web conference to repair or not to
prepare what steps should companies be
taken before the GDP r is finalized
today is brought to this program is
brought to you by trustee my name is
Dave Cohen I am the IEP piece knowledge
manager and I'll be your host for
today's program I will be getting
started with the presentation in just a
minute but before we do a few program
details participating in today's program
will automatically provide I EPP
certified privacy professionals who are
the named registrants with one cpe
credit other sort listening can apply
for those credits through an easy-to-use
online form on our website we also like
to remind you that today's program is
being recorded and will be provided free
to register attendees approximately 48
hours following a live event a link will
be provided on one as last slides in the
presentation to access the recording you
can also email me if you'd like a copy
of the slides my contact information we
provided at the end of program we
encourage you to ask questions at any
time during the program by typing them
into the QA feel to the right of your
PowerPoint window and your questions
will be answered by the presenters at
their discretion either during or after
the presentation and now on to our
program and I'd like to introduce
today's panelists Chris bayville is the
CEO at trustee and will be the moderator
for this program Chris key tussled about
your background in privacy sure Chris
table again the Cu of trustee been here
about six years focused on privacy
before that's been about 15 years the
security side but you know experience
with trustee is really helping the
company over the last number of years
from just the certification than sealed
Pacific we were no encore at the
business level nearly transforming the
business into a company that provides
not only that but also the kind of
technology to allow you to manage
monitor and scale your privacy program
excellent thanks Chris welcome and
adjoining Chris on the panel Caroline
olstead rostrum is the chief counsel of
global privacy at Kelowna and works out
of Stockholm Sweden Caroline welcome to
the program and can tell us a little bit
about your privacy backgrounds thank you
very much I'm heading a team of privity
specialist ask the IANA group so i have
a CPL row you could say i'm responsible
for both data protection strategy and
compliance within the group
but I also have another hat I in the
chairperson for the Swedish data
protection forum which is a nonprofit
organization for videos in Sweden I've
been dealing with the data protection
issues for around 15 years first 12 of
them in private practice the 15 many
multinationals on both compliance and
strategical aspects of data protection
issues excellent great welcome Caroline
thanks for your time today it's round
out our panel Marcus more set is the
global privacy officer you bathe Marcus
how did you get into sealed privacy hi
thanks Dave alike Chris I actually have
a security background been in doing
security and data protection for about
14 years prior to joining even four
years ago where I now run the global
team I ran my own security and privacy
consulting company called concise
consulting and prior to that worked in
various either boutique firms from coal
ioactive and was with KPMG for a while I
have a background I'm a lawyer so I have
a background in both litigation as well
as general technology law and privacy
I've been doing privacy almost as long
as privacy has been around great so as
you can see we have a lot of depth and
experience on the panel welcome Marcus
and with that let's move to the program
itself and Allah for that I'll turn it
over to Chris Chris floors yours thanks
Dave so to kick that off just from an
agenda perspective we've done the intro
I'll give a quick little overview on
highlighting some of the research that
trustee has done on the GDP are and kind
of awareness what companies are doing in
a broad-based level would swim it over
to Caroline for her to give an example
of what they're doing Clara time you get
a perspective from an EU company when i
go back to marcus for the u.s.
perspective Q&A at the end feel free as
some of you already doing to lodge any
questions you have in that QA window
david said will be assembling those and
i'll be taking the three of us through
any of those that come up so make
certain you type them in early as they
tend to all flood in as soon as we can
that partner and it's a little harder to
call through them at that point so feel
free to type them in early um as you
jump into kind of an overview obviously
the the GDP are is in its final stages
of negotiation and I'll touch on some
comments that geove le Giovanni blue
torelli had given earlier this week we
kind of timing and things like that but
we had done a research study that I
wanted to share with you I'm to really
try to assess where companies were
generally of course the background on it
just to give you a sense of timing as
we've had a lot of EU related privacy
things going on the survey was carried
out by third party it was done between
the eighteenth of September and the
sixth of October so keep in mind on the
twenty-third of September's when you
have the preliminary ruling against you
safe harbor and obviously on the sixth
the kind of final version of that from
the EU court of justice so it was before
that was finalized but certainly EU and
privacy was a big topic during the
survey being in the field it was a
sample of 202 people all people that had
the ability to kind of prove that the
new something about privacy so this was
just anyone and they had to be a company
of that hill over 250 employees they
didn't know the trustee was the survey
sponsor and in terms of participation we
had 103 out of the US and 99 out of
Europe with a pretty good mix between
companies and people located in UK
Germany and France so let's take a look
at the results first we asked a general
question around awareness and honestly
of all the points of the survey result
this was the one that was most
surprising to be and that there was
essentially fifty percent awareness of
the Judi PR and this wasn't are you
aware of you know the specifics of x y&z
this was really are you aware of it
generally and what surprised me most
about it was that that awareness was
kind of equally unaware if you will
across the different countries surveyed
with about fifty percent awareness and
the people that responded both across
the u.s. France Germany and in the UK as
we dug in a little bit to the verticals
that had more or less awareness the
financial services vertical of the
highest awareness at fifty-eight percent
probably not a surprise
given that they're typically very
compliant focus have a lot of different
things that they're worried and
concerned about on that front and maybe
also not surprisingly the technology
sector had the least awareness at
forty-three percent typically you know
being a bit of a smaller sized company
that may not be as compliant focused but
a bit worrisome given that you know
technology companies are typically the
higher users of data and highest movers
if you will of data we tried to also
take a perspective and snapshot of big
versus small and kind of maturity of
privacy program and companies that you
know we put in a bucket of more mature
privacy programs and the qualifying
question was you know do you have 10 to
25 or more privacy employees that group
had the highest awareness but even if
you combine all those things you know
for the highest at fifty percent in the
sector the lowest at forty three percent
you know that could have been ninety
five and five it really shows that this
band of kind of fifty percent awareness
across the board and almost even that in
all sectors it's not that much
variability was really kind of the
