welcome to the IPP web conference no
opting out of CA CPAs data rights
brought to you today by big ID my name
is Dave Cohen I'm the ITV's knowledge
manager I'll be your host for today's
program we'll be getting started with
presentation in just a minute but before
we do AC program details participating
in today's program will automatically
provide IPP certified privacy
professionals for the named registrants
with 1c PE credit others who are
listening in can apply for that credit
through an easy-to-use online form on
our website
now select remaining at today's program
is being recorded and will be provided
free to registered attendees
approximately 48 hours following live
event we encourage you to ask questions
at any time during the program and to do
that you can just type them in the Q & A
field that's just to the right of your
PowerPoint window and your questions
will be answered by the presenters after
the presentation we may actually take
the questions in line too so please feel
free to ask the questions at any time
during the program and now with that I
would like to introduce today's panelist
Deb Farber is senior director of privacy
strategy a big ID Debra welcome to the
program today and can tell us a little
bit about your role over there at big
idea and also what you've done
previously thank you for having me it's
a big idea and senior director of
privacy strategy and I have the pleasure
of evangelizing privacy and life so
important for businesses to
operationalize and you know comply with
the various regulations out there
operationalize privacy dates caching
into their into their enterprises and
physicists I also work on you know salt
leadership around private by design and
private engineering and and such and
engage the legal community to make sure
they understand a lot about how big IDs
products can you know help be the
compliance with CCPA gdpr and other
privacy regulations
I've been a
I'm a lawyer by training but I've
actually not practiced that I went
straight into operationalizing privacy
and I've spent 14 years managing privacy
and security programs that companies
like visa IBM American Express trust arc
and the advisory board company I'm also
the vice chair of the US technology
advisory group which is providing
guidance on the global stage for the ISO
privacy by design standard and I'm
really excited to be here today terrific
this Dever it's great to have you with
us and joining Deborah on the panel
today Robert Glasser is a specialist
leader privacy and data protection cyber
risk services at Deloitte Robert welcome
to the program Nek tell us a little bit
about your professional background sure
so Robert glazier happy to meet
everybody virtually I've been with the
white for about six years having come
from industry with Deloitte I specialize
in assisting companies through the
assessment design and build and
operationalization of privacy programs
obviously for about the last two years
been doing primarily gdpr
presently moving heavily into CCPA prior
to joining to white I was she privacy
officer at Genentech and Roche USA prior
to that and have been in privacy since
about 2003 prior to that was a
healthcare CIO and spent 24 years in the
Navy so we've watched the world of
privacy evolve and this is a
continuation of that of evolution as
well as the professionalism of privacy
and I look forward to providing my
section of the presentation today
fantastic thanks Robert
and with that let's go ahead and get
started with the program and for that
I'm going to hand it off to Deborah
Deborah the floor is yours
wonderful thank you so we see CPA we've
got a new privacy sheriff in town right
compared to in the past where we've had
other regulators some of them sectoral
in the u.s. some of them global and
regional but in other countries here
we've got something that's very GDP our
life happening in the United States
there are new consumer data protection
rights and with data protection rights
that becomes obligations that for
companies so there's this consumers in
California or residents of California
have a right to know information that a
company is collect a personal
information that a company is collecting
about them right to access that
information a right to disclosure a
right to opt-out of sale of that
information and a right to have their
information deleted I'm going to go
through these briefly in the following
slides but what I want to you know for
each of these points here what I want
you to take away is that each of these
rights has obligations on the company so
now an organization needs to establish
and build and maintain a data inventory
in order to effectuate any of these
rights within the CCPA is an expanded
definition within the united states of
personal information it's very similar
to the GDP our definition and we'll
unpack that but personal information is
data that's linked or label to a
California consumer or household not
just identifiable or personally
identifiable information which most
[Music]
privacy laws in the United States had
had referred to in the past the world
will unpack what personal information
means and in the following fun
and so this establishes and you need to
determine and monitor the
identifiability
of all the data that an organization has
collected in addition there's actual
real enforcement here that this law has
teeth there are state attorney general
fine or violations and data breach
notification lapses per incident
beginning July 1st 2020 and even earlier
six months earlier from that is when
California consumers have the ability to
sue they have a private right of action
to see for privacy violations and
inadequate protection against breaches
so
that's coming up quickly January 1st
2020 and then lastly you know there
needs to be accountability and data
processing you know as we'll go through
this you'll see that it you need to
operationalize opt-out decisions and
then delineate between what information
is sold transferred and and just
generally process data
the first the right to know the CCPA
grants consumers the right to request
that businesses disclose the categories
and specific pieces of personal
information in the business have
collected about them so again with the
right to know comes a company's
obligation to disclose and you know
consumer has the ability to send a
request to say I'd like to know all the
information that he sent about me that
verifiable consumer request means that a
business must put processes in place to
be able to you know discuss what
categories of personal information that
is collected about him or her the
categories of the sources from which the
personal information was collected the
business purposes behind collecting that
personal information the categories of
third parties within the businesses has
shared that information and then the
specific pieces of personal information
and collected about the consumer so for
compliance it like information must be
updated at least every 12 months and
what that practically means is then when
this law goes into effect that I'm you
know January well when it goes into
effect would be regulators as of July
1st 2020 will say you know you you must
be able to upon when a consumer comes to
you with a request to exercise a right
to know request that you must have a
