Guylyn Cummins, Esq. Elizabeth Balfour, Esq.

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Guylyn Cummins, Esq. Elizabeth Balfour, Esq."

Transcription

1 Privacy Law Perils in California, the Nation and Beyond: Securing Data, Responding to Theft of Data and Other Business Assets, Assessing Your Company s Privacy Policy, Evaluating Risks Presented by Your Employees Computer Use, and Understanding Government Enforcement Mechanisms Guylyn Cummins, Esq. Elizabeth Balfour, Esq. Sheppard, Mullin, Richter & Hampton LLP 2008

2

3 Securing Data: Information Security is no longer just good business practice, it is becoming a legal obligation.

4 Securing Corporate Data Businesses have an obligation to provide appropriate security for their own data, as well as in connection with electronic transactions they enter into. What is appropriate?

5 Appropriateness depends on the industry HIPAA (Health Insurance Portability & Accountability Act) Gramm Leach Bliley Act FACTA (Fair and Accurate Credit Transactions Act) SEC regulations to safeguard customer records Sarbanes Oxley 302 certifications re: internal controls

6 A legal standard is emerging that focuses on a process approach to determining reasonable security measures for a particular business: Simply implementing certain tools in a checklist (firewalls, passwords, encryption, etc.) is not sufficient. The process approach ensures that the information security system is tailored to the specific security threats that pose a risk for that company.

7

8 (1) identify the company s information assets (2) conduct periodic risk assessments to identify specific threats and vulnerabilities (3) develop and implement a security program to manage the risks identified (4) monitor and test the program to ensure it s effective (5) continually review and adjust the program (6) oversee third party service arrangements

9 What if there is a security breach? Responding to Theft of Data and Other Business Assets Possible Causes: Disgruntled Employee Criminal Activity of third parties Hackers Negligence

10

11 Corporate Victims More widespread than we think: ChoicePoint Countrywide Lending Tree Bank of America SAIC University of San Diego

12 California s Notification Law, Civil Code Applies to: Personally Identifiable Information (PII) Name (or first initial and last name) + any one of the following: social security number driver s license or state ID number financial institution account number in combination with a password medical information health insurance information

13 Companies doing business in California are subject to other statutes that regulate use of personal information: Song-Beverly Credit Card Act California Financial Information Privacy Act California Consumer Credit Reporting Agencies Act California Confidentiality of Medical Information Act

14 Privacy Protections for Data other than Personally Identifiable Information: s, Text Messages, Telephone Calls, Where you are Driving. When can third parties legally read your s or text messages, or listen to your telephone calls?

15 When you are at the office, what information are employers permitted to access? Company policies regarding employee use of the internet and company devices (cell phones, PDA s) need to be clearly communicated and enforced in order to remain viable. Expectations of privacy in the workplace may differ depending on whether the employee has been properly informed. A person s consent to disclosure is a defense to a claim of invasion of privacy.

16

17 Can employers use knowledge of employees computer use to fire or discipline employees? California Labor laws: Cal. Lab. Code (use of lie detector and polygraph testing) FCRA Exception for consumer reports obtained in connection with an investigation of suspected employment-related misconduct: 15 USC 1681a(x)(2)

18 Protection of Business Assets and Proprietary Information Company Identity and Territory on the Internet: Domain Names Protection of Domain Names Domain Name Disputes

19 Privacy Protections for Exchange of Information on the Internet? Blogging List-serves Online searches

20

21 Restrictions on Companies Doing Business Over the Internet: CAN-SPAM FTC Enforcement

22 Companies that collect information about their customers, or who offer products or services over the Internet need enforceable privacy policies for their customers. The FTC enforces compliance with the terms of privacy policies under Section 5 of the FTCA. The FTC identified five core principals of privacy protection, which have become known as the Fair Information Practice Principles: (1) notice and awareness (2) choice and consent (3) access and participation (4) integrity and security (5) enforcement and redress