driving point to make I'm the survey
results here we move beyond awareness
and said okay you're for those that are
aware so again for the fifty percent
that said they were aware we started to
try and get into questions and all the
rest of these refer to that audience of
what are you doing are you budgeting are
you preparing what are you most worried
about and that will be the next few
slides here of those that were aware
two-thirds said that they were starting
to prepare her even before the law was
finalized and here's where you start to
see a split between the countries some
of the European countries like Germany
and UK bleeding at 82 and 71 percent in
that preparation with the US and France
at sixty and keep in mind here
especially when we talk about the second
part of this on budget that remember
from the slide before it was a bigger
company generally or most aware so when
we started to ask questions like budgets
this likely skewed away from the smaller
companies that had been only 250 maybe
500 thousand employees and skewed larger
but 83% had already started to allocate
some budget against the GDP are whether
that be in preparation or actual
implementation over the next few years
and a bit actually surprising to me of
the 21
Senate that they actually already
allocated half a million dollars or more
to address the changes that are required
by this effort over the next few years
so budgets already starting to be
allocated when we started to ask the
question of what are you doing what does
preparing mean I think you got what
would be expected with the GDP are not
finalized the number of drafts still
being worked you had a lot of responses
that were kind of more in the background
preparation area the first and highest
of which was kind of reviewing IT system
security systems where data is making
certain that you had a good baseline
knowledge of what was happening inside
your enterprise and I won't read all of
these some of the other ones we're going
to be briefed and started to share what
this means with management with the
board of directors you're researching
the changes the second area that we
highlighted here in the twenty-four
percent bucket it's kind of the one
question that we specifically had put in
there to ask about implementation they
kind of took you the step beyond the
preparation the background information
the educating of teams and that question
really got it are you implementing
changes today to start to to impact
things and get ready even though the GDP
are hadn't been finalized the
twenty-four percent of people actually
said they were already starting to take
actions today to try and work to address
it when we got into what are the key
concern areas within the regulation and
asking those types of questions not
surprisingly i think the level of fines
and the ability to for dps do fine
companies for non-compliance was the
biggest issue at forty-two percent
tighter consent requirements came in
second at thirty-seven percent and of
course we asked kind of the opposite
question how many of you are concerned
at all about any of these proposed
changes and that was six percent so
either we've got a very slim number of
companies that are incredibly well
prepared and have everything totally
dialed for that group is probably really
in need of additional awareness because
there are quite a number of changes as
we all know in the GDP are when we ask
companies what help is needed what are
you looking to get assistance on I think
the first two were really really not
surprised
I need the second one fifty three
percent more information on what the
changes are understanding what the final
draft is and then the biggest one at
fifty-five percent not alone you I need
to know what's legally in the document i
need to understand you know what does
that implementation what are the faq is
around it what are the things you
typically see soon after any regulation
is passed that starts to give guidance
by DPA etc on what what to really do and
what is expected of you to achieve those
compliance guidelines but the
third-highest one that jumped out was I
think this realization that a lot of
privacy programs are kind of run on you
know Word documents spreadsheets
SharePoint things of that nature and
with something as comprehensive as the
GDP are there was really a need to start
thinking about how do I in order to
scale its across my full enterprise and
make it work on a day-in day-out basis
which is kind of more required by by the
regulation how do i implement technology
to help me meet these compliance
requirements and I've always said you
know coming with my security background
privacy to me is kind of like security
by 15 or 20 years in terms of technology
implementation mething companies were
starting to say and highlight that that
was the types of things that they needed
and last year from for me to raise the
back up a level interestingly almost
three quarters of people said the GDP
are is the most important change in data
privacy legislation in the last 20 years
really at a global level they believe
that the regulation has kind of true
teats with the defining numbers that are
being talked about in terms of
percentage of global turnover and there
was also this belief that the
seventy-seven percent level that it
would actively be enforced by regulators
with the vast majority of people saying
that enforcement would be much stronger
and much more robust than it wasn't
things like the cookie directive they
also believe that they would spend more
on is obviously as it's a much more
comprehensive regulation than the cookie
directive was on last year over fifty
percent of people said they were placing
a high or very high in the corporate
risk register and I think one of the
things that that I see is companies at
least in the US when they do their kind
of government financial filings with the
SEC is a publicly traded company your
sir
to see privacy points hit the risk
factors that are shared with investors
and shared with the investment community
and I originally started my career as an
investment banker and we all know that
when things hit that top of the line
list that are shared with investors that
it's really starting to kind of get
mindshare inside the enterprise so
hopefully that is a helpful backdrop in
terms of what we're seeing generally I'm
going to turn it over to Caroline now to
get into details and examples of what
you're seeing from companies in the EU
Caroline take it away thank you so I
will bring you some information around
what it is that we are doing internally
our configuration seeing on this but I
would also start with a bit of a
background in general because I think
that data privacy in general of course
means an interest interest here and we
can see that from the consumers from
media partners and such and the young
public they are all also in Europe right
now becoming more and more aware of the
privacy issues so the GDP are the safe
harbor all these developments that the
bid's had over the phone now in general
creates very much positive focus on only
suspect so with increased focus of
course and the tension also comes better
understanding and focus for being the
organization so how do you use this then
we use this in order to try to
communicate internally to say that we
need to transform the potential risks
that we see here into a competitive
advantage basically it will be something
that's both positive for us if we can be
prepared and started early in trying to
to Amendola the processes or systems
that will be necessary so even if you
perhaps compel the data protection or
data privacy itself within the
organization sometimes it's easier to
just sell the nice idea of a happy cat
tomorrow happy member or or user the
accountability of course is an important
