There’s a memorable scene in Back to the Future 3 where Marty receives a Western Union telegraph from Doc almost a century after it was originally mailed, warning him of events to come. Seems an unlikely possibility that any organization would honor such a request to preserve, protect and deliver documents for so long. However, that’s exactly what happens every day, all over the world, and it happened to me only a few years ago when I found out I was adopted at the age of 33! The experience was so life changing that I made a film about it which is finally available this month on Amazon and Itunes.
The Little Girl with the Big Voice, A Documentary on iTunes
The State of California, to whom I wrote a letter verifying my identification, swiftly wrote me back with a manila envelope containing a treasure trove of documents gathered from multiple state agencies. In the package were details from social workers, hospitals, doctors and even notes from my biological parents! They were all free of charge and kept under seal for over three decades! We take these systems for granted nowadays but can you imagine how effective a system must be to protect my information for this long, over so many administrations and to do it largely without computers? What really makes these processes work is not technology of course, it’s people. But what motivates these people to do such a thing?
Adoption details from the State of California
An honorable discipline based on ethics.
I’ll tell you what my own epiphany was, as somebody who works in the fields of Information Governance and Privacy… and that was that record keeping, and those who perform it, are part of the ethical backbone that so much of our society relies on. This often thankless discipline codifies and exemplifies the altruistic commitment we have, and must continue to have to one other. It’s a commitment to value the records and history that tell us who we are and a pledge to protect those records as a matter of ethics ethics and common values. It’s one of the reasons Archives and Records Management has been a passion of mine for so many years.
What can we, as information managers, learn from all of this?
With Joe Franklin
The new era of Privacy is a boon for Records Management because it underscores the truth that the most important data and records are not just necessary for business continuity, death and taxes but are personal. The return of the discussion of privacy as a fundamental right is not new of course. It’s written into the Constitution in the 4th Amendment. It has been defined historically through almost all cultures and even has biblical roots. Privacy a gift that we’re just beginning to learn how to appreciate again and a silver lining in a world struggling so hard to protect it.
The short answer? A lot, but not as much as you might have been told…
As I’ve traveled around California doing my “Blessings of the CCPA” presentation, I’ve been asked repeatedly about the “average” cost of a CCPA solution from CFO’s, GC’s and IT folks alike. It’s a loaded question as there are many requirements to the law, from policy and website disclosures to consumer data request obligations. One size does not fit all and your organization needs to spend time methodically planning its approach before setting aside budget and other resources.
While some unprepared organizations may need to beef up spending in the near-term, others may end up refining their programs over the coming years as they realize their initial investment wasn’t as strategic as it probably needs to be.
At the San Diego ILTA Presentation of “Preparing for the California Consumer Privacy Act”
Decision makers, consider the following:
What’s our true risk exposure based on the personal data we already collect, sell, barter, manage, etc. on behalf of our business partners?
Can we do this all in-house or should we outsource some of it?
Do we have any existing talent and software that might help streamline some of the CCPA’s major workstreams like data mapping?
What kind of fundamental changes are we willing to make to our IT infrastructure?
Do we fully automate self-service requests through API’s and is that even the right idea, long-term, given our risk, the evolving nature of IT and emerging legislation?
How can taking a principle based approach to privacy using concepts like data minimization to insulate us going forward?
Clearly, all of us subject to the law need to protect our business and expect some activity, whether it be through consumer requests or even the limited right of private action afforded by the CCPA. That doesn’t mean you turn your entire organization upside down and fork over hundreds of thousands of dollars in licensing ransom! Change management on this scale first requires proper risk analysis, roadmapping and getting stakeholders to buy-in and be accountable.
Then what’s my next step?
Before you embark on this journey to become a privacy-centric company, the real question you should be asking yourself is….
Are there consultants and affordable software solutions out there that will leverage our resources and best minds to help us implement a proportional strategy that protects us?
Long-term solutions need to be fact-based and reasonable, recognizing the unique facets of your culture and business model. Big, complex and expensive isn’t always better.
It’s true there are some amazingly fancy privacy software products out there. But do you really want to spend a quarter to half-a-million dollars a year to fend off what might ultimately be a handful of consumer requests and opt-outs, when you can do the exact same thing with a far less expensive and better tool?
The bottom line…
There are so many vendors playing in the privacy space today and way too many folks are impulsively investing either too heavily or disproportionately in them just to “check the box.” Yes, of course you need to “check the box,” but running headfirst into this regulatory challenge could leave you with a budget nightmare and organizational headache you’ll soon regret.