23 California Laws that Affect Companies Doing Business Online: Online Privacy Protection Act California s Shine the Light Law

24 Enforcing Privacy Policies Online Enforcement by the Company: Clickwrap v. Browsewrap Enforcement by the Government: FTC Actions

25 Challenges for Innovative Marketing on the Internet Behavioral Marketing Personalized Advertising Cookies v. Web Beacons

26 FTC Principles for Behavioral Marketing: Transparency Consumer Control Reasonable Security Limited Data Retention Affirmative Express Consent for Material Changes to Existing Privacy Promises Prohibition Against Using Sensitive Data for Behavioral Advertising (Without Consumer Consent)

27 Special Challenges Related to Children s Use of the Internet Children s Online Privacy Protection Act 15 USC Applies to Websites directed to children under 13

28

29 Standards for Business Transactions that Are Completed Online What is a digital signature? Removing legal barriers to electronic commerce E-SIGN Electronic Signatures in Global and National Commerce Act UETA Uniform Electronic Transactions Act

30 Who is responsible for ensuring appropriate data security measures are developed and implemented in the corporate environment? Chief Information Officers? CEO s? CFOs? Members of the Board of Directors? In-house counsel?

31

32 Questions? Guylyn Cummins, Esq Elizabeth Balfour, Esq

Privacy Law Basics and Best Practices

Privacy Law Basics and Best Practices Privacy Law Basics and Best Practices Information Privacy in a Digital World Stephanie Skaff sskaff@fbm.com What Is Information Privacy? Your name? Your phone number or home address? Your email address?

More information

Clients Legal Needs in HIPAA Security Compliance

Clients Legal Needs in HIPAA Security Compliance Clients Legal Needs in HIPAA Security Compliance Robyn A. Meinhardt, JD, RN FOLEY & LARDNER LLP 2004 Preserving Attorney-Client Privilege and Work Product Protections 1 Relevance to Security Compliance

More information

Where Are the Security Guidelines for Protecting Taxpayer Data?

Where Are the Security Guidelines for Protecting Taxpayer Data? Where Are the Security Guidelines for Protecting Taxpayer Data? Carolyn E. Davis, Sr. Program Analyst/Project Manager Internal Revenue Service Carolyn.e.davis@irs.gov 1 Agenda Background Progress Update

More information

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation Melissa J. Krasnow, Dorsey & Whitney LLP A Note discussing written information security programs (WISPs)

More information

CSR Breach Reporting Service Frequently Asked Questions

CSR Breach Reporting Service Frequently Asked Questions CSR Breach Reporting Service Frequently Asked Questions Quick and Complete Reporting is Critical after Data Loss Why do businesses need this service? If organizations don t have this service, what could

More information

CYBERSECURITY: THREATS, SOLUTIONS AND PROTECTION. Robert N. Young, Director Carruthers & Roth, P.A. Email: rny@crlaw.com Phone: (336) 478-1131

CYBERSECURITY: THREATS, SOLUTIONS AND PROTECTION. Robert N. Young, Director Carruthers & Roth, P.A. Email: rny@crlaw.com Phone: (336) 478-1131 CYBERSECURITY: THREATS, SOLUTIONS AND PROTECTION Robert N. Young, Director Carruthers & Roth, P.A. Email: rny@crlaw.com Phone: (336) 478-1131 TOPICS 1. Threats to your business s data 2. Legal obligations

More information

Identity Theft Security and Compliance: Issues for Business

Identity Theft Security and Compliance: Issues for Business Identity Theft Security and Compliance: Issues for Business The Facts Six Common Uses for Stolen Information Financial Criminal Medical DMV Social Security Terrorist The Facts A Chronology of Data Breaches

More information

Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00)

Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00) Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00) May 15, 2009 LLP US Information Security Framework Historically industry-specific HIPAA Fair Credit Reporting