aspect of this it's one of the basic
principles that did CPR brings and we
can actually now then also see and they
indicate text it contains so many things
but one thing is that if it's important
in order to build trust or relationships
with the the consumers and merchants
partners and regulators etc so by
actually being able to demonstrate
accountability and being able to say
already now that we are focused on this
and that we are focused on being
compliant or stay in compliance so
bringing more compliance from a data
privacy perspective means that we can
also then build good and early
relationships with the regulator's this
is something of course that was a bit
different in the various jurisdictions
in Europe we have already today
regulators with a very different
approach in some areas specifically in
in the Nordic areas in the Nordics the
regulators are perhaps not so visible as
for instance in in Germany or in the UK
you're from but nevertheless it's always
important we should also keep in mind of
course it also the regulator's right now
are striving in order to learn more to
adapt them to find new ways and reassess
practices etc so it could actually be a
very good thing for for building a good
relationship to try to reach out to the
regulator's already now but it's
important from my perspective within the
organization is that the heat
application is so much more than than
just compliance in our internal dialogue
I found it very important to highlight
that in every
how this is related East you you meet of
course also to take so many other
factors into account and what comes out
in the end is very much a complex
picture of various needs right now we
are making changes to one of the
variables into the ear regulation and I
can see now that's actually then it's a
bit of text missing on the slide but in
the left corner of the picture in the
three doctors should be text playing
local and global legislation so we see
some changes in the regulatory framework
but it does not necessarily mean the
whole picture changes so we have to stay
cool but focus on the important aspects
here and yet again as just mentioned
good previous effective is actually
something that we're starting to become
also a usual casting need a business
need etc so hopefully it will provide
regiments some good arguments that you
can use for highlighting internally that
need to change so where would I start
then um in the yes I would start by
using the existing rushing are there any
gaps today when you talked about the if
we compare the GDP are to the present
directive still there are so many basic
principles that there are still relevant
for what we need to do with the data how
we are able to process the data how we
can transfer it cetera and for large
organizations then Pamela would say that
the DPO if you have one on board should
already perhaps make an initial
assessment the DPO often this business
best and may have all the tools
available for actually trying to make a
gap analysis of already
what we might be lacking in relation to
the present regime I think that would be
a good start I think also that it's very
important to make friends internally
this is something that we have found
that it's important to be very handsome
to stay visible to build around us and
to try to educate of course about the
upcoming challenges the reason perhaps
see and this goes for everyone both of
the executive level littlest I in
universities with products technicians
in engineering HR and other and other
places for small organizations from the
other hand kept this is a bit more of a
challenge if you don't have already a DP
0 in place but still I would say that
it's important to try to identify the
major issues that you might already have
with regards to the gap already in
relation to the present regime so it
could be an idea of course to return to
the next dollar lawyer Princeton or
other consulting firm but also I would
like to mention specifically the local
DPO organizations like the Swedish data
protection forum that I represent myself
I would say that it's important to try
to to lace to learn to analyze together
and to to some extent to some extent to
try to find a jointly a way forward in
this the sanctions of course use the
sanctions as an example of why you do
need some extra attention on these
issues management and board should be
aware as privacy issues are right now
moving from something that is a human
right into you but it's also becoming a
corporate risk that needs attention so
if like this to to management hopefully
then you will get you don't already have
a DP
in office you have a good chance of
getting one you need at least a proper
budget so that you are able to actually
try to address these issues going
forward if possible I would like to
mention permanent the DPO in place is a
very important factor in this from my
perspective / sickness also that you
would have someone internally actually
owns these issues so going forward we
will perhaps see that there will be at
least partly some organizations for
which it would be mandatory to have a DP
always in place but nevertheless still
find it important just for ownership
around diseases you what we have been
but where started to focus on already
then in klarna with the next step is
towards in math and analyze of course we
are starting to document and analyze how
how we process data and where we have
perhaps gaps that we need to attend to
did a lifecycle management in general if
something of course that is it was
important to focus on but from our
perspective we are perhaps putting a bit
extra effort into this right now in the
next place we are also focusing on
vendor or supplier management and we are
setting a strategy specifically product
for organizations that heavily depend
from suppliers for instance it's of
course important to make sure that you
focus on them from the European
perspective this is sometimes a
challenge when we see a large us
suppliers with a bit of a different
approach to data privacy so they could
need some extra attention like now on
the sea GDP are moving on data breach
and th provided by design etc
all these aspects that entails somehow
new technical aspects or new procedures
in place we watch me take some extra
time probably within an organization we
are already starting focusing on this
trademark trying to see what you can do
in order to to put in place more more
clear processes sopia we will be using a
technical tool but anyhow how you choose
to do this or which other possibilities
you might have internally whether it's a
large original company it's still
something but I think it's in post it's
important to start focusing on quickly
because it will take some time clicking
into town for instance ongoing
procurement for new systems it would be
an idiot or webinar think about that the
new or the changed requirements for pro
these systems international transfers of
course it's a specific challenge right
now we have the safe harbor that brought
from from a positive view a side effect
that it attracted some attention such as
I suddenly almost every company was
focusing on this issue there was at
least information around international
transfers and the challenges on that the
safe harbor decision but it means also
that companies need to have some kind of
a strategy around both short-term
long-term strategy standard contextual
closest of course being a possibility
right now but how do we use this going
forward we have to map your your
requirements in relation to the
potential changes of course let's see
what you need in terms of transfer for
us specifically for Clara we were lucky
we already had quite a good focus on
this is harbour if you wanna go
we already had established some new ways
of being able to transfer in some