The bottom line is your investment needs to be proportional to your risk profile and the complexity of your infrastructure and organization. Even then, you may not need a solution that costs you hundreds of thousands of dollars when you could be compliant and sleep comfortably for under $50,000 a year.
In response to recent stateside efforts to enshrine data protection including the California Consumer Privacy Act (CCPA), organizations are revisiting the efficacy of their Data and Information Governance (IG) programs. Laws and regulations vary by industry and company size. Yet each intend to protect consumer’s personal data by prescribing technical and governance standards backed by stiff penalties for non-compliance.
What you need to know and do to ensure compliance with California’s new Consumer Privacy Act
New regulations governing use of customer and personal data needn’t be burdensome. Rather, they help reduce expenses and monetize the information lifecycle, identify opportunities for better governance to avoid fines and litigation exposure and foster trust to enhance customer experiences. Download this FREE detailed CCPA roadmap to see how you can get your company on the path to compliance.
This slideshow requires JavaScript.
Our CCPA and GDPR engagements include:
Data and resource mapping
Conducting gap and risk assessments
Controls evaluation to standards
Establishing governance with clearly defined roles and responsibilities
Policies and procedures review
Domestic and International legal review of privacy and security policies to fit the organization’s risk profile and culture
Consumer data request and delivery mechanism (including website notices)
Providing education and training
Design of role-based access control (RBAC) rights
Privacy impact assessment (PIA/DPIA) during product design
Third Party Due Diligence Support
Pre-contract due diligence and consulting
Cloud services guidance
Managed security services (build or buy guidance)
Third-party management program/policy
Our consulting and software solutions enable clients to comply with CCPA provisions 1798.110(a)(4), 1798.100, 1798.105, 1798.110, 1798.120, 1798.145, 1798.140, 1798.150
Call us today to see how we can help you with:
California Consumer Privacy Act of 2018, Amendments and Rulemaking
HIPAA/HITECH Security, Privacy and Breach Notification Rules
Generally Accepted Privacy Principles (GAPP)
EU’s General Data Protection Regulation (GDPR)
ISO/IEC 27001-2:2013
CIS Top 20 Critical Security Controls (CA AG requires)
SEC OCIE Cybersecurity Initiative
NIST Cybersecurity Framework
U.S. Sentencing/DOJ/OIG Guidelines for Effective Compliance (program foundation)
Applying Risk Management Program Management and Principles
By Rafael Moscatel, Certified Information Privacy Manager (CIPM)
HEY BOSS, LOOKS LIKE PRIVACY IS KIND OF A BIG DEAL NOW
IAPP’s Privacy.Security.Risk. Conference 2019took place in Las Vegas over four days at the end of September and was attended by more than 2000 attendees hailing from all over the United States as well as a number of countries. The Fortune 500 was well represented but I also met a number of other astute organizations and took a tour of the industry’s big vendors on the showroom floor. Although I live tweeted the event I’d been waiting to share my complete thoughts until after I passed my CIPM exam, which I did just a couple days ago. More on that later…
THE FIELD OF INFORMATION MANAGEMENT CONFERENCES GROWS MORE CROWDED
First, as a Certified Records Manager (CRM) and Information Governance Professional (IGP), I’ve been to and spoke at my share of conferences touching on best practices for information management, privacy, security and content. What made this one different? Well, besides how well the conference was organized and the venue, The Cosmopolitan, almost all of the workshops were just first rate, chalk full of real take home targeted content and timely. The vast majority of the presenters were seasoned and even the first-timers made the grade. Here we are on the heels of one of the biggest new privacy laws, the California Consumer Privacy Act, and these sessions were speaking directly to its attendees on how to take specific action and plan for additional state directives. The education aspect and sales piece blended well, with technology complementing best practices and not the other way around. And the conference also left me with a lot of questions…
DO WE HAVE THE RIGHT TO BE FORGOTTEN?
I didn’t attend the training sessions on the first two days but made it to the opening keynote by Former Chairman of the FCC, Tom Wheeler who gave the audience a 30,000 foot view and shared thoughts from his new book, From Gutenberg to Google. A great way to set the tone for the conference and then it was followed up by Janelle Shane who focused on rudimentary examples of AI but didn’t really connect her topic that well to Privacy. Nonetheless, it was an interesting takeaway. However, my favorite keynote came in the form of a play by Sharyn Rothstein and directed by Seema Sueko entitled The Right To Be Forgotten. The play examined a concept that we find in Europe but which still hasn’t taken hold in the States. It follows the impact of a young man’s juvenile mistakes and how they follow him around as he gets older, impacting his reputation and his life.