look that period of 12 months where
you're able to provide all that data
from the preceding 12 months that that
has been you know kept up to date in
your systems and so what that
practically means is that you don't have
that much time to get your house in
order to be able to provide this
information for this 12 month look-back
period in addition you know any
additional secondary uses of personal
data that are different from from which
you originally told them that you were
going to use the data at the point of
collecting that information and within
your privacy policy at the
collection you know you would now need
to provide notice to the consumer of
their rights and their right to know and
their right to you know request
information about them so you'll also
have to part of the right to know update
your privacy policies to explain the
rights of the individual or near this
meeting today um in addition there's a
right to access so in those consumer
requests you know kind of flows from the
previous slide but consumer requests a
copy of the specific personal
information that businesses retain about
him or her so the right to access isn't
just one of the categories
now it's okay you've got these
categories I'd like to know what
specific data you you hold about me
so the good thing is that you you know
consumers are only 11 if this request
twice in a year so it's not like they
can fill you with denial of service
attack level of request constantly
coming in over and over and over again
they're only allowed to legally you know
make these requests you know twice a
year however practically that means that
you'll need to have processes in place
to govern those requests to make sure
that those that the right to access is
being is actionable and so that you can
comply with the regulations businesses
must provide a California consumer with
access to personal information that's
held by the business and deliver it to
in a readily usable format that allows
porting the data to another entity
without vendors and so the what this
really is here within the right to
access there is this kind of implied
right to portability that's similar to
GE PR that allows me it allows you to be
able to receive that data in a way
that's readily usable that you can bring
and pour it over to another organization
information must be provided free of
charge
yeah that's pretty clear you can't
charge exorbitant fees to you know
deflate the cost of providing this
governance in the first place and Andy's
right there is an exception to that
right that your it's not applicable to
information that's collected for a
single transaction as long as the
information is not sold or retain for
the purpose of linking it to personal
information so for instance a great
example of this is a guest checkout
capability right you want to let's see I
want I don't want to login to a an
e-commerce company
I just want to one-time buy buy
something for it maybe it's a baby
registry and I don't have children so I
never really need to go back to this
particular website but I do want to buy
something in that one moment in time so
because I've never logged in I'm never
really maybe I'm never not fully
identified
I the business and it's just a one-time
transaction there's no need under the
law to maintain a record of that
particular transaction where they
couldn't identify me in the first place
what's also interesting to note about
the right to access is that unlike the
GDP RR there isn't a right to amend your
data if it's incorrect or right to you
know write of rectification which means
pretty much the right to amend your data
but that's what it's referred to in GPR
yeah it's not such a big deal since you
know one would assume it with all the
other requirements that a company has to
adhere to that you're not you know it
you wouldn't want to keep incorrect
information because you know Clint the
consumer would just leave and wouldn't
trust you anymore so the if you have to
provide the access and the ability to
delete the data in the first place you
might as well give incentivize people to
to you know be able to amend incorrect
data so that they don't request to have
it deleted to instill that trust but it
is it is important to note that that's
not a separate right under CPK um the
right to access also has so we talked
about the inside right of portability so
a business must provide a California
consumer with access to personal
information that's held by the business
and to obtain it in a readily usable
format that allows porting the data to
another entity the time traders without
hindrance so you can't spend you know
months and months this needs to be
something that's done without delay and
and you know without hindrances kind of
a legal term and that would be
determined by by other factors such as
case law and perhaps clarification from
the attorney attorney general and future
they make this request to business
emergent right here okay we already went
over that and the business was not
required to include data that are
obtained in a one-time transaction or
this was kind of flowing from the other
slide is a little redundant but they're
also not required to re-identify or link
information that is not already an
identifiable form so you know the big
takeaway is here that you know prepare
don't panic if you've already been
working on gdpr compliance you've gotten
a lot of the way there in terms of
operationalizing and data protection
right within your enterprise because it
was really where we need the privacy
office the attorneys the policy folks
within the organization to work hand and
hand with the more technical folks in
the organization to you make your
private engineers or your IT team to
make all the required governance changes
and you know basically to operations you
to make sure you have the capabilities
on our opt-outs the ability to address
the access and deletion request that
scale and with minimal impact to the
business and to collect the so I can
operationalize all off that request for
the sales consumers so one of the things
I didn't have a slide key but I was like
because out here is that for that
consumers have the right to opt out of
the sale of consumers personal
information and so as part of that it's
similar to GDP ours right to withdraw
consent except that it only applies to
the sale of information you don't have a
right to opt out of all things with
under CCPA but what you do for the sale
of consumer information so let's unpack
that a little bit when an organization
size rents or stones personal
information of other companies the Act
requires them to keep a record of all
sales for 12 months and to provide a
clear and conspicuous link on its
website with the call to action do not
sell my personal information
so that people may easily opt out of
that practice if they want to and then
CS requires even more of those that sell
the personal information of children who
are 16 years old or younger and then
this link or button you know other you
know permission requests that that you
kind of baked into your user experience
which surely you raised privacy concerns
for many potential clients and prospects
and that could you know result in a loss
of their trust so as you would imagine
as the passage of CCPA is kind of