negotiation we also built a service
specifically to platform so you need to
focus on this and see perhaps if there
is something that you might need to
attend to before urgently specifically
then I would like to mention that hands
on right now to try to bring awareness
and some information on GDP are within
the organization is quite important even
though the details perhaps might be not
that clear even though we might see them
in a week's time still as I can it's
important to make sure that everyone in
the organization and run really
different things at least know that
something is going on it gives us some
assurance about that there will not be
ongoing procurement or ongoing
investments in various platforms etc
that we at least don't know about so
that we are able to to be part of the
discussions and to provide some man
advice that we are also placing extra
focus on data management registered in
in Sweden having a DP 0 means because if
we already need to maintain a register
of ongoing data processing activities
but we are expanding the scope this is
an important thing strument for us and
it means that we have both or at least
the relevant information assembled in
one place for many of our are important
systems so it makes us a bit it gives us
the possibility of being able to manage
challenges in some aspects whether it is
around transfers or absorbing or over
some other kind
it also gives us the possibility to be
able to audit my government of course
but also to to place extra attention or
being training principles to specific
teams we are also investing in even more
effective annual supply management we
have identified a great number of
important service providers and we are
dealing with them then specifically
moment trying to place extra space God's
around our corporation we are also
focusing on extra checkpoints we are
reinforcing the functional radius for
Clara being and a credit market company
it means that we already have purchases
around distant place but this is an
important to thrust in order again to be
more awareness to the teens and to the
different parts of the organization in
general we are also finding
responsibility throughout the
organization working a lot with our data
protection champion it can network with
ambassadors that we have throughout the
organization for for Venice to roll up
and to to be able to say very much
Hansel finally I would just like to
mention that two years will go fast so
take this opportunity to benchmark
against the existing directive of motion
do you like something try to find out
what and make sure that you have it in
place also to cooperate industry-wide
and regional research I work with the
DPO organization also attracted to
cooperate designed finding best
practices and a good way forward and
then I would like specifically to say
that actually this is not just scary but
it's actually quite fun this is very
interesting time
they very much is happening in our area
right now it's it's quite exciting don't
forget that and with that I am handing
over to market for the US side of things
thanks Carolyn I think Carol I think
your point is true I think there's more
I've seen more movements and more
happenings in the last several weeks in
privacy than we've seen over some years
so I think everyone you know don't be
daunted by this but also don't don't you
know don't be don't be frozen by it
either Carolyn's list there is pretty
good I'm not you know I mean from a u.s.
perspective if you were to take her
slide there and make a checklist out of
it quite frankly you'd be in good shape
but I think you have to almost roll back
a step my direct experience having been
a consultant for as long as I was and
then if you look at the results of the
survey tells me that US companies even
though we've had the regulation in place
we've had safe harbor in place for years
just like it was with socks and the
other issues US companies tend to do the
bare minimum to meet an obligation and
privacy is one of those areas I think US
companies for the most part obviously if
they're only us focus are going to have
a very minimal privacy program but even
though ones that have a foothold in
Europe have done the minimum amount to
get ready or to be quote compliant with
either their countries whatever a
country in Europe they operate their law
their implementation of the regulation
or if it was safe harbor to meet the
minimal safe harbor so I think the first
step i would take would be to really do
a self-assessment you know sit down over
your favorite beverage here in the next
day or two whether it's coffee in the
morning or IPA at night
and say what is are you know what is my
team look like what is our team look
like and more importantly what does our
business do where are we operating what
date are we collecting where are we
collecting it how we're using it you
don't have to do a full data map to know
all that you should if you've been with
your company in and doing privacy for
any great length of time and you should
be able to answer some of those
questions and I think that'll help you
assess kind of where to start because I
think what's going to happen here and
keep in mind i have been notoriously and
publicly very bearish on both the
regulation or the gdp are actually
kicking in but i think we've seen
movement the last week or so and even
the statements yesterday that show a
Europe willing to to move and get
something implemented and I think the
safe harbor the schrems decision shows a
willingness to now stop talking about
enforcing an increasing privacy but
actually doing something so i think the
times have changed so i think you have
to just have a conversation with your
team with yourself and figure out where
you're at and then the next step is to
obviously make sure that your leadership
wherever privacy is positioned in your
company because privacy sits in various
different places sometimes it's illegal
like it is view Bay sometimes it's in
the business sometimes it's bifurcated
and even try fricative as it is at
Facebook so start having conversations
up your up your leadership chain and let
them know what's coming let them know
some of the key areas you don't to get
into details but give them big picture
ideas and tell them you're working on it
but that there's going to be some
significant changes they're going to
take place I think you start to having
that education now I think the other key
is is if you do operate in Europe and if
you don't have a good relationship with
your primary data protection authority I
would suggest getting one in place
really quickly whether that's your your
European team reaching out whether
that's you
I'm sitting all fly to Europe suddenly
but I think if you if you're not on good
terms and haven't had a good working
relationship with your at least your
primary dpa you need to start having
that because they're going to be key to
your your relationship and your ability
to comply with this new set of regulars
new regulation going forward the DPO
registration i think is an interesting
subject i saw some questions on it about
do we have to have it are we required I
think there's some I think there's
already I think is always some pretty
clear guidance on when you need a DP 0
and if you've gotta know if you're a
major US company without with a with a
European data controller you know you're
in Ireland or you're in the United
Kingdom or you're in Luxembourg like we
are you know you had you pretty clearly
have it to have a requirement to already
have a DP 0 so whether that's your
European Council or your European
privacy head serving as a DP 0 as we do
on our business side or hiring a
consultant to do your DP 0 work as which
is what we do in some jurisdictions for
our employee work because a lot of the
focus is on user data but there's also a