IS THERE A PLACE FOR DIGITAL ETHICS?
I know a number of people who have been personally affected by the internet, both by their own doing and also unfairly, and so this was a terrific way of introducing these challenges to the audience. The problem was that the rest of the conference didn’t really touch on this topic because it was more focused on CCPA and the corporate aspects of privacy program implementation. That’s fine but it left me wondering if in the United States we’re really where we need to be on the privacy front. We seem to only be focused on the issue from a data protection standpoint rather than an ethical one, whereas GDPR and other parts of the world take a more holistic view. Yes, we have HIPAA and the Children’s Online Privacy Protection Act (COPPA) but it feels like many of our laws are still really about breaches and liability and not about the value of privacy.
The conundrum seems to be that while we’re moving, as industries, toward a business culture of privacy, our culture as a whole is moving in the opposite direction, away from arms length communication and behavior and towards oversharing and a lack of discrepancy. How do these two worlds exist? We know that hackers are now using personal information voluntarily shared with the world to design more sophisticated phishing attacks and deep fakes. We know that thieves use location and vacation information shared through social media to know when you’re home and plan robberies. And despite all of these controls supposedly put in place around the world, we continue to give more of our personal information away which ends up being held as ransome against our companies. Yes, we know we have to share this information to enjoy convenience and in many cases now, to simply survive and get daily errands completed, but it still feels like digital sisyphus. In the age of the personal brand, are there even any private people around anymore? What good is all of this data protection if society as a whole has given up on the ethics of privacy? Besides the play at the conference and some of the discussions around children’s privacy, I didn’t see much of a discussion here, but perhaps it wasn’t the venue. I recently had a discussion with noted Data Privacy Professor Anita Allen, who wrote the first casebook on privacy law, on these ethical aspects of privacy that will soon be available in my book, Tomorrow’s Jobs Today.
THE RISE OF THE MACHINES
So, full disclosure, I work with a few vendors in the privacy space but my thoughts on privacy vendors are not influenced by those relationships. I saw some amazing products at P.S.C.19. The products seem to be maturing and there is a lot of venture funding going into developing large enterprise scale platforms that do an A to Z job in addressing GDPR and CCPA. There are a couple big players in the business and the industry should be grateful for their sponsorship of conferences like this and generally moving the ball forward in terms of conversations around privacy.
What I’m seeing is a lot of enterprise product that is designed specifically for large organizations and a lot of file analysis, enterprise architecture and other similar companies trying to adapt their solutions to solve the problem. The problem is that the problem is constantly evolving and despite a pretty clear prescription in the CCPA legislation, I just don’t think one size fits all. Especially if you’re looking at a capital investment to check a compliance box that might be covered in a more strategic manner. Let me explain…
I had the pleasure of sitting with a team of folks from a major multinational and a peer and I questioned them about their approach to CCPA. It was pretty impressive. They had half a dozen folks attending the conference from a number of their offices. They had hired an industry leader to implement their program. So lots of investment, lots of buy in and it was proportional because their size makes them a natural target for a regulator. One of the more amusing partners in the group casually replied to me after I asked if they were ready by saying, “Yeah, but I’m going to be really pissed if we did all this work and don’t even get one request!” That’s of course what a lot of organizations realized following the GDPR where the flood of data subject requests turned out to be a trickle. So, despite their aversion to risk and likely thorough, appropriate strategy, I still wonder it it’s right for everybody. What about the companies with a smaller footprint and much smaller budget? Does it make sense to have an omnibus-like enterprise product, with dozens of API’s and infrastructure demands take over a section of your IT department?
WHAT ABOUT STRATEGY?
Here’s the truth about privacy programs and tools. There’s no silver bullet. Dumping a ton of money into an existing IT or Records Management program or hiring a team of half a dozen twenty-six year old MBA’s from one of the big four to turn your enterprise upside down (yes I’ve seen that) is not even close to a smart information governance strategy. Unfortunately this is the first time many organizations have had to take a close look at their information and records management programs. In many cases, especially with regulated industries, information management has played a role in meeting regulatory and audit demands but it wasn’t necessarily center stage the way it is now. Many companies have a retention schedule or policy but were probably over-retaining a lot of their data and not taking action on some of the other aspects of it like data classification until the privacy movement came along.
Data Protection Impact Assessment with CAPP using LogicGate
Privacy-centric records management is basically the ideal Information Governance project or initiative. That’s because to accomplish privacy goals, companies need to not simply revise policies, they need to holistically understand how those policies work with other areas of their business like data security and records management. Fortunately, a lot of the groundwork has already been in place at many organizations, specifically in Finance and Health, in order to integrate a privacy-centric framework. If it has been performed you should also complement it with a DPIA or Privacy Impact Assessment.
