Swiss Re data_privacy_27_01_2016

© 2016 IBM Corporation
Monique Altheim
Jayne Golding
IBM Security Services
January 29th, 2016
The Increasing Risk of Data Privacy On the
Enterprise
Swiss Re - Expert Forum on Cyber Risk

 Data Privacy and Cyber Risk
 Data Privacy must be a priority for your business
 GDPR as a Risk Engine
2/9/2016 IBM Data Privacy Services
Agenda
2

Data Privacy and Cyber Risk
2/9/2016 IBM Data Privacy Services 3

Cyber Risk
Data Security Data Privacy
Scope Crown Jewels (Business Sensitive
Data, Personal Data)
Personal Data
Objective Guaranteeing Confidentiality, Integrity
and Availability (C.I.A.) of the
Organization’s Crown Jewels
 ID Theft Prevention
 Individual Control over Personal
Data
 Protection of Individual’s
Reputation
 Protection of Individual’s Freedoms
Authority  International Industry Standards
(eg. ISO/IEC 27001; ENISA; PCI DSS)
 National Privacy Laws &
Regulations – Personal data (eg.
EU Data Protection Directive)
 National Critical Infrastructure
Legislation (eg. German IT Security
Law 2015; NIS Directive)
 National Laws and Regulations
(eg. The Swiss Federal Data Protection Act)
 National Constitutions
(eg. Art 13 Swiss Federal Constitution)
 Human Rights
(eg. Art. 8, Charter of Fundamental Rights of
the EU)
 Best Practices (ex. ISO 27018; ISO
29100 )
4

Cyber Risk
Scope
Data Security
Business Sensitive Data Personal Data
Data Privacy
Personal Data
5

Cyber Risk
Data Security Data Privacy
Principles Organizational, Technical and
Physical Controls; mostly as per
Industry Standards:
Some Examples:
 Security Policy
 Incidence Response Plan
 IAM (Identity and Access
Management)
 SIEM (Security Information
and Event Management)
 Firewalls
 Encryption
 Locks, guards, video
surveillance
 Collection Minimization
 Transparency
 Notice, Choice, Consent
 Purpose Specification
 Use Limitation
 Data Security
 Access, Rectification and Erasure
Rights of Data Subjects
 Retention Periods
 3rd Party Vendor Requirements
 Cross-border Export Restrictions
 Cross-border Access Restrictions
 Data Breach Notification
6

Data Privacy
Security Other Privacy Principles
Cyber Risk
Principles
7

Mexico
Federal Law on the
Protection of Personal Data
US Federal
HIPAA, GLBA, COPPA, CAN-
SPAM, Do Not Call, Safe
Harbor Principles; Possible
Cybersecurity Legislation,
Student Privacy Legislation;
California Requirements
Argentina
Personal Data Protection
Act of 2000, Confidentiality
of Information Law
Chile
Law for the
Protection of
Private Life
South Africa
The Protection of
Personal
Information Act
2013 (POPIA)
Canada
PIPEDA and
Provincial
Privacy Laws
Switzerland
Federal Act
on Data
Protection
Dubai
Data Protection Act 2007
United Kingdom
UK Data Protection Act 1998
European Union
EU Data Protection Directive.
Imminent adoption of the General
Data Protection Regulation (GDPR)
Russia
Federal Law of July
27tth 2006 No 152-FZ
on personal data
Australia
Amended Privacy Act
and Spam Act
Japan
Personal Information
Protection Act (PIPA)
South Korea
Personal Information
Protection Act 2011
(PIPA)
India
Information
Technology
Act of 2000
Philippines
Data Privacy Act
2012
Comprehensive data protection law enacted
Pending effort or obligation to enact law
No comprehensive law
Singapore
Personal Data
Protection Act
2012 (PDPA)
China - New
Data Protection
Requirements
HIPAA: Health Insurance Portability and
Accountability Act
GLBA: Gramm Leach Bliley Act
COPPA: Children Online Privacy Protection Act
CAN-SPAM: Controlling the Assault of Non-
Solicited Pornography And Marketing Act
Source: http://dlapiperdataprotection.com/#handbook/world-map-section/c1_SG
Nearly 100 countries around the world have adopted data protection
and privacy laws
Selected Comprehensive Data Protection/Privacy Laws and Bills as of 1/2016
8