More information

Gramm Leach Bliley Act. GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 7/1/2007

Gramm Leach Bliley Act. GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 7/1/2007 Gramm Leach Bliley Act 15 U.S.C. 6801-6809 6809 GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 7/1/2007 1 Objectives for GLBA Training GLBA Overview Safeguards Rule

More information

Cyber Risk Checklist: Compliance with Legal Obligations Grand Rapids Cyber Security Conference April 23, 2014

Cyber Risk Checklist: Compliance with Legal Obligations Grand Rapids Cyber Security Conference April 23, 2014 Cyber Risk Checklist: Compliance with Legal Obligations Grand Rapids Cyber Security Conference April 23, 2014 2014, Mika Meyers Beckett & Jones PLC All Rights Reserved Presented by: Jennifer A. Puplava

More information

Data Security Standard (DSS) Compliance. SIFMA June 13, 2012

Data Security Standard (DSS) Compliance. SIFMA June 13, 2012 Payment Card Industry (PCI) Data Security Standard (DSS) Compliance SIFMA June 13, 2012 EisnerAmper Consulting Services Group Overview of EisnerAmper Fifth fhlargest accounting firm in the Metro New York

More information

Vulnerability Management Policy

Vulnerability Management Policy Vulnerability Management Policy Policy Statement Computing devices storing the University s Sensitive Information (as defined below) or Mission-Critical computing devices (as defined below) must be fully

More information

HIPAA: Privacy/Info Security

HIPAA: Privacy/Info Security HIPAA: Privacy/Info Security Jeff Jones HIPAA Privacy Officer HIPAA Information Security Officer KY Region What you should know Discussion Topics Protected Health Security Awareness Information(PHI) Disclosure

More information

Data breach, cyber and privacy risks. Brian Wright Lloyd Wright Consultants Ltd

Data breach, cyber and privacy risks. Brian Wright Lloyd Wright Consultants Ltd Data breach, cyber and privacy risks Brian Wright Lloyd Wright Consultants Ltd Contents Data definitions and facts Understanding how a breach occurs How insurance can help to manage potential exposures

More information

Information Security Law: Control of Digital Assets.

Information Security Law: Control of Digital Assets. Brochure More information from http://www.researchandmarkets.com/reports/2128523/ Information Security Law: Control of Digital Assets. Description: For most organizations, an effective information security

More information

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF ARIZONA

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF ARIZONA David W. Lincicum (California Bar No. 223566) Burke W. Kappler (D.C. Bar No. 471936) Federal Trade Commission 600 Pennsylvania Avenue, N.W. Mail Stop NJ-8122 Washington, D.C. 20580 dlincicum@ftc.gov bkappler@ftc.gov

More information

E-COMMERCE GOES MOBILE: SEEKING COMPETITIVENESS THROUGH PRIVACY

E-COMMERCE GOES MOBILE: SEEKING COMPETITIVENESS THROUGH PRIVACY E-COMMERCE GOES MOBILE: SEEKING COMPETITIVENESS THROUGH PRIVACY Oana Dolea 7 th Annual Leg@l.IT Conference March 26th, 2013 Montreal, Canada INTRODUCTION Mobile e-commerce vs. E-commerce Mobile e-commerce:

More information

3/4/2015. Scope of Problem. Data Breaches A Daily Phenomenon. Cybersecurity: Minimizing Risk & Responding to Breaches. Anthem.