shining a light on the practice ism
data brokers and advertisers you know
there's there's going to be a great many
California consumers that will make
request that their data and not be sold
and then maybe reevaluate the business
model or I should say company should
really Eights their business model now
prepare and implement changes before the
2020 enforcement date because the act
appears to also undercut our current
self regulatory advertising framework in
the u.s. there aren't laws in the United
States that really regulate advertising
and privacy so much as it was a self
regulatory model and now the California
law is kind of appending that and so
it'll it'll be interesting to watch how
the industry practices are going to as
almost like you know right now you also
meet under CCP a you are allowed to
collect affirmative operations from
children between the ages of 13 of 16 to
sell their personal information so now
you also have to manage they're off in
which are have the legal hurdle of
having to the affirmative authorization
so you know basically under the ass a
covered business shall not sell the
personal information of consumers if the
business has actual knowledge that the
consumer is under the age of 16 years of
age
affirmative authorization of the sale of
personal information has been granted
and so you know similar to Coppa the
Children's Online Privacy Protection Act
businesses are required to get opt-in
consent for children under the age of 13
except the CCPA then carves out this
other exception that's very different
from like gdpr right we're children
between the ages of 13 and 16 have this
other kind of ability to affirmatively
authorized a business to sell their
personal information without parental
consent and so to comply with this
provision like companies that sell
personal information or you don't like
data brokers and advertisers must put in
place processes and technology that can
detect whether they capture or infer
infer of the ages of children under 16
years old to even imagine with gaming
companies as well this would be
applicable so next the those companies
will need to decide you know does it
make sense to sell this theater or you
know should we stop doing that
you know from these consumers or should
we implement effective consent
management and auditing process is to
manage often affirmative authorization
to sell personal information so you know
you should start preparing now not panic
understand the regulatory space and then
determine what technologies you're going
to use to help with automating some of
this and after I pass the baton over to
Robert you know I will come back and
talk about big ID and how we address
some of these areas but for now I'm
going to leave you with the deletion
aspect so you have the right to delete
personal information if the business is
not required by law to retain and then
privacy
let's see privacy compliance and CCPA
goes beyond traditional notice and
choice requirements right now as it's
today CCPA is really around the ability
to put control back into the hands of
the consumers around there the data that
they've provided data about them and to
really effectuate be that control
through
opt-ins opt out and you know the data
protection rights granted on your CCPA
and so with that Robert to you thanks a
bunch and appreciate it Deborah a lot of
what Deborah just said lends itself to
my portion of the presentation which is
more operational and operational
considerations so the first thing I
wanted to say is readiness takes a
village as we found what GDP are it's
not just IT it's not just compliance
it's not just legal it's not just
procurement it's not just human
resources but to appropriately to
appropriately approach CCPA
it's got to be an organization with wide
endeavor and with that then the
organization has to make some
foundational decisions are we going to
approach California uniquely are we
going to approach California in
conjunction with our other
jurisdictional requirements and are we
going to approach California as part of
our global program we oftentimes while
dealing with GDP are engagements and we
Deloitte did about 250 of those over the
past couple of years saw that the
companies that were most successful had
a leadership view into the mechanisms of
compliance many times had centralized
funding and in fact it was IT and
technology where the bulk of the spend
was versus operationalization or
administrative type procedures basically
to do this you're going to have to use
it from the perspective of the entire
organization from a resource perspective
both human and financial and where
California goes the rest of the nation
could follow or tends to follow if you
think about it California had the first
data breach law in the country we now
have 50 states with data breach laws
many of which almost verbatim follow
California
corny has the confidentiality of Medical
Information Act and while that is a
carve-out under CCPA the reality is as
other accountants other states have put
in law specifically health information
Texas for example and their health and
safety code 181 so where G where Europe
goes much of the world follows and we
see that that where California goes much
of the u.s. follows and we have to also
take into consideration that our own
federal government is finally appearing
to get serious about a federal law so
you have to take that into account when
you tie it back to California has a
strong history of enforcement in
California Massachusetts Connecticut New
York many of those states are leading
the way in terms of the actions of their
attorneys general and how they take care
of their citizenry and for the record
you know California in this is
extraterritorial much like gdpr is
because the definition of a California
resident defers to the california tax
code which essentially says that if you
pay taxes in the state of california
you're a resident and we're waiting on
clarification for for those types of
questions but in theory there could be a
student at the University of North
Carolina who had a summer job in
California who pays taxes I as a
consultant pay taxes in California so
the definition of a resident is very
wide-ranging and you can't just think
about the borders of California and then
you also have to think about the
assertiveness of how California has
traditionally enforced its regulations
and then lastly as Deborah mentioned a
while ago it has owner US and European
mic requirements we we say that it
brings European GDP our to the United
States and while it's not a hundred
percent GDP are there is a a ven overlap
of the requirements that are common
amongst GDP are and the California CCPA
so if you bring all of this together and
you think about a compliance date of
January 1 of 2020 and you couple the
with from about November 15 to the end
of the year times - and you think about
the summer holiday period and you think
about the folks who are supporting your
business the reality is we're now about
14 months out from the compliance date
and you have 8 to 9 months a true work
period in order to come into compliance
and if you are with a company who has
not executed a gdpr program on a global
basis we found that many companies in
executing GDP are it took them one and a
