Embed Size (px)
DESCRIPTION
Examples of situations that companies face Storage of employee and customer personal data Use of credit reports for employment decisions Use of health data for marketing Technological features required to comply with regulations
Citation preview
Data Security and Privacy Overview and Update
Peter MoldaveOctober 28, 2015
Topics to cover today:
Data SecurityData PrivacyData Integrity Specific Issues with Regulated Data
Examples of situations that companies face
Storage of employee and customer personal data
Use of credit reports for employment decisions
Use of health data for marketingTechnological features required to
comply with regulations
Data security and data privacy are not the same thing
Data security is about protecting data from unauthorized access
Data privacy is about restrictions on collection or use of (personal) information
Data protection may be combination of privacy and security
Data integrity is separate from data security and data privacy
Ensuring data is available and usefulData integrity issues are in some ways
opposite to those of privacy and security
Data Protection RegulationUS has no general (federal) data
protection requirementSpecific US items may need more specific
consideration, i.e. Gramm-Leach-Bliley, HIPAA, COPPA, Fair Credit Reporting, State Data Protection
European rules on data protection are more generalSafe Harbor update
Examples where data security and data privacy issues come up“Normal” companies (i.e. not “internet”)
Employee recordsState data security (SSN’s etc.)
Hiring decisionsState data security & Fair Credit Reporting
Customer relationshipsInformation about EU customers
Services provided to healthcare companiesAre you a “business associate”
Use of on-line resourcesAre your records appropriately protected?
Examples (cont.)“Internet” companies i.e. product
provided over internetObligations regarding customer dataObligations regarding customer’s
customers dataAbility to use data to improve products,
provide services to other than the immediate customer
Obligations regarding method of storage/protection of data
Some terminology to usePersonally Identifiable Information (“PII”)
A data protection (US state law) conceptInformation associated with a particular individualExample definition under Massachusetts data
protection law: Name + account number Personal Health Information (“PHI”)
A HIPAA conceptInformation relating to a health care services
provided to an individualCan including billing information
Terminology (cont.)HIPAA
US federal law regulating health information
Generally covers health care providersCan also extend to “business
associates”Graham-Leach-Blighly
US federal law regulating privacy of financial information
Generally covers financial institutions
Terminology (cont.)Data subject/subject individual
What individual is the data being gathered about
Generic terminology/EU privacy terminology
Aggregated dataData which has been combined so that
it does not reflect any particular individual
Terminology (cont.)
CustomerWhat organization is utilizing the
information supplied by the Content company concerning the data subject
End UserMay be the same as the data subject,
maybe a person at the Customer organization
Terminology (cont.)
EncryptionA method of transforming data so that it
is not immediately readable by an unauthorized third party
Clear textThe original unencrypted data
Rights/Liability
Interests of the content company(Data Privacy) Use restriction obligation
to data subject, source(Data Security) Security protection
obligation to data subject(Data Integrity) Data integrity of
concern to data recipient, not to subject
Rights/Liability (cont.)
Interests of the data subject(Data Privacy) Use restriction obligation
to data subject(Data Security) Security protection
obligation to data subject(Data Integrity) Data integrity not
relevant to subject
Rights/Liability (cont.)
Customer(Data Privacy/IP) Use restriction
obligation to data subject, source(Data Security) Security protection
obligation to data subject(Data Integrity) Data integrity of
concern to Customer
Contractual protection of data is importantProblem areas/issues
Overbroad clausesIndemnificationLiability for events over which you have no
controlConfidentiality clauses; interaction with privacy
policiesAddressing multiple levels of source of data
End user->provider->customer->third party resources
HIPAAWhat is covered: Protected health
information maintained or transmitted electronically (“PHI”)
Who is covered: Covered Entity: includes health plans,
and health care providers who transmits any health information in electronic form
Business Associate: includes non-health care organizations performing services to a Covered Entity involving access to PHI
HIPAA (cont.)What is required: adequate security;
Business Associates Agreements (“BAA”) with Business Associates
What is restricted: Use of PHI other than for provision of health care
What is permitted: use for health care purposes, etc.
