Information Governance

Transcription

1 Information Governance in-fər-ˈmā-shən\ˈgə-vər-nən(t)s: a holistic approach to managing business information by implementing processes, roles, controls and metrics that treat information as a valuable resource. iinformation Governance A legally compliant global records and information management program is the foundation that enables a business to capitalize on the benefits of an increasingly information-driven world and more effectively pursue other corporate compliance initiatives.

2 We live in an information-driven world Information Governance digital media has supplanted paper as the primary format for recording and storing information the Internet is the great enabler data flows instantaneously through connected global networks and an ever expanding range of devices more data is being hosted in the cloud by third party providers and often stored in global locations that are not easily identifiable [change title in Slide Master] 2 Information Governance 2

3 Data is changing how businesses are organized and run Drivers of Data Growth of 47% of global companies surveyed rank data growth amongst their top top 33 business challenges. The rate at which we contribute information to the global data repository grows exponentially every day. Our information-driven world is having a profound impact on how global businesses are organized and operated and introduces new business challenges and legal risks that must be managed. Growing business demand Expanding Data Warehousing / Use of Business Intelligence applications Increasing amounts of data created and hosted online The annual volume of global data traffic will exceed 60,000 petabytes in 2016, over seven times more than the 8,000 petabytes expected in How much is a petabyte? Approximately 20 million four-drawer filing cabinets filled with text or over 6.5 billion photos on Facebook. 50 petabytes roughly represents the entire written works of humankind, from the beginning of recorded history, in all languages. Enhanced business protection activities i.e. back-up, recovery, replication, mirroring More reporting data from Enterprise Resource Planning and other core systems Enhanced generation and tracking of compliance information for statutory reporting purposes New business units resulting from M&A activities Increasing e-business activities including use of social media More video and graphical files [change title in Slide Master] 3 Information Governance 3

4 New opportunities must be weighed against an array of compliance risks Compliance Risks For many global companies, institutional knowledge is their most valuable asset. The effective management of corporate data presents businesses with new opportunities and capabilities; for example, the information may be used to better understand and market to customers or to reduce operational costs. When institutional knowledge is harnessed and managed well, a business can gain a competitive advantage over its rivals. Conversely, mismanaged information can result in a business finishing out of the race and expose the enterprise to legal and financial risks. Records Retention Data Privacy Data Security Data Breach Data Transfer Media / Format Imagine the problems that would arise under a wide range of laws if a global organization does not understand what personal data it processes, who has access to certain data, where the data is stored, or how a security breach occurred. Alternatively, consider the potential financial exposure if an organization cannot produce evidence for litigation purposes, comply with a lawful access request, or effectively conduct an internal investigation. Storage e-discovery Lawful Access Internal Investigations [change title in Slide Master] 4 Information Governance 4

5 Risk is managed by maintaining an effective records and information management (RIM) program Challenges In order to manage the array of compliance risks, an organization must understand: what information it collects and has in its possession and control; how it is accessed, used and processed; to whom it may be disclosed; where it is stored; and when it is deleted or destroyed. However, in an era of Big Data a term used to describe the voluminous amount of unstructured and semi-structured data that a company creates, which would take too long and cost too much to load into a relational database the development of an enterprise-wide RIM program that is compliant with the full spectrum of functional and jurisdictional compliance obligations is no small feat. To succeed, an organization must develop a strategy that enables it to address and overcome a number of challenges. Operational Resource Compliance [change title in Slide Master] 5 Information Governance 5

6 Operational Challenges An enterprise may not be organized in a way that enables or facilitates the mounting of a global records and information management strategy. The challenge often stems from the historical separation of the records management (RM) function, which typically has been the responsibility of compliance personnel, from the information management (IM) function, which has been the purview of the IT/IS department. There was some logic to this approach in a largely paper-based world when IT/IS was focused primarily on managing network systems, but this is no longer the case as roles and responsibilities have merged. Simply put, it is difficult for an organization to successfully tackle and meet its compliance obligations and manage business and legal risks when initiatives are launched without the active participation of the appropriate stakeholders be they business, legal, regulatory compliance or information technology and systems personnel. For businesses that originally adopted an ad hoc approach to records management, often characterized by different approaches across jurisdictions, the challenge may be in trying to reconcile these different approaches or in extending one approach across the enterprise as data is increasingly co-mingled in centralized databases. Resource Challenges Limitations in financial, systems or staffing create resource challenges. Without the involvement of knowledgeable personnel to create and manage complete and accurate record retention schedules and systems that enable the effective management of the stored data, a business will not be able to implement and sustain a global records and information management program. [change title in Slide Master] 6 Information Governance 6

7 The Solution: an operational & resource strategy Prioritize effective records and information management (RIM) as a prerequisite for a successful corporate compliance program. Align compliance functions with IT/IS functions. Hire personnel with records management expertise to help with the development, implementation, and maintenance of a global RIM program. Seek guidance from RIM experts to help design and develop tailored record classification schemes and operational protocols. Acquire software tools that help the enterprise better organize, access, and manipulate stored data. [change title in Slide Master] 7 Information Governance 7