half to two years to get fully
defensible and we believe that the same
thing is going to be appropriate for
California the purpose of this slide on
the principle amendments to CCPA is to
say look see CPA was passed in June and
the first set of amendments came out in
September and many of us are looking for
rulemaking clarification and
anticipating that further amendments
will occur to see CPA in 2019 and
rulemaking may not even be completed
until the spring of 2020 however there
are core aspects of CCPA which will
never be changed and in that perspective
you have to think about the holistic
program itself and what the purpose of
the program is and to set forth a good
app good-faith effort to become
definitionally ready or defensible
should you be inspected by a regulator
or should you be questioned by your
consumers and we expect that further
amendments will come down one of the big
ones that's often talked about is
employees our employees consumers or
employees employees are you as a company
going to make a value-based decision to
treat employees differently than
consumers or are you going to treat
everybody the same as California going
to be part of your global program or as
California got to be unique so as you
begin to look at these types of per
Series amendments redefining personal
information expanding hit
exemption reference to
gramm-leach-bliley limitations and
privacy or right of action limits
penalty to 7,500 for each violation so
as we begin to look at intentional or
violations and intentional violations
what's the definition of a violation if
I were to find a large multinational
$2,500 as a single fine that's no big
deal but if you had a breach of 500,000
individuals times $2,500 that's a huge
number so we're beginning to really look
at these numbers and these expectations
as for further clarification as we move
into some leading practices as it
relates to CCPA
we're really leveraging our history with
gdpr so the first thing that you need to
do is to think about updating your data
classification program redefining what
personal information is and ensuring
that your policies standards processes
technologies all all match as it relates
to that and then secondarily you have to
consider as I referenced earlier
California or the United States where we
see leading practices are one-and-done
the complexity and what we mean by that
is the complexity of operating multiple
privacy programs is significant and
because of that you have to look at how
you're going to govern the actual effort
and how you're going to validate the
things like data destruction data
classification the provision of personal
information all come into play records
of processing activities inventory the
processes procedures and systems so as
an example there is one of the questions
that's on the board is would you
recommend the general approach of
producing categories of third parties
with whom info was shared absolutely you
need to know who you sent that
information to what information
you sent what their destruction policies
are whether they're getting requests for
records of processing or records
requests and how you're going to
interact with them and if you don't have
a full system inventory if you are not
interacting with your agencies of record
you're going to have a major problem now
you can you can break them down into say
this vendor has general personal data
and this vendor might have sensitive
personal data as defined by the EU or
other forms of regulated data such as
Social Security number of
government-issued identifiers bank
account information but the reality is
you need to have core sources of record
and those records need to be updated you
need to have a risk ranking criteria so
that you understand what the
organizational risk is reputationally
and financially you need to look at
human change management this isn't just
IT change management but it's human
capital change management and are you
going to change the culture of the
organization as well as setting up
privacy by design standards now you look
at the law and it doesn't say much of
that but the expectation behind the
verbage that's contained in the law
indicates that much of this is going to
be a requirement and if you're going to
have a privacy program that dovetails
nicely with Europe it's just an
extension the problem is is that many
companies when they did the European GDP
our implementation does not include the
United States or rest of the world so
this work is brand-new and many
companies also may operate only within
the jurisdiction of the US so this is
new so for a lot of companies they're
just getting ready to start out the next
one is Portability and erasure what's
the scope of data for portability in a
ratio what are the retention
requirements there is no easy button
meaning there's no no one button that
you can push and make all of this happen
and while we delight our technology
agnostic companies like big id and
others in the marketplace offer
solutions that can address many of these
or part of these or all of these as
they're going through the process and
those types of solutions become
very important are you going to have a
manual based process are you going to
have a technology based process but
regardless you need to start with
systems of record you need to make sure
that those systems are integrated into
the retention schedule those systems and
what's contained in them need to be
contained within the long-term vision
and strategy of the organization do you
do you consider yourself a data company
do you consider yourself an operating
company do you consider yourself a
marketing company and how does the
records that you keep from a legitimate
business purpose then support the
strategy of the business and which of
those records that you keep from a
legitimate business purpose increase the
risk to the business and you also have
to consider ad hoc responsibilities or
ad hoc responses versus technology
enablement and Deborah indicated some of
that and I just talked about this but we
have seen many companies post gdpr go
live where there was an influx of
requests for information where they were
executing their access rights the
individuals were executing access rights
and it's tailed off so many companies
handled this and are handling this with
a administrative and manual process
other companies in preparation for what
they believe to be a large-scale influx
once the requirements become
better-known are implementing
technologies to address this and it may
be a phase 1 phase 2 approach but the
reality is you have to make that
decision up front and then consent
Deborah talked a lot about consent but
you need to be able to update your
authentication mechanisms how do you
really know that it's in the individual
so we have companies from a gdpr
perspective and other companies that and
I've seen this myself we're just from a
login perspective on a consent on a
customer based website I am getting
multi-factor authentication text into my
might tell my mobile phone in order to
log in to make sure it's really me
Enterprise consent management solutions
we're beginning to see a
master data management solutions when
you begin to put in all of these factors
and you have to manage opt-in and
opt-out and you don't have a central
