Data Privacy and Sovereignty Changing Legal Landscape - GDPR Sheila M. FitzPatrick Chief Privacy Officer, NetApp Presented at Digital Velocity London 2017, The Landmark Hotel

1. © 2017 Tealium Inc. All rights reserved. | 1© 2017 Tealium Inc. All rights reserved. | 1

2. © 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---2
Data Privacy and
Sovereignty
Changing Legal Landscape – GDPR
Sheila M. FitzPatrick
Chief Privacy Officer
NetApp, Inc.

3. Agenda
1) Why do data privacy and sovereignty laws matter?
2) Data protection legal landscape
3) General Data Protection Regulation: Key highlights
4) Shared concerns and misperceptions
5) Data privacy versus data security
6) How do you mitigate the risks?
7) The NetApp global model of excellence
8) The NetApp value proposition: Start with the legal framework
9) Key takeaways
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---3

4. ▪ Heightened concerns over data access
▪ New technology driving the importance of
privacy considerations
▪ Serious privacy risks with new technology
(for example, cloud and internet of things
[IoT])
▪ Focus moving toward data sovereignty or
cross-border flows
▪ Lack of companies addressing privacy
Why do data privacy and sovereignty laws matter?
▪ Concern for customers
▪ Global business expansion
▪ New business and business models
▪ Global regulation expanding
▪ Greater sanctions and penalties
▪ Intense media and social media focus on
privacy and security breaches
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---4

5. © 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---5
Data Protection
Legal Landscape

6. Global Data Protection Laws
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---6
▪ General Data Protection
Regulation (GDPR)
▪ ePrivacy directive
▪ Country-specific laws
▪ Cloud computing
directive
▪ Data sovereignty
obligations
▪ Cybersecurity directive
▪ Antispam laws
▪ Healthcare privacy laws
▪ Data breach regulation
European Union (EU) Asia-Pacific Canada Latin America
▪ Country-specific
privacy laws
▪ Healthcare privacy
laws
▪ Asia-Pacific Economic
Cooperation (APEC)
cyber privacy code
▪ Cross Border Privacy
Rules (CBPR)
▪ Restrictions on
marketing activities
▪ Restrictions on cloud
computing
▪ Data breach
regulations
▪ Privacy Act
▪ Personal Information
Protection and
Electronic Documents
Act (PIPEDA)
▪ Digital Privacy Act 2015
▪ Provincial or
sovereignty laws
▪ Medical records laws
▪ Cybersecurity
regulations
▪ Canada Anti-Spam Law
(CASL)
▪ Data breach regulations
▪ Cross-border transfer
restrictions
▪ Country-specific
privacy laws
▪ Personal health
information privacy
laws
▪ Cloud computing
regulations
▪ Organization of
American States (OAS)
cybersecurity
guidelines
▪ Data breach
regulations

7. ▪ Patchwork system of privacy laws
▪ Federal Trade Commission Act (consumer protection)
▪ Electronic Communications Privacy Act
▪ Judicial Redress Act
▪ Cybersecurity Executive Order (voluntary)
▪ Data breach regulations
▪ Healthcare—Health Insurance Portability and
Accountability Act of 1996 (HIPAA) and Health
Information Technology for Economic and Clinical
Health (HITECH) Act
▪ Regulated industries (government, financial, and
critical infrastructure)
▪ State privacy laws
▪ Privacy Shield
U.S. Data Protection Laws
7 © 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---

8. General Data Protection Regulation: Key highlights
▪ First and foremost a legal compliance issue, not an IT or technology issue
▪ Affects any company regardless of location
▪ Requires appointment of Data Protection Officer (DPO), who “owns”
responsibility for GDPR
▪ Requires a strong data privacy compliance framework
▪ Affects business functions that collect or process personal data
▪ Requires data retention and destruction policies and procedures
▪ Has legal and relevant need to know how to collect, access, or process
personal data
▪ Has greater data processor obligations or accountability
▪ Effective May 25, 2018
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---8

9. What does GDPR mean for companies?
▪ The law has a broader definition of
personal data and pulls more data into
the “regulatory net.”
▪ The definition of personal data now
includes unique identifiers, IP address,
biometrics, genetic data, and location
data.
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---9

10. ▪ The law is extraterritorial.
▪ The law applies to any organization anywhere in the world that collects, processes,
accesses, shares, stores, or transfers EU personal data.
What does GDPR mean for companies?
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---10

11. What does GDPR mean for companies?
▪ New obligations include transparency, accountability, data minimization, data destruction,
and 72-hour data breach notification.
▪ The law mandates privacy by design before embracing new technology.
▪ The law requires privacy impact assessments (PIAs).
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---11

12. ▪ The law features new accountability rules
for data processors.
▪ The law applies to any organization that
provides a service on behalf of another
organization.
What does GDPR mean for companies?
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---12

13. What does GDPR mean for companies?
▪ The law mandates the attainment of freely
given, explicit, and unambiguous consent
(not implied or forced).
▪ The law enables the deletion of data when
it is no longer needed.
▪ The law provides the right to erasure.
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---13

14. What does GDPR mean for companies?
The law increases the penalties for breaches or noncompliance to €20 million or 4% of
annual global turnover.
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---14