That said, how do you get the most value of the technology you implement? I think you do that by having the types of conversations that allow the best minds in your organization to become stakeIholders in the ultimate solution. Before you buy product, you need to survey your landscape. It may be that you need a privacy program and privacy protections for your consumers, employees and vendors but your data subject requests are not so cumbersome that you require an overhaul of your inventory and integrations.
Can you use an Enterprise Architecture and data mapping tool in concert with a separate data subject request tools instead of automating everything? Maybe. Consider the investment and time that might go into continuously monitoring a complicated, heavily API dependent and seldom-used privacy tool. Might that effort be better put into maintaining an EA tool that not only supports the mapping requirements of data privacy legislation but also supports other areas of the IT business? Don’t we want our organizations to be agile and be able to swap-in and swap-out tools as needed? Do we really want to tie an entire business process to one solution? Haven’t we learned anything from our legacy mainframe days? Remember how hard it was, and is, to untangle ourselves from those.
Mapping Data for GDPR with CAPP in Ardoq
I’m not saying that an enterprise-wide product isn’t right for large organizations with a lot of risk and endpoint exposure. I just believe that companies need to consider the process as a whole and take their time building these programs. Although California may serve as the baseline, we still don’t know what the rest of the States will do or what the future brings.
BEING A NEWLY MINTED CIPM
I can’t comment on the substance of the exam as I’m prohibited to by the agreement I signed. What I can say is that like most designations the value I find is not necessarily in the certification as much as the legwork and study necessary to achieve it. The reward is in the knowledge you acquire along the way, not just the medal you get at the finish line. If you check out the publicly available study materials and Body of Knowledge (BOK) available on the IAPP site you’ll see that it looks very much like the protocol of other information management organizations.
My belief though is that this BOK is evolved precisely because it’s privacy-centric. It covers many areas familiar to IG and Data Privacy disciplines but it is much more a holistic model and prescription than I’ve ever seen. It’s one of the reasons I’m so impressed with the IAPP.
THE RACE JOURNEY BEGINS
I came back from meeting with data privacy officials and business people in Brussels in 2018 knowing that Privacy was going to change the world. It’s one of the reasons I decided to engage more fully in it professionally. I’ll be spending more time talking about my journey towards privacy and speaking about the CCPA and related issues over the coming months and in my new book which should be available early next year. The concept of privacy is not just important for data protection and to check a compliance box, it’s important because it affects the lives of our colleagues, our friends, our children, our parents and pretty much everything around us. We need to not only protect our data but we need to value it and teach others to value theirs and that’s what I’m dedicated to.
I’m available for consulting opportunities and interviews and would love to discuss your corporate challenges. Feel free to contact me at rafael@capp-llc.com to schedule a free two-hour workshop or just give me a buzz at 323-413-7432.
Rafael Moscatel, managing director at CAPP, joins GRC & Me to discuss how his background in law and consulting ultimately led him to the world of GRC. He shares how one tweet led to a watershed moment in compliance and privacy, and tells his deeply personal connection to California adoption records. Rafael also explains how CCPA should be viewed as a blessing that helps better understand what’s “under the hood” of your company.
EPISODE NOTES:
Top 3 Quotes
“The more that you can show your customers that you’re being a good steward with their data, the more they’re likely to trust you. And from a reputational standpoint and a branding standpoint, that’s always one of the best benefits and one of the reasons that consumers will choose one product or service over the other.”
“And I think if you look carefully, the CCPA is quite a blessing. It helps reduce expenses and monetize the information life cycle because you have a better understanding of what’s under the hood in your company.”
“…you know there’s not one silver bullet when it comes to preparing data for an information governance strategy, IG is essentially a multidisciplinary type of approach.”
Show Highlights
[01:28] Rafael’s background in law and consulting [02:35] Discussing Rafel’s company and beginnings [04:36] The “Olympics of Privacy” [05:59] A watershed moment in Compliance and Privacy [08:05] Rafael’s personal connection to records in California [09:05] The incredible moment Rafael received his birth records [12:00] The “blessing” of CCPA [14:11] Rafael’s personal opinion of CCPA [16:19] Best practices for privacy and policy management [19:30] Policy management systems [21:04] How to read more about Rafael’s thoughts on these issues [22:58] The Little Girl With The Big Voice [24:03] Vendor Risk Management [25:00] Being mindful of what’s outside your company walls as well as what’s within them
We share and store our most sensitive personally identifiable information (PII) on countless computers, networks, and devices. Within an organization, PII can be found scattered in emails, databases, shared drives and more. The new California Consumer Privacy Act (CCPA) is making a strong privacy program an essential part of an organization’s records and information governance program. Join our presentation as we discuss:
How are you leveraging the focus on privacy and complying with this new law?