3/4/2015. Scope of Problem. Data Breaches A Daily Phenomenon. Cybersecurity: Minimizing Risk & Responding to Breaches. Anthem. Cybersecurity: Minimizing Risk & Responding to Breaches March 5, 2015 Andy Chambers Michael Kelly Jimmie Pursell Scope of Problem Data Breaches A Daily Phenomenon Anthem JP Morgan / Chase Sony Home Depot

More information

Cybersecurity for Nonprofits: How to Protect Your Organization's Data While Still Fulfilling Your Mission. June 25, 2015

Cybersecurity for Nonprofits: How to Protect Your Organization's Data While Still Fulfilling Your Mission. June 25, 2015 Cybersecurity for Nonprofits: How to Protect Your Organization's Data While Still Fulfilling Your Mission June 25, 2015 1 Your Panelists Kenneth L. Chernof Partner, Litigation, Arnold & Porter LLP Nicholas

More information

Policy Implications: Privacy, Security and Liability Big Data in Telecom. June 7 2012 TIA 2012: INSIDE THE NETWORK Dallas TX

Policy Implications: Privacy, Security and Liability Big Data in Telecom. June 7 2012 TIA 2012: INSIDE THE NETWORK Dallas TX Policy Implications: Privacy, Security and Liability Big Data in Telecom June 7 2012 TIA 2012: INSIDE THE NETWORK Dallas TX Who We Are Leading trade association in support of information and communications

More information

INCIDENT RESPONSE CHECKLIST

INCIDENT RESPONSE CHECKLIST INCIDENT RESPONSE CHECKLIST The purpose of this checklist is to provide clients of Kivu Consulting, Inc. with guidance in the initial stages of an actual or possible data breach. Clients are encouraged

More information

Navigating the New MA Data Security Regulations

Navigating the New MA Data Security Regulations Navigating the New MA Data Security Regulations Robert A. Fisher, Esq. 2009 Foley Hoag LLP. All Rights Reserved. Presentation Title Data Security Law Chapter 93H Enacted after the TJX data breach became

More information

Global Privacy Japan Sets its Rules for Personal Data

Global Privacy Japan Sets its Rules for Personal Data Global Privacy Japan Sets its Rules for Personal Data Global companies must comply with differing privacy rules. The great divide between the EU and the USA is well-known. See Global Privacy Protection

More information

Federal Trade Commission Privacy Impact Assessment

Federal Trade Commission Privacy Impact Assessment Federal Trade Commission Privacy Impact Assessment for the: W120023 ONLINE FAX SERVICE December 2012 1 System Overview The Federal Trade Commission (FTC, Commission or the agency) is an independent federal

More information

Cybersecurity and Data Breach: Mitigating Risk and How Government Policymakers Approach These Critical Issues

Cybersecurity and Data Breach: Mitigating Risk and How Government Policymakers Approach These Critical Issues Cybersecurity and Data Breach: Mitigating Risk and How Government Policymakers Approach These Critical Issues Todd Bertoson Daniel Gibb Erin Sheppard Principal Senior Managing Associate Counsel todd.bertoson@dentons.com

More information

Information Security Handbook

Information Security Handbook Information Security Handbook Adopted 6/4/14 Page 0 Page 1 1. Introduction... 5 1.1. Executive Summary... 5 1.2. Governance... 5 1.3. Scope and Application... 5 1.4. Biennial Review... 5 2. Definitions...

More information

Privacy Legislation and Industry Security Standards

Privacy Legislation and Industry Security Standards Privacy Legislation and Issue No. 3 01010101 01010101 01010101 Information is generated about and collected from individuals at an unprecedented rate in the ordinary course of business. In most cases,

More information

Data Privacy: What your nonprofit needs to know. Donna Balaguer and Ed Lavergne Washington, D.C. February 5, 2015

Data Privacy: What your nonprofit needs to know. Donna Balaguer and Ed Lavergne Washington, D.C. February 5, 2015 Data Privacy: What your nonprofit needs to know Donna Balaguer and Ed Lavergne Washington, D.C. February 5, 2015 Overview 2 Data privacy versus data security Privacy polices and best practices Data security

More information

Table of Contents. Table of Contents... 1. Chapter 1 Introduction... 5. Sample. Chapter 2 Monitoring and Quality Control... 8