Cyber Coverage Overview
Security Breach - Non
Privacy
Privacy Breach - Security
and Non-Security
First Party
Coverage
 Forensic Investigation
 Business Interruption
 Data Loss/Destruction
 Cyber extortion
 Business Interruption
 Data Loss/Destruction
 Cyber extortion
Privacy-Security Breach - Additional
Coverage:
 Data Breach Notification Costs
 Credit Monitoring of Customers
Third Party
Coverage
 Legal Defense
 Settlements, Damages and
Judgments
 Legal Defense
 Settlements, Damages and
Judgments
 Regulatory Fines and Penalties
9

Data Privacy must be a priority for
your business

1. Increase in collection and storage of personal data (what you don’t have cannot be
breached) - Big data & data analytics, Internet of Things - esp. IoT consumer products ex. Smart homes
2. Loss of control over data and devices - Outsourcing of processing of personal information to service
providers (Cloud), BYOD
3. Globalization of the economy - Global personal data transfers
3. Increase in global privacy legislation eg. GDPR
4. Increase in cyber attacks
Recent trends that have increased privacy liability risk
11

Netdiligence 2015 Cyber Claims Study
Study of Cyber Insurance Claims as a result of data breaches that occurred between 2012 –
2015; (data set 160 cyber claims; numbers are “payouts-to-date”)
 Personal data was the most frequently exposed data – 86% (includes PII, PHI, PCI)
 Average claim per record: $964.31; Median claim per record: $13
 Total Claims spent on:
 Crisis Services: 78%
– Forensics
– Data breach notification
– Credit/ID monitoring
– Legal guidance
– Public relations
• Legal Defense: 8%
• Legal Settlement: 9%
• Regulatory Defense: 1%
• Regulatory Fines: 1%
• PCI Fines: 3%
Numbers
Source: http://www.netdiligence.com/downloads/netdiligence_2015_cyber_claims_study_093015.pdf
12

General Data Protection Regulation as a
Risk Engine
Is your enterprise prepared?

The new General Data Protection Regulation (GDPR) has arrived!
 New European Union General Data Protection
text was finalized in December of 2015
 New rules will be formally adopted in early
2016 and will be applicable in 2018 to any
organization which operates in the EU market
 GDPR will fundamentally change the way
companies must manage their data
The majority of companies are not ready for
the new privacy requirements of the GDPR

 Unlike the existing 1995 Data Protection Directive (95/46/EC), the Regulation will create a
unified data protection law for all 28 European Countries.
– It will also have international reach - applying to organizations that handle personal data of any EU
resident (data subjects)
 The objectives of the GDPR are twofold:
– To enhance the level of personal data protection for EU residents
– To modernize the law in line with existing and emerging technologies (e.g. social networks and cloud
computing) and to clarify responsibility for the handling and storage of data, making it easier for
organizations to comply and avoid fines.
Key Aspects of the New General Data Protection Regulation
Non-compliance could lead to regular and periodic audits and/or a fine of € 20 million or
4% of the company’s annual worldwide turnover, whichever is greater

 Expansion of Applicability of EU Privacy
Framework
 Data Breach Notification Requirement
 Privacy by Design, Privacy by Default
 Privacy Impact Assessments
 Data Privacy Officers
 Expansion of Obligations of Data
Processors
 Major Increase of Fines
Major Changes
16

 Understand your obligations
– Become familiar with the proposed GDPR requirements and monitor its development
 Know what data you have and where it is located
– Conduct a data inventory and mapping initiative to assist in understanding and evaluating the
operational and technological changes required for compliance
 Appoint a Data Protection Officer
– Create a structured privacy office and appoint, at minimum, a data protection officer (DPO) who has
expert knowledge on data protection law
 Review all privacy notices
– Confirm all privacy notices are presented in clear and plain language and are transparent and easily
accessible to data subjects.
 Review customer consent and choice mechanisms
– Ensure that the appropriate consent and choice mechanisms are in place and/or are updated to meet
the express consent requirements and to easily facilitate customer choice (e.g. Right to Erasure,
Portability)
GDPR Readiness – Understand your risk
17