Is Record and Information Governance at the table for the conversation?
Will you and your organization be ready when the Act goes into effect on January 1?
Media Contact: Ally Bertik ally@marketingmaven.com (310) 405-0358
Williams Data Management to Host Data Protection Lunch at Century City
Chamber of Commerce
Leader in
Data Protection Partners with Cyber Hygienist and Technology Expert to Discuss
How Fiduciaries Can Prepare and Protect Their Businesses for Data Breaches
LOS ANGELES. – (September 18, 2019)– Williams Data Management, southern California’s leader in data protection, has partnered with Rafael Moscatel, managing director of Compliance and Privacy Partners, and George Baldonado, president and CEO of Oasis Technology, Inc. to host a “Data Protection, A Primer For Your Fiduciary: It’s Your Business, Protect It!” lunch in conjunction with the Century City Chamber of Commerce. The panel will take place from 11:30 a.m. to 1 p.m. on October 3, 2019 at Greenberg Glusker, 1900 Avenue of the Stars, Suite 1400 in Century City, California.
Data
Protection Pro, Douglas C. Williams, president and CEO of Williams Data
Management will discuss how small businesses can take advantage of a data
breach reporting service powered by CSR Privacy Solutions, Inc. to enable
companies to protect Personally Identifiable Information (PII). Other topics
will include the California Consumer Privacy Act (CCPA), cyber security
protection and data governance.
“We
are thrilled to lead the conversation for fiduciaries on how to better protect
their businesses,” said Williams. “Our goal is to keep your information safe,
secure and available regardless of what it is or where it is stored. We hope to
provide a clear solution for companies in all industries moving forward,
especially with our new data protection suite that provides a pathway for
self-assessment and structural gap analysis for internal management.”
Guests
will have the opportunity to network with business professionals, engage in
this informative panel with expert sources and enjoy lunch provided by Williams
Data Management.
Williams Data Management is southern California’s leading source for
data protection management. The company educates, consults, has the source
materials, and provides the structure for self-assessment and corporate plan
structure for information breach notifications in the United States. Over the
last decade, the firm has become an expert solution provider, offering
professional records management, data protection, imaging and digitization,
cloud storage and certified data destruction services to all sectors and sizes
of businesses.
Williams holds numerous certifications for data compliance and
destruction including SSAE16, NAID “AAA” Certification, and is a member of
PRISM. For more information, visit www.williamsdatamanagement.com or call
888-478-FILE.
About Century City Chamber of Commerce
The Century City Chamber of Commerce is one of Los
Angeles’ most active, involved and relationship-driven chambers. The chamber
places a special emphasis on its members working together to build effective
relationships and relevant programs that help individuals and companies expand
their marketplace reach. Under the clear and powerful guidance of many
energetic committees and councils, the Century City Chamber has grown to
encompass representatives from virtually every industry, helping to make
Century City one of Los Angeles’ most prestigious business communities. From
the largest corporations to mid-sized businesses and emerging entrepreneurs,
its diverse members thrive with one another and with key decision makers.
7 Ways To Prepare Data In The Age Of Privacy and Information Governance
7 Tips for Data Preparation in the Age of Information Governance
Content may still be king, but now the rights to some of it may belong to the people! In response to the EU’s General Data Protection Requirement (GDPR) and recent stateside efforts to enshrine data protection including the California Consumer Privacy Act (CCPA), organizations are revisiting the efficacy of their Data and Information Governance (IG) programs. Laws and regulations vary by industry and company size but each intend to protect consumer’s personal data by prescribing technical and governance standards backed by stiff penalties for non-compliance.
Notably, while many companies are already familiar with records retention laws, these latest controls also introduce a duty to destroy data once no longer required for a legitimate business purpose. For entities that have grown accustomed to leveraging cheap digital storage, this new responsibility presents a number of logistical hurdles.
However, directives on how you may use your customer’s data or any other information you store doesn’t necessarily have to be burdensome. In fact, these new guardrails present numerous opportunities to implement better governance, monetize the lifecycle of information assets and foster trustworthy relationships that can actually enhance the customer experience.