What is not covered: aggregated data, de-identified data
Gramm- Leach-Bliley
What is covered: nonpublic personal information about individuals who obtain financial products or services primarily for personal, family or household purposes; but not for business, commercial, or agricultural purposes.
Who is covered: Financial institutions
GLB (cont.)
What is required: develop, implement, and maintain a comprehensive information security program that contains administrative, technical, and physical safeguards to insure the security and confidentiality of customer information. 16 CFR 314.3
Fair Credit Reporting Act
What is covered: “consumer report” communication any information by a consumer reporting agency bearing on a consumer’s credit worthiness, . . . character, general reputation, personal characteristics, or mode of living. 15 U.S.C. § 1681a(d)
FCRA (cont.)
Who is covered: Consumer reporting agencies
What is required: In many cases, consent from data subject; notice upon adverse actions; correction of erroneous information
FCRA (cont.)What is restricted: Use of/access to
credit information for unauthorized reason (i.e. not in connection with credit etc. transaction); maintenance of certain stale or prohibited information. 15 U.S.C. § 1681c
What is permitted: Use for eligibility for credit, insurance or employment purposes with consent of data subject. 15 U.S.C. § 1681b
EU
Expansive view of what is coveredRequirement re destruction/review by
data subjectRestrictions on cross-border usageImpact of recent “Safe Harbor”
decision
State Data Protection LawsOverview
What is covered: Personally identifiable information (“PII”), usually a name or email address plus SSN or financial account number, in general only in electronic form
Who is covered: In general, citizens of the applicable state
What is required: Encryption of electronic PII
What is restricted: In general, unauthorized disclosure of PII
Massachusetts example
What is coveredWhat is requiredWhat is not coveredActions to take on data breach
Data Security
ConsiderationsWhat is the data being utilized?Plan ahead for type/form of data
collectionDefine access controlUnderstand location of content and
encryption strategyUnderstand backup and archivingContingency plan for data breach
What is content used for - internally
Consistency with internal privacy policy
Consistency with regulatory requirements
Consistency with IP rights granted in end user agreements
What is content used for - provider
Consistency with internal and provider privacy policy
Consistency with regulatory requirements
Consistency with IP rights granted in end user agreementsIs aggregate/anonymous use permitted?
What is content used for – provider (cont.)
Performance of serviceMonitoring of serviceOther uses
Creating new productsSelling of aggregate data
Planning ahead for data collection and storageWhere is data stored
Is data for separate projects/separate clients stored in separate “containers”?
How is access controlled (2 factor authentication?)In what form is it stored (encrypted or
unencrypted)Where are encryption keys storedHow is it protected from external access (firewalls
etc.)
Access to Content - Generally
Purpose of accessSecurity of information flow
Agreements with third partiesConformance of theory with reality
Access to Content – Generally (cont.)
Consider regulatory requirements for protection of data
Consider regulatory requirements for agreements (BAA’s etc.)
Consider impact of mobile usage
Access to Content – Generally (cont.)Employees
Implement appropriate internal security policy
Consider whether employee use of own devices is problematic
Access by third partiesImplement appropriate non-disclosure
agreementsMake sure access consistent with
agreements and privacy policy
Subcontractors
Consent over use of subcontractorsVetting of subcontractorsEnsuring contractual provisions flow
properlyMay require use of BAA's for HIPAA data
Dealing with changes to provision
Backups and archivesHow is it archived?
Where is it archived? Is the location acceptable based on general data protection principles?
FrequencySecurity – encrypted vs. non-encrypted
Retention periodWhen can/must it be destroyed
Stop-destruction in case of litigation
Backups and archives (cont.)Make sure document retention policy
and archive process consistentMake sure litigation hold can be
implementedClarify location of dataConsider ability to delete
backups/archives on a client by client/project by project basis
Data Breach
Exposure to liabilityFinancial – identify theft monitoringHIPAA – regulatory actions
Contingency planning for data breach
Understanding regulatory requirement and time frames
Determining types of data being storedEncryption
Arrange insurance for data breachUsually E&OMay be sublimits on notificationPrimary insurance coverage under own
policyAlso coverage under supplier policyName as additional insuredConcern about coverage amount