 Implement a Privacy By Design approach to new systems and services
– Create a Privacy By Design framework to ensure that privacy requirements are embedded, by default
and design, from the very outset of the development of new systems and services.
 Document your privacy compliance activities
– Adequately document all processing operations involving personal data through the use of Data
Privacy Impact Assessments (DPIAs)
 Implement and document appropriate security measures
– Provide technical, physical and administrative security measures 'appropriate' to the risks identified by
DPIAs
 Create breach response and notification protocols
– Implement data breach investigation, containment and response processes and procedures, and be
sure to test their effectiveness
 Develop audit capabilities and processes
– Establish a robust audit plan and process to monitor ongoing compliance and to mitigate risk
GDPR Readiness – Mitigate your risk
18

 Review all cross border data transfers
– Confirm that you have a legitimate basis for transferring data to jurisdictions outside the EU that do not
have adequate data protection regulations
 Assess external contracts, both as a controller and/or as a processor
– Determine whether contractual obligations need to be amended to reflect any changes in services
and/or costs in in line with the enhanced responsibilities on controllers and processors
 Train your employees
– Create training programs to educate employees on their obligations when accessing or processing
personal data.
 Make sure the appropriate budgets are in place to support the changes
– Prepare to invest in data protection
GDPR Readiness – Mitigate your risk
Be proactive!
Build a robust, auditable, privacy compliance program to manage GDPR compliance
and to reduce risk

Questions?

© 2016 IBM Corporation2/9/2016 IBM Data Privacy Services
IBM Data Privacy Services Contacts
Monique Altheim
Global Privacy Managing
Consultant
malthei@us.ibm.com
1-347-628-1479
Jayne Golding
European Privacy Lead
jgoldin1@uk.ibm.com
+44 7584 202302
21

Information concerning non-IBM products was obtained from the suppliers of those
products, their published announcements or other publicly available sources. IBM has
not tested those products in connection with this publication and cannot confirm the
accuracy of performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the suppliers
of those products. IBM does not warrant the quality of any third-party products, or the
ability of any such third-party products to interoperate with IBM’s products. IBM
EXPRESSLY DISCLAIMS ALL WARRANTIES, EXPRESSED OR IMPLIED,
INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
The provision of the information contained herein is not intended to, and does not, grant
any right or license under any IBM patents, copyrights, trademarks or other intellectual
property right.
Other company, product, or service names may be trademarks or service marks of
others. A current list of IBM trademarks is available at “Copyright and
trademark information” www.ibm.com/legal/copytrade.shtml
Copyright © 2016 by International Business Machines Corporation (IBM). No part of this
document may be reproduced or transmitted in any form without written permission from
IBM.
U.S. Government Users Restricted Rights – Use, duplication or disclosure restricted by
GSA ADP Schedule Contract with IBM.
Information in these presentations (including information relating to products that have
not yet been announced by IBM) has been reviewed for accuracy as of the date of initial
publication and could include unintentional technical or typographical errors. IBM shall
have no responsibility to update this information. THIS document is distributed "AS IS"
without any warranty, either express or implied. In no event shall IBM be liable for any
damage arising from the use of this information, including but not limited to, loss of data,
business interruption, loss of profit or loss of opportunity.
IBM products and services are warranted according to the terms and conditions of the
agreements under which they are provided.
Any statements regarding IBM’s future direction, intent or product plans are subject to
change or withdrawal without notice. Performance data contained herein was generally
obtained in a controlled, isolated environments. Customer examples are presented as
illustrations of how those customers have used IBM products and the results they may
have achieved. Actual performance, cost, savings or other results in other operating
environments may vary. References in this document to IBM products, programs, or
services does not imply that IBM intends to make such products, programs or services
available in all countries in which IBM operates or does business.
Workshops, sessions and associated materials may have been prepared by independent
session speakers, and do not necessarily reflect the views of IBM. All materials and
discussions are provided for informational purposes only, and are neither intended to,
nor shall constitute legal or other guidance or advice to any individual participant or their
specific situation.
It is the customer’s responsibility to insure its own compliance with legal requirements
and to obtain advice of competent legal counsel as to the identification and interpretation
of any relevant laws and regulatory requirements that may affect the customer’s business
and any actions the customer may need to take to comply with such laws. IBM does not
provide legal advice or represent or warrant that its services or products will ensure that
the customer is in compliance with any law.
Legal notices and disclaimers

Swiss Re data_privacy_27_01_2016

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (20)

More from AltheimPrivacy

More from AltheimPrivacy (12)

Recently uploaded

Recently uploaded (20)

Swiss Re data_privacy_27_01_2016