whole probably a whole other webinar we
could have on employee data I think so
with that said I think you know you look
at your staffing once it once you've
done your self-assessment how are you
positioned in Europe do you have one
person five people know people and then
I really think the next step here and
I've seen a couple of questions on data
life cycle management and data mapping
in inventory controls and how do you
start there's various ways to do this
again I think there's some high-level
very basic data mapping that can be done
look at your websites look at all your
collection points those should be fairly
logical try to get an idea of what your
notices save those collection points
because what's going to be key for the
regulation as Carolyn points out is the
ability to document your appropriate
processing of data and that's going to
be a kind of a hate to use a pun kind of
be a foreign concept for a lot of US
companies that means you're going to
have to be able to show if ass
for all of the personal information
you've collected you most likely had a
notice and you gave some indication to
the data subject of the purposes of that
of that club that why you were
collecting and what you're going to do
it how you process it and your data
mapping however you do it automated
through tools like people like trustee
have or some other people or manual or a
combination of both essentially what you
want your data map or your data
inventory to show is what data was
collected and what were the purposes
that it was collected under and how is
it being used in the organization where
is it being stored who has access to it
how is it classified how long are you
retaining it so I think there's some
really some five or six basic questions
around a lifecycle collection use
retention and deletion disclosure and
security that if you have a basic data
map in place or at least an ability to
start one that's going to be I think
ultimately a requirement on an ongoing
basis once the once that the regulation
becomes fully effective but it's also
going to help you now in preparing to
look at some of the other aspects of of
compliance sorry I'm having to click and
talk it's not a good so um you know
substantively we you know I think we the
latest draft I've seen in my team my
European team has passed to me is a
November 15th draft I think you need to
get familiar with that draft whether you
do it directly or you get one of your
outside councils to give you a summary
or your European team to give you a
summary but I think you need to get at
least familiar with that draft there's
no guarantee that that's the draft we're
going to see but again based on the
statements yesterday I think we're
pretty close I don't know if we're truly
talking final passage final approval in
the next month I'm not sure how much
more changes to the draft we're going to
see I think some of the big picture
items are there so I think you can start
getting familiar with it now
your gr team again I I put this bullet
in quite frankly before the statements
of yesterday in Silicon Valley this was
to really stay engaging gr team because
of the process I don't know if any of
you have been having your gr team
involved but there has been some ability
i think by industry to affect some of
the provisions i think we're looking at
a draft that was actually written with
some good input from some trade
industries and trade associations and
from from US companies so hopefully that
will continue right until the end and
like i said previously start now having
a conversation with your management
about big picture items stuff that's can
come and if you can start a gap
assessment obviously on the november
version that would be kind of bonus i
will say i think subjective lee one of
the big issues that you're going to have
is knowing what changes you're going to
have to make to your that you can
control implementing a PIAA process
doing a data life cycle management you
know doing the things that are pro
privacy program based that you hopefully
can control through your budget and your
workforce but there's going to be a lot
more that's going to need to change that
the business is going to have to be
aware of and agree to product changes I
think explicit consent for marketing
it's going to be one of those areas most
US companies operate in an opt-out basis
I think between the two changes we're
seeing here with the GDP are as well as
the changes in Castle I don't know if
any of you're aware but come 2017 in
Canada you're going to need pretty much
express consent for commercial
commercial messaging so i think the the
do the the tide has changed and this
concept of opt-out just people
automatically by use of a service or
registration for a service automatically
receiving email marketing but being able
to up data i think those times are
coming to an end and so I think you're
going to have that's one of the key
areas i would start having a
conversation with your business because
that's it usually a big pain point
people usually point to that being
depending on your business model but for
come
like eBay being able to market to and
contact and encourage use of the site
that's the whole reason we're in
business so I'm going to wrap up here
I'm getting I'm getting the hook I think
again that checklist from if you look at
my slides mine or more kind of process
what to do sort of phase 1 phase 2 phase
3 but really do something I think my
last slide here 2018 you know that's
this is really going to depend on when
it kicks in but we're looking most
likely based on the current timeline
early 2018 but that isn't wait till then
to do it there's going to be a phased-in
approach and I will mean by early 2018
you'll have to have everything in place
to meet the the submissive parts of the
regulation so again I would start now I
wouldn't panic but I would definitely
start thinking about privacy on a much
different level than we've thought about
it previously Dave back to you I'll jump
in is a got one more page here before I
jump into some of the questions and this
is Chris again thanks Marcus thanks
Caroline for the perspectives I think we
had had an event in san francisco on
tuesday where literally had WebEx into
it and shared a bunch of of feedback and
I've included some of the quotes here on
the page on the left here he went off a
little bit and said some things a
highlight that weren't quite in the
exact messaging but I think the key is
first point eat it kind of explicitly
said it was the most strong I've heard
from a European saying you know next
week just in time for Christmas we
expect the parliament and council
tribution of political agreement on the
GDP arch so that was the strongest
messaging I heard that this is going to
be in kind of final form as of next week
and he'd even joked that you know Santa
Claus was going to come a few days early
and deliver a gift when you made it
verbal comments I think that he outlined
a timeline that had said you know final
adoption of the regulation will take a
few more months he was pointing to April
or May of 2016 with full kind of
applicability
enforcement starting two years later he
was questioned in that session about you
know we've heard it being pulled up and
trying to be made 18 months is there any
possibility for that and he said well
that's still in discussion he was pretty
firm in his belief that it was going to
be kind of two-year window upon which to
get these things in process because
there isn't understanding that there's
quite a number of changes in the current
versions of the regulation as they come
together in the last but not least she'd
certainly I would say and I saw it
covered by some reporters there he was
give him pretty stern warning saying you
know get going now like even reference