system opt-in opt-out and you have
agencies of record who are working on
your behalf if you do not have a master
data management solution or some sort of
a solution that addresses all the
singles all the sources of information
that come in to create a unique
individual then you have risk in your
company and the biggest thing and
Deborah talked about this is you need to
know for sure which which data is
actually being sold so the housing of
data the utilization for a business
purpose is one thing but what is the
data that's being sold and what forms of
data are being sold are they ID
identified are they pseudo anonymized
are they identifiable is it can contain
within the consent statement is it
contained within your privacy statement
online these again fall within the
purview of what you need to seriously
consider security so we talked a lot
under gdpr and other laws about security
for privacy and historically states such
as Massachusetts in California have led
the way but as we've watched companies
come through the gdpr process many
companies were looking at ISO from a
European standard we're looking at nist
from a u.s. standard and what they're
trying to figure out is what standard do
we follow and what's the best practice
or an industry-leading practice or a a
common practice and what we're beginning
to see are companies who have developed
what I'll call a control framework for
security where they have consolidated
nist and iso into a single controlled
framework along with other similar type
of expectations such as the security
requirements in HIPAA and that's what
they're going with monitoring encryption
tokenization loss prevention
capabilities companies have to make a
basic decision from a risk perspective
where they may have put these off that
now this this impetus and the risk to
the company is demanding that these type
technology's be put into place and
that's where the risk versus reward
comes into play and every company we
work with has a different risk tolerance
some are have a higher tolerance some
have a lower tolerance one of the things
that you have salutely need to do is
look at your incident response plant
your forensic capabilities and and and
conduct wargaming whether it be tabletop
exercises or actual exercises also you
have to make a decision of how you're
going to conduct breach notification if
you have global databases and the
Europeans require notification to a
regulatory authority within 72 hours
whereas this law says you have to make
notification in 30 days are you going to
defer notifying the California Attorney
General or the other appropriate
regulatory agencies for 27 days after
you've notified the Europeans or are you
going to notify in the same time frame
so each of these nuances has to be can
look tat in conjunction with your global
footprint and then of course encryption
is a safe harbor under CCP a and and so
what we already have our number of
companies they're just talking about
flipping the encryption key and
encrypting in transit and in storage to
avoid many of the risks that are
associated with breach third-party
inventory and all of your third parties
who process personal data on your behalf
or for whom you receive personal data
from do you know for a fact that the
data that you have purchased from that
third party has been procured in
accordance with these requirements do
you have the contractual obligations do
you know for a fact that your data
processes are in fact complying with the
obligations do you know that they are
not using it for their own purposes
which contracts do you need to amend and
we we have seen companies with thousands
of contracts that need to be amended or
to have reference while we were dealing
with the gdpr
so which of the contracts are you going
to amend and how are you going to
identify them and we actually have a
solution where our artificial
intelligence is being used to
read contracts to assist in identifying
these types of elements and who do you
assess are you going to assess those
vendors that that process the most
sensitive forms of personal information
on your behalf you're going to assess
all vendors or you're going to assess
those vendors that you select randomly
or are you going to put the right to
audit and assess in a contract and then
decide not to execute you have to make
those decisions and breach preparedness
I talked a little bit about that a while
ago but breach preparedness is key and
testing your breach response program is
key understanding the interface between
security and privacy is key technology
enablement now or later as well as the
maturity of your privacy landscape which
technologies are you going to implement
implement and how are you going to do
them once your vendor analysis under a
short and a long term strategy
management you know we talked a while
ago and I talked and Deborah indicated
well CCPA be modified will it be further
amendment how is it going to be enforced
we know California historically enforces
pretty seriously
but as CCPA going to be enforced at the
same level a higher level a lower level
and what's my business risk
what's the categories of personal
information do I sell the moment pop
shops are they consumers or do I sell to
individuals and do I interact with
individuals and I'm tracking them from a
purchase habit perspective and what's
the change culture how are you going to
change your organization and how are you
going to manage the employees in your
organization when I was in industry I
often said I was going to give people
bracelets that said what about Bob and
what I mean by that is how does privacy
interact with the business how large is
the privacy office what's the value to
the business
privacy is no longer writing policies
and procedures and just interpreting law
policy privacy really now is part of the
operational culture of an organization
and has to be integrated into the
business and strategy development of the
organization or risk inside the
organization well and continues to
increase
as we begin to look at CCPA readiness
you really have to assess and then build
and then operationalize so as you begin
to assess you want to look at your
existing documentation your existing
people process technologies your
existing strategies roadmaps and and
project planning and what I mean is this
is strategies and roadmaps not only for
the technology and core business but
strategies and roadmap for your own
privacy office I mentioned during my
introduction that I've watched the
professionalism of the professional
nature of privacy be enhanced over the
past 15 years for many years I fought to
be recognized as a legitimate
professional and for many years I fought
for privacy to be legitimized as they
pry as a true profession gdpr CCPA
they are the full employment act for
privacy professionals so it's a great
time to be a privacy geek but if you're
going to do that you have to become part
of the business and the business culture
and the business strategy and then
putting together the budget this is
where a lot of companies in GDP are
seriously underestimated the complexity
of GDP are and seriously underestimated
the business and if you haven't been I'm
sorry
the complexity and the cost of GDP are
and if you haven't been through that
process already for GDP are you're going