15. ▪ Understand it is first and foremost, a legal
issue, not an IT issue.
▪ The CPO “owns” the GDPR issue.
▪ Tools and technology are great, but you
cannot start there.
▪ A strong data privacy compliance framework or
program must be in place.
▪ Assess the personal data that you collect and
store.
▪ Review current agreements, internal and
external, in regard to data privacy.
How do you prepare for GDPR?
▪ Implement a violation mitigation process for
privacy and security.
▪ Implement relevant and transparent policies
and procedures.
▪ Introduce Privacy Impact Assessments (PIAs).
▪ Develop a global records retention policy and
schedule.
▪ Form a GDPR swat team.
▪ Evaluate tools and technology to help maintain
ongoing compliance.
▪ Find a trusted advisor who truly understands
GDPR and privacy laws.
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---15

16. ▪ Location of data centers
▪ EU data stored or processed in UK
▪ Lead authority for BCRs
▪ Model Contractual Clauses in place
▪ UK may be deemed “inadequate”
Will BREXIT impact you?
16 © 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---
▪ New agreements with UK providers
▪ UK Data Protection Act vs. GDPR
▪ Identified deficiencies by EU Authorities
▪ Data breach notification
▪ UK investigatory powers

17. EU-US Privacy Shield – Is it the Right Direction?
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---17
▪ ECJ Adequacy
▪ ECJ invalidation
▪ Member State
Challenges
▪ Mistrust of US
Commitment
▪ “Cosmetic” change to
Safe Harbor
▪ Not compliant with
GDPR
Pros Cons Potential ObstaclesStatus
▪ No current
enforcement
mechanism in the US
▪ US self-certification
▪ Challenges from Max
Schremes and other
privacy advocates
companies
▪ “Loopholes” in US
Redress Act
▪ No mass surveillance
▪ EU citizens’ redress
mechanism
▪ Strong
obligations/robust
enforcement
▪ Transparency
regarding US Gov’t
access
▪ Recently approved –
4 abstentions
▪ US appointment of
an Ombudsman
▪ Dissatisfaction in
some Member States
and privacy
advocates
▪ Self-certification as of
August 1, 2016

18. © 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---18
Shared Concerns
and Misperceptions

19. Foremost on the minds of companies
▪ How to embrace the cloud and new technology
▪ Compliance with data privacy and sovereignty laws
▪ Where to begin with GDPR
▪ Mixed messages and misleading information
▪ Data location and sovereignty
▪ Cybersecurity
▪ Data breach remediation and contingency plans
▪ Loss of control
▪ Data security
▪ Accountability and liability
▪ Data retention and destruction capability
▪ Whom to turn to for help
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---19

20. Challenges in the world of cloud computing
▪ Global restrictions
▪ Compliance with data privacy and sovereignty laws
▪ Volume of data from unknown sources
▪ Data location, jurisdiction, and cross-border data flow
▪ Data control and/or ownership
▪ Lack of transparency
▪ Data that could or should live in the cloud (and type of cloud)
▪ Data breach remediation and contingency plans
▪ Security, including encryption and tokenization
▪ Use of third parties
▪ Litigation and electronic discovery
▪ Misperception of privacy versus security
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---20

21. Data privacy versus data security
▪ Data security is not data privacy.
▪ Privacy is the legal collection, use, sharing, storage, and transfer of data; privacy is
legislated and regulated.
▪ Security is a fortress around the data.
▪ Companies can have world-class security but no data privacy.
▪ International Organization for Standardization (ISO) 27018 addresses security but not data
privacy.
▪ All cloud vendors can address security, but few can address privacy.
▪ The legal PIA is a critical decision mechanism.
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---21

22. ▪ Clear and explicit policies and procedures
▪ Privacy Impact Assessments (PIAs)
▪ Data privacy agreements and model
contractual clauses
▪ Knowing the difference between privacy
and security
▪ Restricted access to data
▪ Well-defined data ownership of data
controller versus data processor
▪ Transparency: opt ins and opt outs
How do you mitigate the risks?
▪ Classified data (what should or should
not live in the cloud)
▪ Vetted third parties
▪ Asking the right questions
▪ Knowing your risk tolerance
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---22

23. © 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---23
NetApp’s Model
of Excellence

24. The NetApp global model of excellence
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---24
Business-Impacting Decisions
NetApp Expertise: A Model Global Company for Addressing These Concerns
NetApp Internal Global Model Program
Global Policies
and Procedures
Monitor and
Advocate
Internal and External
Partnerships
Internal and External
Training
Verify That Products
Mitigate Privacy
Risks
Execute
on Laws
Key Business Needs
Store Data Protect Data
Understand
Legislation and
Regulation
Balance Risks Manage Costs
Global Data Privacy Cybersecurity Cloud Computing Big Data

25. ▪ NetApp uses its business model to help enterprises
prepare for and be compliant with EU GDPR
regulations (95% compliant with GDPR)
▪ NetApp has a reputation for excellence in global data
privacy and is one of fewer than 100 companies that
have BCRs.
▪ NetApp educates customers on the data privacy
compliance foundation before introducing products
that help maintain compliance with GDPR.
▪ The Data Fabric strategy enables organizations to
control, manage, secure, and protect their data
whenever and wherever access is needed.
The NetApp value proposition: Start with the legal framework
Key components
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---25

26. Key takeaways
▪ Embrace the laws instead of running from them
▪ Start with the data privacy compliance framework, not technology
▪ Know the importance of privacy due diligence
▪ Know the difference between privacy and security
▪ Ask the hard questions and push back on their suppliers
▪ Know that there is more at stake than where the data center is located
▪ Reach out to NetApp as a data privacy and governance-trusted advisor
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---26

27. THANK YOU
© 2017 NetApp, Inc. All rights reserved. --- NETAPP CONFIDENTIAL LIMITED USE ---27
Sheila.fitzpatrick@netapp.com
@sheilafitzp