back to saying don't do what happened
with the you safe harbor where everyone
waited in that but I came in slate you
know us companies complained and said
I'm not ready he said you've got the two
years use them wisely as the enforcement
date will be one that won't move there's
going to be links to that presentation
that he gave on the trustee site they're
not up quite yet we're still pulling it
together but you can look there on the
next few days for it and then also here
on the on the right part of this page
there's a link but you can also just go
to the general trustee site look under
business resources and research and you
can get the full version of the research
that I was talking from from earlier so
we have a number of questions let's dive
right into them first maybe back to
Marcus and Carolina a bunch of questions
I'm kind of you know and you've talked a
little bit about this but I think they
were even the next level down its
specificity on you know how do you
really do these things like do you look
specifically to external tools of x and
y and z do you use any technologies to
do this is a kind of a dhaka methodology
a lot of questions on the you know
technology side of you know what do you
use and how do you do it um yes there's
a mix of course and it depends also very
much on the size of the company we have
shoots and basically to work went to
electronic tools one is the data
management object that we call it but
the data management register where we
assemble lots of information around
a shape when their legal grounds for for
the processing of the personal data
contained in the register various
assessments that have been made if there
is perhaps a mild sourcing relevant for
that in a data protection if there is
any agreements in relating in
relationship to that that needs to be
covered at such as we try to assemble
cannibal information in one place next
phase we will also start using a system
of alerts in this so we will include
this in our in our scheduled plans for
revision by the global privacy office so
it means that it will actually start
taking out whenever we see that there
are there is a need for review
furthermore we are also specifically
implementing an electronic tool for
privacy impact assessment we found that
to be quite effective and it brings so
many other aspects to this not in
practice just to be able to administrate
the administer that the pier process but
also again for training for awareness
for simplicity actually also being a
tech company it's easier I've handed to
implement a tool then even if it's
simple word or excel sheet so we have
pretty much most of the processes around
these two electronic tools I think from
my perspective Chris I think for when
you're looking you're talking about data
mapping I think you need to partner with
your info SEC they should already be
worried about what what days of the
company has where it's where it's at how
it's classified and how it's being
protected I mean one can assume that you
have an infosec that has data
classification data handling standards I
mean and again from the privacy team
isn't you know while security is an
element of privacy we don't own we don't
own the frontline doing that so my first
my first reaction would be partner with
them are they already utilizing a tool
process or a consultant and can you
either leverage that get involved in
that make that better that's our
situation at ebay we've the team privacy
is does own data mapping and we've got
infosec rafael and doing its own and
we're trying to pull those two processes
together because again i think the key
for the regulation purposes it's why
people do a data mapping or an inventory
and it sits on the shelf moonshell the
infamous shelf where meaning it doesn't
get updated it's not a living breathing
document that's not going to do you any
good I'm having a snapshot in time you
know just like you know we do it like a
pci assessment having a snapshot of your
of your your infrastructure on you know
january 15 2016 is not going to help you
it's going to be out of date a day later
soon as somebody makes a change to a
system or act as a new collection point
so it's got to live and breathe again
whether there's tools out there you know
obviously GRC tools like Archer or
Orbison pages or what have you there's
some off-the-shelf stuff be wary of
consultants I think it's um there's a
lot of vapor where a lot people sell you
on their process and stuff you can
probably do on your own I think with
some creativity where's got a bit as i
reflect the nature of your business and
the nature of your your data life cycle
management i think one thing I'd add to
that kind of stepping out of the
moderator rule for a second putting on
my you know trust you supporting
thousands of customers and thinking
about this I think a lot of people have
looked at tools and technologies and in
the past used like I referenced earlier
you know things like Word Excel pure
point etc which I think are great spot
to get you started when it comes to
technology we've seen a number of
companies like said Marcus as part of a
broader company-wide implementation of
GRC system kind of use that as a method
to kind of try to run a compliance
process around pias but are oftentimes
challenged in a sentence that the
privacy content isn't in there to really
help people get over the hump and I know
Clara has used some technologies we
built the
you can see on our site called privacy
assessment automation and helping you do
pias encourage people looking at that to
take a look and that'll be my my one
little sales pitch for a great
technology that we think has helped
companies as small as 100 hundred and
fifty since I launched in march of
earlier this year all the way up to
companies that have a hundred thousand
plus employees and helping them related
through this process and automate it
jumping around to two other questions
this one Marcus I might seem a bit more
at you I know that you have your VCR
you've had it for quite some time I
think there was a question around you
know does the GDP are have kind of
applicability you make any major changes
to someone that either has a VCR like
yourself or more broadly someone that
may be thinking about a VCR yeah I think
it's unclear at this point what the
impact and ocean questions on you know
as not only a country level adequacy you
know the EC has a list of countries that
considers adequate for dead transfers I
think some about the joke I mean endures
on there for crying out loud I mean but
I think also on the remaining 23
adequacy mechanisms you know will you
have to reset I would assume that any
discussion of a new safe harbor 2 point
0 would be if they're smart the
substance of that program would be
written around the GTR but I will also
assume that you know the standard
contract clauses will themselves be
modified then that leaves the binding
corporate rules I mean the binding
global rules for the most guys aren't
written in a very tactical way I mean if
you've read anyone's VCRs they're not
they're not a privacy policies or
standard there are there a high-level
sort of mission statements you know
privacy Constitution if you will but we
are I can tell you we are contemplating
a BCR refresh once the GDP are is
finalized most likely to look to have a
revised commitment because that's really
what a VCR is it's a company's corporate
commitment to privacy at a corporate
level we're going to revise our bcrs
give more of a facelift to them
hopefully timed around the final
implementation
we haven't been told absolutely we have
to do that bar our primary dppa and the
two backup jurisdictions but we feel
that something that you should you
should consider so yeah anyone who's on
the call I be relatively shocked that
there were many BCR shops on the call