to need to go through that process for
CCPA
and the success is often with
centralized budgeting rather than
fragmented budgeting and how and how
willing are is your organization to
absorb either the risk or the resource
needs as you begin to look at phase 2
which is really the design and build
phase you're going to have to look at
planning for the entire program and
remember earlier I said something like
there's 8 months left you're going to
have to look at your policies and notice
how you're going to manage consent and
how you're going to manage individual
rights access what's your security for
privacy what your existing security
posture there were
in my past life were sis's were my worst
nightmare now for the first time not for
the first time over the past few years
I've seen the cooperation among IT
security and privacy becomes
significantly higher than ever before
and I'm beginning to see many sis's who
are now asking for direction and
specifics from the privacy office of
what's the minimum expectation and I'm
thrilled to see that because there were
times I had to fight to get that
attention putting privacy by design into
play and not only designing it but
executing it and then validating it
again I talked about human capital
change management I talked about
procurement and third-party risk
management organization and the
operating model are you going to have no
privacy office are you going to have a
50% time are you gonna have 12 people
what's your operating model for privacy
are you going to use privacy stewards
throughout the organization are you
going to dovetail this as part of your
global privacy program metrics and
reporting what are they
Incident Response tests them data
inventory get it and data protection
impact assessments documented there's a
few questions on here I'm going to see
if any of them real quick can you talk a
little bit broad about the deletion
exemption I think I'm going to defer
that a little bit to Deborah
can you define the scoping of opt-out
cookies in tracking that's a technology
question I'm going to defer to Deborah
and then there was a question about are
there exceptions similar to gdpr for
clinical research having come from a
pharmaceutical company I would tell you
that under clinical research you have
the informed consent the ICS the
informed consent that all the patients
and most of those have gone through some
sort of an IRB an institutional review
board and that institutional review
board generally operates clinical
research under HIPAA and I am NOT as an
attorney and I do not provide legal
advice I am a
so but what I would tell you is I think
a case can be made that would say that a
clinical trial participant and clinical
research is not consumer marketing and
because of the other protections that
are granted I think clinical research
could be a limited carve out and that is
one of the areas that it would expect to
see that the state would continue to
address in the future then finally from
the operationalization and
implementation Thursday it's not just
writing policies it's actually ensuring
that your policies that you put out
there or followed it's not just saying
you have a rights management but testing
and our and putting that into play so
all of these things that are in phase
two it's really validating what in Phase
three it's really executing what you've
designed in Phase two and not only just
putting the policy and procedure out
there but testing that it actually works
the way that you expect that the work
and that people have changed people are
incorporating that into their day-to-day
business so one way that many of these
programs can be managed is with
technology and Deborah's going to follow
on here in just a second that that say
technology can help you do more with
less and the key here is to say you've
got 500 data rights requests I'm just
making this up if you had to manually
execute data rights requests and you got
500 of them in it would be held to do so
in that perspective then maybe
technology can help master data
management if you have to combine
multiple systems into place in order to
manage consent or you have to go to look
at all your third parties and 16 systems
in house and see if somebody's opted out
fast complexity so the point here is
that technology can help you with your
CCPA programs and can help you leverage
more with less so data inventories you
can use technology to do your
we've seen artificial intelligence we've
seen ediscovery we've seen data loss
prevention and we've seen other
technologies that call the networks to
do in them force consent management
master master data management
individuals can now opt out of sharing
how are you going to incorporate this
into your program and Deborah indicated
that earlier individual rights deletion
access and other data subject rights may
be impractical to execute from a manual
perspective so can you completely
process these in an automated fashion
using your IT systems there are
technologies out there that can help you
do that incident response in breach
detection prior to is important but also
preparation for the potential of can
help you create more resilient systems
so automated notification requirements
against characteristics of incident
allow for expedited workflow and that's
that's not unlike what data loss
prevention does so as we begin to look
at how technology can help meet the
requirements and technology can help you
implement the program this is a session
that Deborah would like to talk about
and so I'm going to turn it back over to
Deborah and then at the end Dave and
others will make sure that we address
any questions that we've missed so thank
you once again
great thanks Robert that was super
informative about kind of
comprehensively how companies should
attack this challenge and it's just to
build on that or CCPA building blocks or
you know you need a combination of the
policies the the the accountability and
transparency by consumers you also need
the technology aspect in order to find
personal data and you want to do this
not just by search of life the person's
main and hoping things show up right I
mean you you need to find context and
what data is associated with other data
that makes it personal information right
because personal information anything
that's linked are linkable too and ident
and so you know especially for
enterprises it's very very difficult to
I don't know delete personal information
upon on a deletion or request if you
don't know where all of the linkable
personal information lives within your
enterprise so technology T in addition
you want to map an inventory personal
information by consumer so you want
understands where is an individual
consumers personal information
throughout your your systems
specifically and then be able to
categorize those and then you need
processes to operationalize and
fulfilled privacy lifecycle management
add as deep as outlined by Robert okay
let's see that didn't so you know I
think idea addresses this in several
ways first for addresses to address the
data consumer data right we need like a
privacy intelligence right you need
insight into your own data so you can do
this with big I deep through data
discovery of the personal information
