IAPP Privacy Academy. Information Governance in a Corporate Compliance World. October 11 th, 2012 San Jose

Transcription

1 IAPP Privacy Academy i Information Governance in a Corporate Compliance World October 11 th, 2012 San Jose

2 Information Governance i Information Governance in-fər-ˈmā-shən\ˈgə-vər-nən(t)s: a holistic approach to managing business information by implementing processes, roles, controls and metrics that treat information as a valuable resource. A legally compliant global records and information management program is the foundation that enables a business to capitalize on the benefits of an increasingly informationdriven world and more effectively pursue other corporate compliance initiatives. IAPP Privacy Academy 2

3 Typical Information Governance Initiatives Within a Corporation 3

4 Information Governance Records Retention Data Privacy Data Security Data Breach Data Transfer Media / Format Storage e-discovery Lawful Access Internal Investigations IAPP Privacy Academy 4

5 Challenges of Coordinating Initiatives 5

6 Information Governance Serving as an Anchor for a much Broader View of Corporate Compliance Compliance Risks Information Governance Design & Production Distribution Financial Governance & Structure People Sales & Marketing Retention Privacy Security Breach Transfers Domestic Content Environment Export Controls Intellectual Property Trade Sanctions Transfer Pricing Agents/ Distributions Boycotts Corrupt Practices Customs Export Controls Corrupt Practices Emissions Trading Financial Controls Foreign Exchange Pricing Board of Directors Compliance Programs Corporate Structure CSR Policies Fiduciary Obligations Compensation & Incentivies Disability/ Discrimination Data Protection/ Privacy Employee Monitoring Labor Relations Advertising & Promotion Antitrust/ Competition Consumer Protection Corrupt Practices Government Contracting Media / Format Workplace Safety Franchising Securities Transactional Issues Migration/MObility Packaging Storage e-discovery Import Licensing Parallel Importing Tax Pensions & Benefits Recruiting & Hiring Pricing Lawful Access Trade Sanction Workplace Change Investigations IAPP Privacy Academy 6

7 Developing a Strategy for Coordinating Initiatives 7

8 Demonstration Contextual Approach Oversight ACCOUNTABILITY ECOSYSTEM Context, Processes, and Demonstration of Capacity Identify Risks and Opportunities Integrated Governance Commitment Implementation Validation Solid policies aligned to external criteria Management commitment Full transparency Mechanisms to ensure policies and commitments are put into effect with employees Monitoring and assurance programs that validate both coverage and effectiveness of implementation Demonstrate capacity to internal stakeholders (Management, Internal Audit, Board) Demonstrate capacity to external stakeholders (Trust Agents, Regulators) Demonstrate capacity to individual data subjects IAPP Privacy Academy 8

9 The Solution: an operational & resource strategy Prioritize effective records and information management (RIM) as a prerequisite for a successful corporate compliance program. Align compliance functions with IT/IS functions. Hire personnel with records management expertise to help with the development, implementation, and maintenance of a global RIM. Seek guidance from RIM experts to help design and develop tailored record classification schemes and operational protocols. Acquire software tools that help the enterprise better organize, access, and manipulate stored data. [change title in Slide Master] 9 IAPP Privacy Academy 9

10 Best Practices in a Global Information Governance Program 10

11 IGRM The IGRM provides a framework for cross-functional and executive dialog and serves as a catalyst for defining a unified governance approach to information. Information Governance Reference Model / 2012 / v3 / edrm.net IAPP Privacy Academy 11

12 Characteristics of the best legally compliant global records and information management programs A holistic approach to legal considerations has been adopted that is informed by the full range of compliance obligations and addresses multijurisdictional requirements The program is evergreen and the rules can be easily refreshed and updated without recreating the wheel or incurring significant costs The organization establishes strong and direct linkages between the interpretation of applicable laws, the mapping of the associated legal requirements to unique record categories, and rule adjustments based on a full appreciation of all material risk considerations The program is informed by industry and jurisdiction best practices The deliverables and work product are simple, practical, implementable, and functional The program is scalable and can be expanded/ phased in and/or grow with the business The program is flexible, tailored, and addresses business needs. [change title in Slide Master] 12 IAPP Privacy Academy 12

13 Theo Ling Harvey Jang Global Coverage Experience Knowledge Resources Solution Oriented Methodology e Baker & McKenzie International is a Swiss Verein with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a partner means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an office means an office of any such law firm.