These 7 tips can help prepare your data to support an IG strategy:
Automate Retention Schedules – Legal and compliance requirements are the cornerstones of corporate governance programs. Yet tracking the multitude of historical and emerging state, federal and international laws and regulations that affect your data decisions can be a monumental task that even the most robust law departments aren’t prepared for. Consider leveraging SaaS software to keep your Risk, Compliance and Legal staff current on the latest citation changes to these nuanced instructions. These tools empower you to defensibly destroy and cleanse costly data no longer useful to your organization.
Cover Your Assets – Satisfying new compliance requirements like GDPR and CCPA means it’s not enough to simply know what kinds of records you keep, you need to know what systems they’re kept in and how that data flows between them. That’s why Chief Data Officers and Enterprise Architects are increasingly embracing asset management tools that not only perform diagnostics on their application stack but allow them to inventory their attributes and map related processes that inform long-term strategic roadmap planning. Tools like these also help support application rationalization projects which in turn aid in classification and disposal of unneeded data.
Introduce Big Buckets – The biggest challenges with enforcing retention across an enterprise are “event triggers” that complicate how long sets of records must be retained. For example, an employee file might be held X years following a termination “event.” Big Bucket strategies allow you to simplify and group “like” records together to support more efficient destruction actions while assuming some risk. Work with your governance partners to determine reasonable standards for a Big Bucket policy and quantifying the acceptable amount of risk your company is willing to assume to achieve cost and efficiency benefits.
Enforce Legal Holds – Cleansing your data lakes and silos to save costs and minimize risk is an exercise in defensible destruction but requires awareness of outstanding legal holds. A company that spoliates evidence subject to a legal hold, even without malice, can be fined and suffer adverse inference litigation rulings resulting in unfavorable judgments. Additionally, healthy oversight of records under a preservation hold doesn’t just make good legal sense, it can also help better identify opportunities for even more defensible destruction, cost reduction and risk mitigation.
Activate File Analysis – The tricky thing about new laws like the CCPA is that they require companies to find and produce data for the consumer wherever it exists. That can be a cumbersome test for many entities that have hundreds or thousands of repositories. Luckily, advanced File Analysis tools can plug directly into your network and help quickly identify sensitive and personally identifiable information (PII). They can also help you deduplicate records and find redundant, obsolete and trivial data clogging your systems, also known as ROT. These tools produce a tangible ROI that management can point to as a prime example of why IG works.
Embrace Content Migrations – Unless you’ve only lived in one home your entire life, you’ve probably experienced the cathartic process of cleansing your old wares in preparation for a move. Bringing in a new content management system is not much different and it’s a unique opportunity to apply retention to your data, discard ROT and provide employees with more accurate knowledge resources.
Bake-in Best Practices – Information Governance is not a “one and done” proposition, it’s a rinse and repeat discipline that only works when management sees to it that organizational culture is along for the ride. These days a basic understanding about data handling is vital for every new hire. Concepts like records retention, data protection and privacy should be part of any overall corporate training plan.
By complementing policy frameworks and toolsets with the types of Information Governance approaches noted here we can better enable our workforce to hone their knowledge skills, achieve defensible destruction and improve audit outcomes. In effect, we are future proofing ourselves for a business world destined to face increased scrutiny and under siege from data breaches and privacy issues with seemingly no end in sight. IG is the bright light at the end of that tunnel.
Rafael Moscatel, CRM, IGP, is the Managing Director of Compliance and Privacy Partners, LLC. Reach him at 323-413-7432, follow him on Twitter at @rafael_moscatel or visit http://www.capp-llc.com to learn more.
Originally published in Document Media Magazine, July 2019.
LEVERAGING A GDPR COMPLIANCE INVESTMENT FOR CCPA / PRIVACY BY DESIGN WORKSHOP
Part I – Join European attorneys and privacy compliance experts from Brussels based law firm Ethikos to learn how to leverage GDPR compliance investments for California’s new Consumer Privacy Act. In this presentation they’ll review key data protection concepts and privacy by design strategies already in place across the EU and explain how they’re now spreading throughout the United States. Find out what you need to know about the rules of transferring data and records internationally, PII records retention requirements, rules for managing content on customer facing websites and the impact of these new records management guidelines in contract negotiations.
SELECT THE LINK BELOW TO VIEW THE WHOLE PRESENTATION.
Part II – Meet solutions engineers from Active Navigation who will show you real world examples of how state of the art privacy software helps apply concepts and rules from GDPR and CCPA directly into an information lifecycle program. Learn about machine learning classification, consent validation, uncovering dark data and many more intricacies of implementing a privacy framework as part of your Information Governance roadmap.