but if there are congratulations and
yeah i would consider along with one of
your items maybe not the highest
priority but one of your items would be
to take a look sensitively at your VCRs
and say is there anything we're going to
need to get get a refresh on keeping in
mind the BCR process is lengthy and
again really relies on your relationship
with your dps everyone I didn't mean to
exclude you from that question but
anything you'd like to add there um well
at the moment actually we are also
starting to think about BTW ours I think
it's a good approach in a good way for
but not just for major company but as
Marcus also pointed out that that is a
bit further down the road so from our
perspective we are waiting and seeing
but more what it what is happening in
general and as mentioned before what we
have picked up both for here and that
might be a specific Nordic issues in
Europe for this effect that also
actually the 30 pas are hesitant right
now so I would wait a little i before
perhaps approaching them on an issue
like that ah yeah and let me let me let
me let me read it I think that's what
best mean I have literally a slide deck
i'm working on for my general counsel
and i have just that statement but we're
not be i would not if I had a VCR in
place or even quite frankly a new VCR
application I would probably hold off
because you're going submitting it now
is going to just be in your in a clog
anyways and there no DPA is going to act
there's a lot of consensus seeking by
the GPAs and so I think you know you'd
be a little more repos phul i will say
let me I know that running low on time
but you know for years I had to defend
the VCRs and whether they were business
limiting and do we
really need them and in the last month
and a half God many a congratulatory
email on how great it was that we had
the VCR is in place so that's probably
turned pretty quickly I think you know
we are one of the other avenues that
might point out is you know through the
referential that was announced between
kind of the APEC and VCRs for companies
that you know could do a PEC type
certification we've seen one large
health related company use that as a way
to be going through the VCR process and
I think that there is absolutely synergy
there that we're seeing in terms of
being able to operationalize kind of one
effort that gets you a lot of cross
energy and then would you know once the
VCRs completed have good
interoperability of data transfer
between you know the 49 really kind of
biggest economies in the world and kind
of excluding India and that process was
moving kind of quite quickly and quite
inexpensively I think relative to other
VCRs that I've seen clients pursue it
absolutely got bogged down in the last
three to six months as all of the safe
harbor and other things have come along
so I agree with both of your comments of
if you're thinking about starting in one
regard you might be worried about you
safe harbors long-term sustainability
don't like model clauses want to get
started right away but I would reiterate
with both the others are saying and that
seems to be a process that has slowed
considerably given all the other issues
at hand Marcus you kind of seen one of
the other questions in here that I
wanted to pick up clearly a number of
canadians on the phone so to answer to
the questions there i think that were
relevant one is specific to our research
we did not include canada and the
research apologies is that offends one
up there but we didn't do that to that
specific question but when it comes to
the broader question or on adequacy with
us in the context of canada at our
events last tuesday again we'd ask some
of the Europeans kind of a specific
question of do the countries that are
deemed at equivalence that gdp are
happens that it kind of grandfathered in
as they currently are or does that
require you know kind of an update
across the board and a reassessment of
each of those adequacy findings and the
initial read back of the level you know
not quote the person because they also
said they need to go back and make
certain but the initial response was
that yes equus II would continue under
the GDP are passing but they were going
to confirm that so I think you might
know that the questions been asked see
further guidance when the GDP are comes
out or soon thereafter and some of the
fa cues that I think we all expect them
to be back to be dry I would yeah I
would think it would be to use a really
big word at nine o'clock good morning I
think it would be Polly anak to think
though that countries like Canada or
Australia that have fairly robust EU
centric privacy laws in pypy doll or in
the new apts I think it would be I think
you'll you'll see again maybe not
instantaneously but I think you'll see
you know hi Peter perhaps being updated
to to change to be more in line with
with the GPR I mean they already are in
the other 4matic assess the castle is a
much more burdensome marketing regime so
then I'll read it already kind of meat
you know they were almost ahead of the
gdp are in that sense so I think the
eyes with you mechanisms I mean Europe
has seen that the turmoil that getting
rid of safe harbor overnight cause
they're not going to get rid of these
adequacy determinations the EC won't
because it's an EC discussion really
working with a 29 group not annual
lateral you know the trams with a
unilateral you know and then the ecj
supporting that action so I think the
adequacy mechanisms are fine I think if
you bring your program at the speed with
the GDP are you won't really have to
worry about in any way good thanks for
that I know we're here at the top of the
hour I've got one last question for you
to upload a little bit if you had to
pick kind of in all the things out there
in the GDP are and there are certainly a
lot of changes if you had to very
quickly just pick one on the pro one on
the slip on the con side what's the
what's the one that's kind of easy that
you've got nailed that you don't think
as much for you know a typical business
like yours to to worry about because you
would have done it in the past or what
have you and what's the one that when
you look at you think is
and operationally most burdensome just
in terms of highlighting maybe some
areas that the companies can you know
start their focus on if they look and
feel like like you that for me correct i
think will be easy even if the
low-hanging fruit for us is obviously
the DPL work we've already got a robust
network of DPOs in place based on our
data controller structures so i'm not
too concerned about that there wasn't a
lot of talk of them now you know single
jurisdiction or you know what let dtas
are you now going to be going to be
going to be regulated by is it now your
your home country or is it every DPA so
that's concerned the con i think the
hardest is going to be quite frankly i
have that debate i'd have to split that
between an actual real robust data
control data inventory processes that's
living breathing and at any point can
show you know can be a convenience of
processing authorization and or building
and implementing a true privacy true
privacy by design program yes and i can
only echo that because i still also
think under the present regime privacy
by design it's it's so very much a
challenge and perhaps not so much
actually because of their sexual
regulation and the upcoming text
potentially but in practice to actually
solve the the challenge in practice to
get from the global privacy or first
corner to the team the technical teams
in how to actually implement this all
the way down if anyone has the answer on
that in practice please give menina
north called and then for for the upside
i think yes accountability and the
documentation i think it's good it's
very relevant and it's quite we are