across your entire environment through
our machine learning and AI technology
you can also you know that the
technology will correlate the personal
data based based on the consumers
identity and it'll find other data that
is connected to an identity I mean we do
this by as Robert says starting with the
systems of record how do you define when
my identity is within organization well
you look at kind of what you consider to
be the source of identity whether it's a
combination of you know Salesforce
information combined with you know some
other databases and data stores and then
you know we take that and see our
machine learning model you know and this
is an on-premise solution so you're not
actually it's not fast we're not a data
processor here something installed
locally a behind the company's firewall
and it pretty much we scan all of the
data stores throughout your organization
through an API first model
and then find like attribute to the
identities that you know you've
considered in their system of identity
systems of record and then we find
attributes that are similar and then
correlate that to an identity index it
and then classify so that inventory and
index capability is what allows you to
kind of have that google-like search
within our platform to find personal
information and then as new data sources
come on board because you know you're
constantly changing your business
environments and new applications are
added I mean attributes are introduced
you will do you know continued scans
that are that allows for dynamic data
maps and that's kind of the image you
can see up there that you've got a
personal data inventory with a visual
data mapping of your business processes
and how information flows through your
business process and that also allows
for finding individual you know finding
things like data residency and oh my
gosh why is this you know German data
German person's data found all the way
in I don't know in in Africa where it's
you know shouldn't have left Germany or
or something along those lines you can
understand the risk to your information
with that data insight and 360 degree
view into your personal information in
addition you know that we have a
consumer centric view that's generated
from the inventory that basically
provides the basis for privacy
protection and reporting so you can
understand where the personal
information was found what categories of
data are collected so that was one of
the questions that was asked how can you
provide the categories of data that are
collected well you know first you have
to discover them and find them and make
them contextualize how the data is
related to a consumer so you know that
the technology has the ability that kind
of explain how that data has been linked
to an individual down to you know what
data
or file-share or you know cloud service
it was it was found in and then you can
add the justification for collection so
you know you can add into it you could
add into this report and you have an
automatic generated if you know for GDP
our would be a data subject that's
request reports and for calculating
consumer price yes it's just an access
report right
you can basically on-demand press the
press of a button to run B the report
generation and it'll it'll it'll give
this this view of all of the data
collect about an individual that you can
provide back to the individual either
through your website through a
self-service capability or kick off to a
you know to the customer service rep who
who is going to interact with that
individual verify their identity and
send it back to them um so as we've
already talked about like you know see
CPAs is pretty much here to stay
there's going to be minor tweaks there's
gonna be amendments still what Chicanos
Robert describe however they're just
going to be more tweaked the data
protection rights afforded to the
individuals are pretty much the central
portion of the CPA and they're here to
stay so you absolutely need ways to use
technology to correlate opt-out
decisions to spittoon
to the specific consumer within the data
inventory you want to identify consumer
data and locations and then of course
identify the specific processing flows
for the consumer data sets within your
environment you want identify the
applications and third parties that are
part of any data flow and then of course
you want to apply any opt-out policies
that you've had through your your
consent management capabilities that you
you already have in place you want to
apply that to consider your consumer
profile and make sure to have policy tag
of those attributes and
and as the big idea clack born allows
for orchestration of the various content
management software's that you had and
pulls in that information to our
discovery capabilities so that you can
even see when someone's opted in over
here opted out for a completely
different service over there and it kind
of keeps that all in check to provide be
able to provide that back to the
consumer when they when they want to
know why you're processing their
information or what authority you have
to do that and then also maintain you
know your policy based monitoring and
alerting for continuous compliance
because you know this is an old one and
done situation this is gonna now be a
consistent monitoring and governance
capability that it will enable your
organization to continue to comply with
CCPA down the road the right to be
forgotten and the right to right through
a racer you know similarity servers you
know in under CCP has the right to
delete but here's a good example of a
request to fulfill that right so you get
a request to delete someone's personal
information from their systems might
come in from you know let's worm mobile
apps phone call however it comes in then
you want to authenticate that request
and then validate that the person is who
they say they are so you're gonna
validate against your inventory and then
issue a response to the consumer you
might say yes we are going to provide if
you are no we don't have any information
in the first place so you'll respond
back then even want to generate a list
of relevant application data sources and
attribute locations for the consumer
from your inventory and then you know
here's how you would execute on those
you know hopefully you have predefined
workflows already on how you're going to
shuffle these requests you could
generate a ticket that you know for
instance that you're using jira for
internal ticketing or or any other
ticketing system you can then you know
kick off a ticket to the right person
who's going to internally so you know
delete the row from the database that
we've identified or you know find that
information
in a file share and delete it once we
identify where it's located and then you
don't initiate that deletion workflow to
IT and then appropriate application
owners and then initiate the
orchestration via API with the ability
to mask and be identify and encrypt
right so you might your ability deleting
might mean mate rendering you know
getting rid of any sort of identity
identify ability right so you could be
identified on information and perhaps
still preserve some value and keeping
the data but eliminating any
identifiability ID by encrypting 14d
identifying and then you know queue up