Table of Contents. Table of Contents... 1. Chapter 1 Introduction... 5. Sample. Chapter 2 Monitoring and Quality Control... 8 [ Client]... 1 Chapter 1 Introduction... 5 1.1 Goals and Objectives... 5 1.2 Required Review... 5 1.3 Applicability... 5 1.4 Role and Responsibilities of the Compliance Officer... 6 1.5 Role and Responsibilities

More information

FACTA Identity Theft Red Flags Program. www.chs.acfei.com

FACTA Identity Theft Red Flags Program. www.chs.acfei.com 1 FACTA Identity Theft Red Flags Program Module 1 Fair and Accurate Credit Transactions Act Overview Identity thieves use individual s personal identifiable information to open new accounts and misuse

More information

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation View the online version at http://us.practicallaw.com/7-523-1520 Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation Melissa J. Krasnow, Dorsey & Whitney LLP

More information

HIPAA PRIVACY AND SECURITY AWARENESS. Covering Kids and Families of Indiana April 10, 2014

HIPAA PRIVACY AND SECURITY AWARENESS. Covering Kids and Families of Indiana April 10, 2014 HIPAA PRIVACY AND SECURITY AWARENESS Covering Kids and Families of Indiana April 10, 2014 GOALS AND OBJECTIVES The goal is to provide information to you to promote personal responsibility and behaviors

More information

plantemoran.com What School Personnel Administrators Need to know

plantemoran.com What School Personnel Administrators Need to know plantemoran.com Data Security and Privacy What School Personnel Administrators Need to know Tomorrow s Headline Let s hope not District posts confidential data online (Tech News, May 18, 2007) In one of

More information

Privacy & Data Security

Privacy & Data Security Privacy & Data Security May 9, 2014 Presented at: SWBA 39 TH ANNUAL CONFERENCE by: James E. Prendergast, Esq. Overview Data Privacy Concerns: Unauthorized access, use, acquisition or disclosure of information

More information

Professor Dorothy J. Glancy, - Santa Clara University School of Law

Professor Dorothy J. Glancy, - Santa Clara University School of Law Professor Dorothy J. Glancy, - Santa Clara University School of Law WISE 2010: Women s Institute in Summer Enrichment Team for Research in Ubiquitous Secure Technology (TRUST) Improper disclosure of personal

More information

Exhibit A. Federal Statutes Impacting Data Security

Exhibit A. Federal Statutes Impacting Data Security Exhibit A Federal Statutes Impacting Data Security Michele A. Whitham Partner, Founding Co-Chair Security & Privacy Practice Group Foley Hoag LLP 155 Seaport Boulevard Boston, MA 02210 Federal Law Citation

More information

Re: Big Data Request for Information

Re: Big Data Request for Information March 31, 2014 Attn: Big Data Study Office of Science and Technology Policy Eisenhower Executive Office Building 1650 Pennsylvania Avenue NW Washington, D.C. 20502 Ladies and Gentlemen: Re: Big Data Request

More information

Cybersecurity. Shamoil T. Shipchandler Partner, Bracewell & Giuliani LLP 214.758.1048

Cybersecurity. Shamoil T. Shipchandler Partner, Bracewell & Giuliani LLP 214.758.1048 Cybersecurity Shamoil T. Shipchandler Partner, Bracewell & Giuliani LLP 214.758.1048 Setting expectations Are you susceptible to a data breach? October 7, 2014 Setting expectations Victim Perpetrator

More information

Legal Ethics in the Information Age: Unique Data Privacy Issues Faced by Law Firms. v2.18.11, rev

Legal Ethics in the Information Age: Unique Data Privacy Issues Faced by Law Firms. v2.18.11, rev Legal Ethics in the Information Age: Unique Data Privacy Issues Faced by Law Firms v2.18.11, rev 1 Presenters Joseph DeMarco, Partner DeVore & DeMarco, LLP Lauren Shy, Assistant General Counsel Fragomen,

