Top 5 Privacy Concerns CCO’s Should Care About Data Breaches • What can we do? Plan, Plan, Plan • Not a matter of if but a matter of when … so be prepared • Challenges with

Copyright © 2017 NAVEX Global, Inc. All Rights Reserved. | Page 0

Top 5 Privacy Concerns

CCO’s Should Care About

Presented byCarrie Penman | Chief Compliance Officer & Senior VP, Advisory Services

Amanda L. Gratchner | Global Privacy Officer & Senior Counsel

Copyright © 2017 NAVEX Global, Inc. All Rights Reserved. | Page 1www.navexglobal.com

Presenters

Carrie PenmanChief Compliance Officer & Sr. VP, Advisory Services, NAVEX Global

Global Privacy Officer & Senior Counsel, NAVEX Global

Amanda L. Gratchner


• Privacy: In Brief

• Top 5 Privacy Concerns1. The EU General Data Protection Regulation

2. Data Breaches

3. Sapin II and CNIL

4. Vendors

5. Operational Considerations

Agenda


A (Very) Brief History…


Here’s a little context…Data Privacy: In Brief … Very Brief

• Data Privacy is not really new…

- France

- OECD Guidelines

- EU Directive

- US

• and its spreading…


• US (HIPAA, GLBA)

• Canada

• Australia

• Latin America

• Japan

• Russia

• China

Data PrivacyData Privacy laws are not limited to the European Union

Source: DLA Piper: https://www.dlapiperdataprotection.com


Data Localization

• Russia: Data Localization Law

1 September 2015

Data must be stored and hosted within the Russian Federation

• China: Cybersecurity Law

1 June 2017

Cross-border transfer requirements

Data localization within the borders of China


1. European Union General Data Protection Regulation


The EU General Data Protection Regulation

• Fines: 2%-4% of global annual turnover

• Extra-jurisdictional reach

• Privacy Impact Assessments

• Privacy by Design as default

• Personal Data Breach notification requirement

• Appointment of Data Protection Officer


Key Attributes & Responsibilities of a Privacy Officer

• Guidance on risk assessments/data protection impact assessments

• Flexible and culturally sensitive

• Expert knowledge of the law

• Independence in job function and reporting

• Leadership and project management experience

• Possess a “common touch”

• Be credible

• Can be external


2. Data Breaches


Data Breaches

• What can we do? Plan, Plan, Plan

• Not a matter of if but a matter of when … so be prepared

• Challenges with cross jurisdictional requirements

− Data mapping is crucial; what data do you have, where is it and where does it go

− Vendors


3. Sapin II and CNIL


Sapin II & CNIL Guidance

• Sapin II

− 1 June 2017

− Increase transparency and modernize existing laws in support of anti-corruption initiatives

• CNIL guidance regarding anti-bribery reports

− Realigned AU-004 to Sapin II

− Disclosure of report only to management

− Reinforced

• Anonymity as a “last resort”

• Confidentiality of whistleblower and accused identities


How are global employees actually using the reporting systems?NAVEX Global Benchmarking Results

Source: 2017 Ethics and Compliance Hotline and Incident Management Benchmark Report


Europe receives the highest percentage of anonymous reportsAnonymous Reports by Geography



Anonymous Reports from Europe are Substantiated More FrequentlySubstantiation Rate by Geography



4. Vendors


Vendors

• Vendor Management Programs

• Audits


5. Operational Considerations


Operational Considerations

• Strengthen the bond between Compliance, Security and Privacy

• Include privacy as a component of audits / assessments

• Embed privacy in the development life cycle across the organization (Privacy by Design)

• Encourage privacy discussions and interest across enterprise


Key Takeaways: Advice for Compliance Officers


Key Takeaways: Advice for Compliance Officers

1. Appoint a Privacy Lead (DPO or otherwise)

2. Add Privacy to my committee

3. Understand the scope of your geographic footprint

4. Identify your points of contact

5. Review current audits or assessments


Questions?


Thank You

Documents

Top 5 Privacy Concerns CCO’s Should Care About Data Breaches • What can we do? Plan, Plan, Plan • Not a matter of if but a matter of when … so be prepared • Challenges with