already in practice to some extent there
and it's quite good actually good
starting points
and as I am speaking can I just as a
very last point mentioned that for this
more as i know in the knowledge there
are so many challenges too many
organizations that don't even have DPO
on board to that don't have a lawyer or
infotech person or anyone focusing on
this just start out by actually trying
to get ownership of that the privacy
invade the security aspects in general
and work from there but that's a
specific Europe and northern Europe is
your pet Dave I'll turn it back to you
but certainly try to do the best to get
through a number of these questions and
punch them together but certainly on my
we have if anyone has any additional
questions that we can be helpful with
emails on the screen and email away
should you have follow-up questions yes
thanks very much Chris and I was going
to echo that as well I'd like to thank
all of you out there in the virtual
audience for submitting such great
questions we got a lot of them and we
were Chris you did a great job and
handling a number of them combining them
but there are still some unanswered so
if you continue to have questions please
do feel free to send a note out to Chris
or Carolina Marcus and I'm sure they'll
do their best to to provide answers they
can and and with that a hearty thank you
Chris Caroline and Marcus for that
excellent view on an ever-evolving kind
of prognostication of what what's about
to happen I'm sure that books appreciate
your perspectives and for all of you out
there in the audience I hope that you
got at least some of what you were
looking for a big thank you to trustee
for supporting a program here for us at
the ITP we very much appreciate that and
for making this program free and
available to all of you again I hope you
have some viable takeaways from today's
program and I thank you to all of you
dialed in and took some time out of your
days to up to join us and on that note
if you wouldn't mind if you're still in
line with us just there's a link in
front of you it's literally a two minute
survey it's been timed we just want to
know how you enjoyed this program what
you thought of the speakers the content
and also importantly give us ideas about
what we might cover on these web
conference program
moving forward we constantly mind that
for ideas from you all out there who we
want to provide you with the information
you need to do your jobs so click on
over to that link take two minutes to
fill out that survey for us we very much
appreciate it and of course hey yes hey
Dave I'm willing to stay on I'm there's
some questions that went unanswered I
don't know if you want to end the
webinar let it go for another couple of
minutes if people still feel their
questions haven't answered I can try via
chat or it's up to you okay that's crazy
Marcus that's a very gracious offer we
certainly can't stay on the line for a
little bit let me just do some finishing
remarks here for those that need to drop
and then if you'd like to stay on line
up please do and we'll do what we can to
to cover some of these just quickly via
housekeeping if you are an IUP certified
privacy professional you're wondering
about cpe credits if you signed up for
the program and you're the named
registrant those will be granted to you
automatically there's nothing that you
need to do you will be that would just
be credited to you for your upkeep of
your certification and if you're
listening in but you didn't sign up you
weren't the named registrant you're
still eligible for those credits you
just need to click the live link in
front of you or go to our website under
the certification tab and there's a very
easy to fill out form there you can use
to receive those credits if you're an
attorney and you're wondering about
continuing legal education CLE credits
this program may or may not be eligible
for those I know that it often is these
programs often are eligible for those
credits but you don't pre certify them
so you will need to contact your
jurisdiction see what they require it
varies from jurisdiction to jurisdiction
and apply and hopefully be able to
receive those credits if you need
supporting materials in your
jurisdiction for instance copy of the
slides and or any other information
please contact me I'll do what I can to
help provide you with those supporting
materials my contact information is here
in front of you now feel free to call it
right we love to hear from you again how
you enjoyed this program and what you
might be looking for in the future and
we will be posting a recording of this
program approximately 48 hours from now
there's a link in front of you that will
take you to the trustee website where
you will be able to
load a copy of the report I believe the
size as well and a copy of this
recording if you missed it or wanted to
go back to review any of the information
so that's all the housekeeping that I
have and with that let's see Marcus is
there anything in particular that you
noticed in the question list here that
we didn't get to know you wanted to
tackle ah there was some discussions
that I incorrectly stated Castle yes I
know that the express consent mechanism
is actually required now but the teeth
when you're dealing with businesses that
rely on marketing until you tell them
there's an enforcement risk you're
you're not going to get people to move
so the 2017 mark is really what most
companies are pushing towards in terms
of implementation yeah if you can get
your business to implement an express
consent mechanism now for new users
moving forward or to refresh current
users that's a great idea it's just that
most businesses are going to want to
push back in here what the risks are so
that's around castle there was questions
about my statement about DPOs yeah it's
unclear again when i say operations in
it come come a country like ireland it
mean depends if you have an actual an
entity that's an actual irish data
controller then you're directly you know
you know monitored and controlled by the
irish DPA I was having DPO in places is
a good idea it may not be a requirement
it's me it may well become a requirement
under the GDP are simply having
operations in the country is not
sufficient we have operations and almost
all European companies countries but we
have our data controller structure is
set around a few key countries and then
there was some discussion about how you
get to G how you get a copy of the the
GDP are I would say oh there was a
question about what gr meant government
relations and I would say your
government if you have a government
relations team they should be up to
speed on the latest copy I think there's
probably a web page either the EC or
somebody probably has a web page with
the latest draft legislation like we
have in the US with pending legislation
and I also it will be reporting out on
it so keep an eye on our
publications page the news page of the
eye appt I'm sure we'll be providing
links for latest updates in the actual
regulation once it comes out and on that
my either I did it right there is mine
dropped so I'm out of i'm at a question
so there you go alright well that's
actually pretty good timing marcus and
thank you very much for staying online
and certain that cleaning up some of the
remaining questions and again if you do
have further questions or want a copy of
the slide deck please do email me my
email addresses for a simple it's dave
at IEP or gets right up there on the
screen in front of you and I'd be more
than happy to do what I can so really
appreciate all of you joining us today
and with that I think I'll take us to a
program close and hope to see you all on
some programs in the near future thanks
very much everybody and have a great
finish to the week