More information

Cyber, Security and Privacy Questionnaire

Cyber, Security and Privacy Questionnaire Cyber, Security and Privacy Questionnaire www.fbinsure.com Please note: This is an electronic application. When completed please save and email to: Ed McGuire emcguire@fbinsure.com Cyber, Security & Privacy

More information

Social Marketing & Liability

Social Marketing & Liability Social Marketing & Liability Fred E. Karlinsky, Esq. Co-Chair, Insurance Regulatory & Transactions Practice Shareholder, Greenberg Traurig Louisiana Insurers Conference Insurance Compliance Seminar August

More information

Hot Topic # 1: What Background Checks Should You Conduct?

Hot Topic # 1: What Background Checks Should You Conduct? HOT TOPICS IN BACKGROUND SCREENING Pamela Q. Devata Scott M. Paler Seyfarth Shaw LLP Breadth. Depth. Results. CH1 11234744 Hot Topic # 1: What Background Checks Should You Conduct? 1 Depends on the following:

More information

3/17/2015. Overview HIPAA. Who s Covered? Who s Not Covered? PRIVACY & SECURITY. Regulatory Patchwork: Mobile Health

3/17/2015. Overview HIPAA. Who s Covered? Who s Not Covered? PRIVACY & SECURITY. Regulatory Patchwork: Mobile Health PRIVACY & SECURITY Regulatory Patchwork: Mobile Health Anna Watterson, Davis Wright Tremaine, LLP Overview When HIPAA applies to mobile apps When FTC has jurisdiction over mobile apps Other considerations:

More information

Data Protection in the United States

Data Protection in the United States Data Protection in the United States Bruce E. H. Johnson Chair, Privacy and Security Group Davis Wright Tremaine LLP Pacific Rim Advisory Council Singapore, October 18, 2011 Overview of US Privacy Regulations

More information

HOW DID NETWORK SECURITY AND PRIVACY ISSUES BECOME D&O EXPOSURES?

HOW DID NETWORK SECURITY AND PRIVACY ISSUES BECOME D&O EXPOSURES? HOW DID NETWORK SECURITY AND PRIVACY ISSUES BECOME D&O EXPOSURES? MODERATOR: Richard J. Bortnick, Esq., Defense Attorney, Cozen O Connor PANELISTS: Anjali Das, MBA, Esq., Partner, Wilson Elser Moskowitz

More information

Hot Topics and Trends in Cyber Security and Privacy

Hot Topics and Trends in Cyber Security and Privacy Hot Topics and Trends in Cyber Security and Privacy M. Darren Traub March 13, 2015 Cyber Attacks Ranked Top 5 Most Likely Risks in 2015 - The World Economic Forum Recent Global Headlines Include: 1 Where

More information

Information Protection Framework: Data Security Compliance and Today s Healthcare Industry

Information Protection Framework: Data Security Compliance and Today s Healthcare Industry Information Protection Framework: Data Security Compliance and Today s Healthcare Industry Executive Summary Today s Healthcare industry is facing complex privacy and data security requirements. The movement

More information

787 Wye Road, Akron, Ohio 44333 P 330-666-6200 F 330-666-7801 www.keystonecorp.com

787 Wye Road, Akron, Ohio 44333 P 330-666-6200 F 330-666-7801 www.keystonecorp.com Introduction Keystone White Paper: Regulations affecting IT This document describes specific sections of current U.S. regulations applicable to IT governance and data protection and maps those requirements

More information

Cyber, PrivaCy. & Data SeCurity. www.mpplaw.com

Cyber, PrivaCy. & Data SeCurity. www.mpplaw.com Cyber, PrivaCy & Data SeCurity 360 www.mpplaw.com about our PraCtiCe Data is the lifeblood of our global economy. Collected, stored and transmitted, digital data not only imparts great opportunities, but

