Patrick Lo Slides: On January 28, 2016, Canada, along with many countries, will celebrate Data Privacy Day. Recognized by privacy professionals, corporations, government officials, academics and students around the world, Data Privacy Day highlights the impact that technology is having on our privacy rights and underlines the importance of valuing and protecting personal information. MaRS Discovery District and Privacy Horizon have teamed up to offer this special program for entrepreneurs and startup companies. Learn what you need to know to turn privacy into a competitive advantage.

1. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
Data Privacy Day:
The Start-­‐up’s Guide to Privacy
January 28th, 2016
J A N U A R Y 2 0 1 6

2. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
1. Why invest in privacy?
2. What do I need to do?
– Understand the LegislaQve Landscape
– Develop a Privacy Management Program
• AccountabiliQes
• Risk Management
• Privacy OperaQons
3. Where can I get more informaQon?
Agenda
September
2014

3. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com

4. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
• Know what privacy laws apply to you and your customers:
– Business Models:
• Business to Business
• Business to Consumer
– JurisdicQons:
• Ontario
• Canada
• U.S.
• World
LegislaQve Landscape

5. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
Privacy
Program
Governance
and
Accountability
Privacy
Operations
Privacy Risk
Management
Develop a Privacy Management Program

6. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
Privacy Risk Management
• Privacy Impact Assessment
– IdenQfy Privacy Gaps
– MiQgate Privacy Risks (Admin. &
Tech.)
– Consists of:
• Authority
• Data Flow (CollecQon, Use and
Disclosure)
• Assessment
• MarkeQng Tool

7. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
• Appoint a privacy officer
• Create Privacy Policies
• Confiden6ality Agreements
• Privacy and Security Awareness Training
• Create a culture of privacy
Governance and Accountability

8. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
Appoint a Privacy Officer
• PosiQon will depend on size and complexity of
organizaQon
– Large organizaQon – dedicated privacy
person
– Small organizaQon – assigned to someone
with other responsibiliQes
• Must have the authority and resources needed
to deal with privacy issues

9. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
Privacy Policies
• Overarching privacy policy
• Privacy statement suitable for the
public and published in a brochure or
on website
• OperaQng policies addressing major
privacy issues such as consent,
disclosure, client access

10. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
Confiden6ality Agreement
• Make everyone who handles personal
informaQon sign a confidenQality
agreement.
• Ensure that they understand their
obligaQon to keep personal informaQon
confidenQal and the consequences of
breaching customer privacy.

11. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
Privacy and Security Awareness Training
• Security and Privacy Awareness training for all
staff who have access to personal informaQon
• Specialty training for privacy officers, app
developers
• Consider different approaches:
– Classroom style
– Videos
– Computer-­‐based training

12. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
Culture of Privacy
• Make privacy a core value
• Privacy is good for business
• Promote secure behaviors
• Senior Management must lead by
example

13. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
Privacy OperaQons
• Incident/Breach Management
• Consent Management
• Individual Access & CorrecQon
• Complaints & Inquiries

14. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
Be ready for a Privacy Breach
• Privacy Incident: Unauthorized or illegal
access to, or use, collecQon, disclosure
or disposal of personal or personal
health informaQon. A privacy incident
results from a privacy breach.

15. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
Consent Management
• Obtain Consent
• Withdrawing Consent
• Overriding a Consent DirecQve
• ReinstaQng Consent

16. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
www.privacyhorizon.wikispaces.com
Privacy and Security Links
Privacy and Security Resources

17. Developing talent • Growing ventures • Opening markets
Visit
us
at
marsdd.com
THANK YOU!
B E C A U S E T H E F U T U R E M A T T E R S
INNOVATION