which records you want to delete and
identify what those are then of course
validate that those workflows have been
effectively completed validate that
against the inventory with the internal
consumer access reports right you'll
generate the report automatically and
then be able to finally deliver that to
the report either you know in whatever
way that you want to deliver it either
through your websites yourself service
capability or you know sending it by
other more and so this is pretty much
the summary slide here I know we're at
the very end but I want you to I want to
leave you with with privacy and that the
two main things that our platform does
that I think are just incredibly unique
in the in the field are our robust
privacy intelligence that big ID and our
ability to provide privacy assurance
with the intelligence technology it's
you know for large businesses with many
data stores it's really essential to
leverage technology it's almost
impossible to built to act upon the CCPA
requirements without having a clear
understanding as to where data lives
across your enterprise you need a map
the data flows to illustrate you know
what applications and systems and with
whom is that data shared you need to
easily contextualize all the personal
information across the company based on
an individual's individual
Zoomers identities and then facilitate
quick organizational responses to
consumer access and deletion request
under the Act you also need to provide
privacy assurance for auditing purposes
and defend against lawsuits and
regulatory actions and so without the
assistance of identity aware of privacy
management technology you know I don't
think large organizations would be able
to provide the accurate information
required to respond to the influx of
consumer requests of the act you know
when the act becomes enforceable and so
with the privacy assurance aspect you
know we're giving you complete certainty
to know with a high level of certainty
that high level of certainty poufy tulle
is where in your enterprise so you know
this is going to satisfy your auditors
your data protection officers and all
the various regulators you know whether
gdpr TCPA or in other countries that are
promulgated regulations and other states
that may do so as well so you know this
will help you confidently and
effectively manage consent and then
integrate and monitor your data
processing so you know this is pretty
much the slide we're going to leave I'm
going to leave you on and we've
integrated some of the questions into
our our discussion here as you've been
asking them but let me take a look this
last one so big I do have the ability to
delete what about making sure that is
removed from unallocated space so right
now
Big Ideas has only has read-only access
into into your data in the future we
will have some other abilities to take
action to be you know and we'll discuss
that another time but right now we do
not have the ability but we do have the
ability to identify what needs to be
deleted down to the database so and that
you know down to the very very specific
locations of the data across all of your
data store structured or unstructured
semi-structured data and so you know in
the future we will have the ability to
do some other things another question
those big IDs have
joshan capabilities not yes but we're
working on it and so we will we will get
back to you on that
and so these I'm handing this back to
you now for questions but I think we
might be out of time yeah exactly Debra
but as you mentioned just a moment ago
you I did a terrific job as did Robert
answering the questions in line so we
had some great questions coming in but
you can ask you the terrific job and
just integrating integrated them right
into the discussion so we are just about
at a time but as you can see on the
slide in front of you now both Debra and
Robert have made their email addresses
available to you graciously so if you
have any further questions or a question
that didn't get answered to your
satisfaction please do feel free to
shoot off an email to them as you can
see my email address is there as well if
you have anything that you'd like to
some help with from me so with that let
me say a big and hearty thank you to big
idea for making this educational web
conference available to all of you out
there for free we certainly appreciate
it here on the IEP P and then we
certainly appreciate Big Ideas support
of our efforts to increase knowledge in
the privacy community they're a great
great partner and we love working with
them so thank you to all and thank you
in particular Debra and Robert for
spending some time with us today and
both in the preparation for this web
conference and also for takin some time
with us today so much appreciated and
before you drop off the line if you're
still with us would very much appreciate
some feedback you can click on that link
in front of you it's very
straightforward very short survey takes
literally two minutes we've timed it and
just gives us gives you an opportunity
to let us know if this webinar met your
expectations if you found what you were
looking for when you signed up and my
favorite field in that survey is what
would you like to hear about on future
programs so it's a great place for you
to let us know what issues and
challenges you're wrestling with out
there and we can now we have a huge
database of speakers to draw upon and we
can produce that content to help you get
your job done in a more effective and
efficient manner so please take
literally just two minutes click on that
link give us some feedback and help us
continue to improve our educational
offerings and as I mentioned at the
beginning of the program if you're an
IPP certified privacy professional and
you have your certification with us
thank you for doing that and hope it's
providing value to you just listening
and watching this webinar will
automatically grant you one si PE credit
continuing privacy education credit
toward the upkeep of your certification
that's just going to happen
automatically if you register you don't
need to do anything but if for some
reason you're listening to this and you
didn't actually register which is fine
you can click that live link in front of
you right now and that will take you to
easy to fill out form on our website and
you can apply for that credit if you're
an attorney and you're wondering about
continuing legal education or CLE
credits they may or may not be provided
for this program they often are but we
do not pre certify these programs so
you'll need to apply within your
particular bar for those credits and and
see what requirements they have in that
jurisdiction if you need supporting
materials for that you can feel free to
contact me my email address is in front
of you there and my phone number
feel free to call or write I will also
let you know if you're wondering about
the slides that we're going to post a
recording of this program on the IEP
website within about 48 hours and under
the viewing window for the recording of
this
webinar including all the questions we
will post the link where you can
download the slides and also download a
certificate of attendance for this
webinar so I think that's about it thank
you very much one last time everybody
for join