Presenters
Miguel Mairlot, Ethikos Law Firm, Brussels
Miguel Mairlot is a trusted compliance expert, with significant breadth of experience across Europe. He provides clients with advice and support on all aspects of their compliance program. His areas of expertise include Asset Management, Wealth and Insurance businesses to cover cross-border regulatory issues, risk management, contractual documentation and product development, advising and influencing senior stakeholders at executive committee level, enabling them to meet their responsibilities across a range of group policies and local requirements, including MiFID II, GDPR, AML, ABC and Sanctions. Before Ethikos, Miguel has worked for prestigious international law firms and financial institutions as Head of Compliance. Miguel speaks English, French, Dutch and is a Certified Compliance Officer (Febelfin Academy) since 2013 and a Data Protection Officer. He has written and spoken widely on compliance and financial law topics and teaches at the Cooremans Institute. He also serves on the Editorial Board of “la Revue de Droit Bancaire et Financier”.
From its inception the internet has always been about search…. searching for that answer, that perfect example, that one you love? But search has also changed the way we think about information, about primary sources and really about each other in wildly different ways that aren’t always, well….helpful.
In the wrong data steward’s hands the integrity of our records and information, both in the style and context in which it is delivered, can be easily and unfairly distorted. This has worsened over time and is horrifying when you consider the extent of “deep fakes,” “fake news” and other purposeful misleading propaganda being spread. A trend towards misinformation and bias is clearly what has happened over time with Google’s search results and it’s having disastrous unintended consequences on the pursuit and preservation of knowledge, wisdom and the humanities around the entire world.
With exciting new A.I. tools like Alexa and Siri becoming commonplace, search has entered a second renaissance and results have even more power to shape hearts and minds. Yet nobody, no one monopoly, should be in the business of brokering access to facts or opinions.
We need new tools that deliver intelligent results that protect the privacy of its users and promote resources which enrich our lives, communities and world around us without exploiting our vulnerabilities.
With proper regulation of monopolies like Google there’s going to be a better way to find what you “need” without being subtly persuaded how to believe and incessantly pestered about what you should “want” along the way. In other words, a return to search that offers a wealth of information minus manipulation.
True search results should provide access to knowledge you can rely on for personal, professional and academic growth. A search engine should steer you away from groupthink and encourage critical thinking, not bully you into becoming a “follower.” We need independent thinkers to reclaim their independence as information consumers, as teachers and students, as citizens, as moms, dads, brothers, sisters and yes, even as politicians. After all, the internet has the power to be the great equalizer in spreading knowledge. But that knowledge can only bring light to our present darkness if it can shine through the praetorian ideologues that have begun to guard its boundless prism.
Google was perfect for its time and helped both connect and open the world to itself. Yet now, as our collective tastes become more refined, we realize our search time is equally as valuable as increasingly for-profit algorithms. Rather than wasting another moment sifting through information curated through a corporate or political filter, knowledge seekers should demand to be able to create their own!
We deserve new tools that deliver intelligent results that protect the privacy of its users and promote resources which enrich our lives, communities and world around us without exploiting our vulnerabilities.
Establishing a Framework to Sustain the Coming IoT Tsunami – An Interview with Priya Keshav of Meru Data
Ninth in a series of in-depth interviews with innovators and leaders in the fields of Risk, Compliance and Information Governance across the globe.
Priya Keshav is the founder and CEO of Meru Data LLC, a software company focused on building solutions that simplify and achieve corporate information governance goals. Prior to Meru, she was the leader of KPMG’s Forensic Technology Services Practice in the Southwest United States. She received her MBA from University of Florida’s Warrington College of Business Administration. I had the chance to sit down with her this January and discuss IG, the Internet of Things, consulting, and software development.
Priya, you’ve written extensively, often in collaboration with thought leaders in IG including Jason Baron, about the enormous ethical questions emerging from IoT. Do you think there is yet a universal, cross-industry awareness of these challenges or are business drivers in this area primarily the result of European or US regulatory pressures?
I think there is universal recognition that the use of IoT will bring unique challenges and ethical questions. However, I would not call this universal awareness or understanding at this point. The use of IoT is rapidly increasing, the solutions being developed are integrating multiple industries and we are just scratching the surface of what is possible with IoT. I think today, we are at a point where we recognize that some unique challenges are going to arise. I do not believe we have fully understood the nature of these challenges, especially as the uses and applications for IoT are rapidly evolving.
