Agreements
Use Cross-Border Privacy Rules as a
data transfer mechanism

Conclusions
• Accountability yields a capacity to meet compliance and program
objectives that is inherently more flexible and powerful than ‘mere’
compliance
• Accountability is determined by what the organization prioritizes
and resources – not by an external standard of ‘what ought to be’
• Accountability helps the organization by ‘getting credit’ for
establishing a framework to yield the right results – even where
there are individual failures, it can be demonstrated they are not
systemic
• Accountability provides a common framework, language for
security and privacy professionals to enhance their respective
programs
• Accountability is therefore the main tool for taking a global risk-
based approach to privacy and data protection compliance

Getting to Accountability Karbaliotis and Patrikios-Oct 22 2015

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Getting to Accountability Karbaliotis and Patrikios-Oct 22 2015

Semelhante a Getting to Accountability Karbaliotis and Patrikios-Oct 22 2015 (20)

Mais de Constantine Karbaliotis

Mais de Constantine Karbaliotis (7)

Último

Último (20)

Getting to Accountability Karbaliotis and Patrikios-Oct 22 2015