8 Information Governance Compliance Challenges With operational and resource challenges come new corporate responsibilities and legal risks in an age when corporate compliance is the mantra of business leaders. Records and information management is no longer just about establishing rules that satisfy laws which dictate how long certain records must be retained. [change title in Slide Master] 8 Records Retention Data Privacy Data Security Data Breach Data Transfer Media / Format Storage e-discovery Lawful Access Internal Investigations Establishing appropriate retention periods is now just one element in a much larger, expanding, and complex web of legal requirements that cover all facets of Information Lifecycle Management (ILM). For organizations that operate around the globe, the compliance challenge is even greater as the particular local legal requirements of each jurisdiction must be taken into account. Merely implementing a global records and information management program is not, on its own, enough. The effectiveness of the program in managing risk depends on the strength and integrity of the rules that are established, and the rules are based on the identification and interpretation of, and compliance with, a wide range of legal requirements. Organizations that have successfully developed and implemented an effective and legally compliant global RIM strategy will be able to leverage the associated RIM program to more confidently and efficiently pursue other corporate compliance initiatives, the success of which are often dependent on the organization s ability to understand what information it collects and how such information is processed and stored. Information Governance 8

9 Characteristics of the best legally compliant global records and information management programs A holistic approach to legal considerations has been adopted that is informed by the full range of compliance obligations and addresses multijurisdictional requirements. The organization establishes strong and direct linkages between the interpretation of applicable laws, the mapping of the associated legal requirements to record categories, and rule adjustments based on a full appreciation of all material risk considerations. The program is informed by industry and jurisdiction best practices. The work product is simple, practical, functional and implementable. The program is scalable and can be expanded/ phased in and/or grow with the business. The program is flexible, tailored, and addresses business needs. The program is evergreen and the rules can be easily refreshed and updated without recreating the wheel or incurring significant costs. [change title in Slide Master] 9 Information Governance 9

10 Simply the Best Global Coverage Our internationally recognized Information Governance team consists of more than 225 practitioners in 70 offices across 42 countries. Experience We have worked on over 50 global RIM projects for Fortune 500 companies across a diverse range of industries and jurisdictions; helping our clients manage risks by developing and implementing strategic RIM solutions that enable them to operate confidently in different and complex regulatory environments. Knowledge Resources Our knowledge is embedded in a unique and unrivalled online database, our Global Legal Index ( GLI ), that identifies the source laws, regulations and rules for over 70 jurisdictions across all major regions of the world. Solution Oriented Our program is: (i) informed by industry and jurisdiction best practices; (ii) scalable and can be expanded/phased in and/or grow with the business; and (iii) flexible, tailored, and addresses the business needs and the operational realities of our clients. Methodology We adopt a holistic approach when identifying and reviewing applicable laws and regulations; the strategy is informed by the full range of compliance obligations and addresses multijurisdictional requirements. e Our program enables clients to maintain compliance after the initial work has been done; the GLI is updated and evergreen, and can be accessed by the client at any time so that defined rules can be easily confirmed or updated without duplicating the original effort or incurring significant costs. [change title in Slide Master] 10 Information Governance 10

11 s 10 Step Global Records and Information Management Program Define specific organizational goals and expectations including roles and responsibilities of appropriate stakeholders. Review existing records retention schedules and/or policies. Compile and evaluate Business Profile for each relevant jurisdiction (form of business organization, scope of activities/ operations, how licensed/regulated, location of employees, etc.). Evaluate overall risk profile and scope of records management project needed including privacy, cross-border data transfer and media/format (e-records) considerations. Determine appropriate records management deliverables (type, length and format of retention schedules, supplementary guidance, etc.), leveraging existing retention schedules where appropriate. Identify applicable local laws, regulations, regulatory guidance, best practices and risk considerations leveraging Baker & McKenzie s Global Legal Index. Obtain input from local counsel in each relevant jurisdiction to confirm, update and supplement local laws, regulations, regulatory guidance, best practices and risk considerations to reflect Business Profile for each jurisdiction. Prepare records management deliverables (Records Retention Schedule, Policies, Legal Foundation by jurisdiction, etc.). Engage in follow-up dialogue to clarify any issues or questions following delivery. Ensure ongoing compliance with B&M s evergreen maintenance program. [change title in Slide Master] 11 Information Governance 11

12 For more information about our Information Governance services, please contact your local office or a member of our Global Privacy and Information Management Team. Global Coverage Experience Knowledge Resources Solution Oriented Methodology e For More Information: Theo Ling theo.ling@bakermckenzie.com Lisa Douglas lisa.douglas@bakermckenzie.com 10 The foregoing has been prepared for clients of. While every effort has been made to ensure accuracy, the information contained herein should not be relied on as legal advice; specific advice should be obtained in each individual case. No responsibility for any loss occasioned to any person acting or refraining from action as a result of material herein is accepted by the authors or. If advice concerning specific circumstances is required, we would be pleased to be of assistance All rights reserved. LLP, an Ontario limited liability partnership, is a member of International, a Swiss Verein with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a partner means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an office means an office of any such law firm. This may qualify as Attorney Advertising requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome. [change title in Slide Master] 12 Information Governance 12