Privacy is more of a priority than ever. With new, heavy-hitting regulations being introduced nationally and globally (such as GDPR and CCPA), as well as news about high-profile data breaches and mishandling of private information by companies, it’s not hard to see why. The key to a successful privacy program is to manage your information throughout its lifecycle with strong governance rooted in policy. In this presentation, learn about the tools, strategies, and techniques public and private organizations are using to identify, manage, and dispose of personal data.

2. Building Your Foundation:
Strategies and Tools for Managing
Retention and Personal Data Risks
May 2, 2019
©2019 Iron Mountain Incorporated. All rights reserved. Iron Mountain and the design of the mountain are registered trademarks of Iron Mountain Incorporated in the U.S. and other countries. All other trademarks and registered trademarks are the property of their respective owners.

3. Speaker Information
Kelly Matoney, JD/MBA/CIPM
Principal & Practice Leader
Iron Mountain
Moderator & Panelist
Carole LaRochelle, MLIS/CIPM
Information Governance & Records
Administrator, PGA TOUR
Panelist
Shannon R. Dahn, MPP/CIPP/G
Privacy Section Chief, Office of the
Chief Information Security Officer
Federal Deposit Insurance Corporation
Panelist

4. Agenda
I. Welcome and Introductions
II. The Information Challenge
III. Strategies & Tools for Developing Personal Data Inventory & Data Maps
IV. Assessing Risks & Prioritizing Data Remediation Activities
V. Solutions for Managing Records to Meet Data Retention & Disposal Obligations
VI. Questions and Answers
VII. Closing Remarks

5. The Information Challenge

6. The Information Challenge
2004
Legal dept drafts records
policy & retention schedules
1920s
Tournament
golf developed
1950s-1960s
Operated as part
of PGA of America
1968
PGA TOUR becomes
separate entity
1980s
Records are born;
Stadium Golf &
Tournament Players
Clubs network
1980s-
Paper records managed
by Facilities & Legal
Librarian
2003
Scanning of paper
records into homegrown
repository
2020
New
headquarters
2013
2016
Hurricane
Matthew
2018
GDPR

7. NEW PGA HEADQUARTERS

8. Ways records are held
The Information Challenge
Hard-copy historical records
Mainframe systems
Unstructured data
Modernizing IT

9. The Information Challenge
Finding the right balance

10. How Do You Know:
What you have? Where is it? Who’s data is it? What rights do
they have?

11. DISPOSE/
RECYCLE
ENABLE
RESTORATION
AND DISASTER
RECOVERY
SECURELY STORE
AND ACCESS
LEVERAGE
INTELLIGENCE &
INSIGHTS
DIGITIZE/CONVERT/
MIGRATE
INTEGRATE
WORKFLOW/BPM
APPLY RETENTION,
PRIVACY &
CLASSIFICATON
CREATE
CONTENT
POLICY &
GOVERNANCE
DIGITAL & PHYSICAL
Your Information
Lifecycle

12. POLICY &
GOVERNANCE
DIGITAL & PHYSICAL

13. What is a Record and PII?

14. Assess Internal/External Environments
Deep-dive assessment of departments’
records processing activities
Updated vendor agreements

15.  Revised privacy policy
 Enterprise Privacy Framework
 Implement Resources – ongoing
web training KnowBe4
 Standardize Data Protection
& Compliance
Update/Implement Policies & Tools

16. • Formed a grass-roots working group, RISC
• Explained impact of failure to comply
• Socialization & Education
Employee Engagement

17. Compliance Program

18. Existing Law & Policy
Requirements
Leverage the Current Environment
Chief Data Officer
Requirement

19. Existing Record
Job Aids
Employee Engagement
Data Clean-up
Days
General Employee
Awareness Campaigns

20. Create a Unified View of Your
Personal Data and Related Obligations
SHOW CONNECTIONS VISUALLY
THROUGH DATA FLOW MAPS
CONNECT CRITICAL INFORMATION
ABOUT YOUR PERSONAL DATA

21. POLICY &
GOVERNANCE
DIGITAL & PHYSICAL

22. • Focus on consumer data
• Outside consultant to perform
GDPR risk analysis/gap assessment
• Data inventory assessment
of 34 internal groups
Assess Risks

23. Personally Identifiable Information
Fair Information Practice Principles
• Minimization
• Accountability and Auditing
• Individual Participation
Evolving NIST Risk Management Framework
Emphasis on reducing risk to PII
Focus on PII

24. Risk Map
Source:
https://www.cnil.fr/sites/default/files/typo/docu
ment/CNIL-ManagingPrivacyRisks-Methodology.pdf

25. POLICY &
GOVERNANCE
DIGITAL & PHYSICAL

26. Retention Solutions
• Records Management Policy resurrected,
reviewed, revised, finalized
• Incorporate 3 main concepts of Records Management
• Addressed electronic documents management
• Introduced email classification/etiquette
• Restructured IT department

27. Iron Mountain® Policy Center Solution

29. Privacy Programmatic Approach Options

30. Reduce Costs & Risks
Most information is needlessly
retained far beyond retention
requirements.
Over-retained information is a liability and
racks up costs
They can’t hack what
you don’t have.
Get rid of what you legally can to
protect yourself from data breaches
Having a current retention schedule and sticking
to it consistently will help you:
• reduce risk (regulatory, legal, financial,
operational, AND reputational)
• save on storage and legal discovery costs
• satisfy audits and regulatory inquiries
• defend your program in legal and litigation matters
Retention Schedule
= Foundation for
Consistency

31. The Advantage of Managing
Privacy and Retention Together
Increasing privacy concerns and regulations like the
GDPR are elevating the need for privacy and retention
to be managed together so you can:
 Have a unified view of your personal data
and related obligations
 Dispose of private information as soon as possible
 Reduce unnecessary exposure to data breaches

32. Top Tips
• Information Lifecycle Management is more important than ever to address
privacy concerns
• Define what a record is to your company
• Consider working with a consultant and leveraging technologies
• Retention and privacy must be managed together
• Employee engagement is imperative for your privacy program

33. Connect With Us
Follow #peakofprivacy and @IronMountain
Connect with the speakers:
• Kelly Matoney, Privacy Principal & Practice Leader, Iron Mountain
• Carole LaRochelle, Information Governance & Records Administrator, PGA TOUR
• Shannon Dahn, Privacy Section Chief, FDIC

34. QUESTIONS & ANSWERS

35. Iron Mountain® Policy Center Solution
Iron Mountain® Privacy Advisory Service
www.ironmountain.com/dataprivacy
Resources

36. How Did Things Go?
(We Really Want To Know)
Did you enjoy this session? Is there any way we could make it better?
Let us know by filling out a speaker evaluation.
Start by opening the
IAPP Events App
Select this session and
tap “Rate the Session”
Once you’ve answered
all three questions, tap
“Done” and you’re all set
1 2 3

37. THANK YOU
©2019 Iron Mountain Incorporated. All rights reserved. Iron Mountain and the design of the mountain are registered trademarks of
Iron Mountain Incorporated in the U.S. and other countries. All other trademarks and registered trademarks are the property of
their respective owners.