Both industry and regulators are at the same point – thinking about appropriate frameworks for discussing and addressing these challenges. I don’t believe regulatory pressures from either Europe or the US are the primary drivers for the growing awareness. It does seem regulators have more of a focus on the challenges while the industry focus is more around creating newer solutions. There are multiple efforts underway to understand challenges with IoT, driven by both industry and regulatory interest. However, I do not think this is primarily due to regulatory pressure. There is regulatory interest that has industry taking notice but even the industry is realizing the need to manage the unique challenges from the use of IoT. Existing regulations like the GDPR, COPA etc. obviously would apply to IoT. There is increased scrutiny and regulations around data privacy and security in general and that might look like there is increased regulation around IoT. However, there are very few IoT specific regulations like the California SB327.
Regulatory efforts around IoT to date have been more guidelines focused and have tried to not slow down the uptake of IoT. Examples include the recently issued NIST draft report on IoT cyber security standards that provides a great discussion of how risks from IoT are unique and how organizations could adapt their policies to handle this. There have also been integrated efforts with working groups to review existing IoT security standards and initiatives in the US (by the National Telecommunication and Information Administration) and in Europe (Working Group 3 formed by Alliance for Internet of Things Innovation). Other agencies like the the Consumer Products Safety Commission and the FTC have also been gathering comments on their roles in regulating IoT.
With the Meru Data platform, you’ve strived to develop a functional and reporting tool that simplifies and sustains data governance programs for your customers. Is most software today built around policy frameworks, such as FINRA compliance or privacy-by-design, and are these types of approaches even feasible amidst shifting customer wants and seemingly prescriptive laws like GDPR?
Read the entire interview and more in my new book on leadership in the information age, Tomorrow’s Jobs Today.
Harnessing Analytical Insights and Illuminating the Physical Realm of Dark Data – An Interview with Markus Lindelow of Iron Mountain
Eighth in a series of in-depth interviews with innovators and leaders in the fields of Risk, Compliance and Information Governance across the globe.
Markus Lindelow leads the IG and Content Classification Practice Group at Iron Mountain, the world’s largest information management company, where he’s been pioneering breakthrough analytic techniques for over a decade. He holds a Master of Science degree in Computer Information Systems from Saint Edwards University and consults across a broad set of industries. I interviewed him in November to discuss his thoughts on the evolution of metadata, content classification, AI, and how organizations are using the new pillars of data science to break down their silos, help customers get lean and discover the hidden value in their big data sets.
Markus, you work with all kinds of companies to help them better understand and address the often incomplete metadata tied to some of their most valuable information assets in the form of historical paper records and materials retained over decades. In many cases, institutional memory has been completely lost and they’re struggling to figure out whether to dispose of these business records, balancing costs of over retention with risks of untimely destruction. How does your team leverage diagnostic, predictive and prescriptive analytics to make sense of what little data they might have to make informed decisions?
Our content classification process focuses on making the best use of the available metadata. This means classifying records with meaningful metadata as well as analyzing the classified inventory in order to create classification rules for records with little or no metadata. We have identified a number of attributes within the data that tend to correlate with classification conclusions. We assess the classified records associated with an attribute to create a profile that may inform a rule to classify the unclassified records sharing that same attribute…
If, for example, there are 100 cartons associated with pickup order XYZ, 90 of those cartons have been classified, and furthermore all 90 are classified to ABC100, can we create a rule to classify to ABC100 the 10 unclassified cartons belonging to pickup order XYZ? Clients may need to weigh the risk when applying this type of classification rule and the process may include a random sampling of cartons for physical inspection in order to verify the classification.
There’s usually a disconnect between the needs of information managers and legislatures which set retention periods for records. We see this in regulations where the granularity of both fixed and event based retention triggers complicates the practical management of records. Over the years, strategies like “big buckets” have attempted to lessen this challenge but even the best efforts are imperfect and carry their own risks. What can be done to better bridge the divide between the need for due diligence in retaining records and the business case for a more practical solution?
There are two pieces to the puzzle of records management: classification and retention. A records retention schedule needs to be straightforward enough to implement so that users can apply record codes to records. But the retention periods for the record classes need to be specific enough so that some types of records are not being over or under-retained because they are being grouped with other records…
Read the entire interview and more in my new book on leadership in the information age, Tomorrow’s Jobs Today.
I can’t comment on the substance of the exam as I’m prohibited to by the agreement I signed. What I can say is that like most designations the value I find is not necessarily in the certification as much as the legwork and study necessary to achieve it. The reward is in the knowledge you acquire along the way, not just the medal you get at the finish line. If you check out the publicly available study materials and Body of Knowledge (BOK) available on the IAPP site you’ll see that it looks very much like the protocol of other information management organizations.