More information

Privacy and Data Breach Issues

Privacy and Data Breach Issues 15-013 Privacy and Data Breach Issues Konstantin Dino Tsibouris Founding Principal Tsibouris & Associates Columbus, Ohio Kirk Herath Associate General Counsel Nationwide Insurance Columbus, Ohio Table

More information

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation View the online version at http://us.practicallaw.com/7-523-1520 Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation MELISSA J. KRASNOW, DORSEY & WHITNEY LLP

More information

ELECTRONIC SIGNATURE REQUIREMENTS FOR LENDERS

ELECTRONIC SIGNATURE REQUIREMENTS FOR LENDERS ELECTRONIC SIGNATURE REQUIREMENTS FOR LENDERS June 2015 Purpose The Electronic Signatures in Global and National Commerce (ESIGN) Act (15 U.S.C. 7001-7006), enacted in 2000, permits, but does not require,

More information

MYTHS AND FACTS ABOUT THE HIPAA PRIVACY RULE PART 1

MYTHS AND FACTS ABOUT THE HIPAA PRIVACY RULE PART 1 CIRCA 2004 MYTHS AND FACTS ABOUT THE HIPAA PRIVACY RULE PART 1 Since April 14, 2003, health care providers, health plans, and health care clearinghouses have been required to be in compliance with the

More information

MIT s Information Security Program for Protecting Personal Information Requiring Notification. (Revision date: 2/26/10)

MIT s Information Security Program for Protecting Personal Information Requiring Notification. (Revision date: 2/26/10) MIT s Information Security Program for Protecting Personal Information Requiring Notification (Revision date: 2/26/10) Table of Contents 1. Program Summary... 3 2. Definitions... 4 2.1 Identity Theft...

More information

HIPAA: In Plain English

HIPAA: In Plain English HIPAA: In Plain English Material derived from a presentation by Kris K. Hughes, Esq. Posted with permission from the author. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub.

More information

Texas Medical Records Privacy Act

Texas Medical Records Privacy Act A COALFIRE PERSPECTIVE Texas Medical Records Privacy Act Texas House Bill 300 (HB 300) Rick Dakin, CEO & Co-Founder Rick Link, Director Andrew Hicks, Director Overview The State of Texas has pushed ahead

More information

PII Personally Identifiable Information Training and Fraud Prevention

PII Personally Identifiable Information Training and Fraud Prevention PII Personally Identifiable Information Training and Fraud Prevention Topics What is Personally Identifiable Information (PII)? Why are we committed to protecting PII? What laws govern us? How do we comply?

More information

Standard: Information Security Incident Management

Standard: Information Security Incident Management Standard: Information Security Incident Management Page 1 Executive Summary California State University Information Security Policy 8075.00 states security incidents involving loss, damage or misuse of

More information

College of DuPage Information Technology. Information Security Plan

College of DuPage Information Technology. Information Security Plan College of DuPage Information Technology Information Security Plan April, 2015 TABLE OF CONTENTS Purpose... 3 Information Security Plan (ISP) Coordinator(s)... 4 Identify and assess risks to covered data

More information

PII = Personally Identifiable Information

PII = Personally Identifiable Information PII = Personally Identifiable Information EMU is committed to protecting the privacy of personally identifiable information of its students, faculty, staff, and other individuals associated with the University.

More information

Privacy Data Loss. Privacy Data Loss. Identity Theft. The Legal Issues

Privacy Data Loss. Privacy Data Loss. Identity Theft. The Legal Issues Doing Business in Oregon Under the Oregon Consumer Identity Theft Protection Act and Related Privacy Risks Privacy Data Loss www.breachblog.com Presented by: Mike Porter March 10, 2009 2 Privacy Data Loss

More information

The Matrix Reloaded: Cybersecurity and Data Protection for Employers. Jodi D. Taylor

The Matrix Reloaded: Cybersecurity and Data Protection for Employers. Jodi D. Taylor The Matrix Reloaded: Cybersecurity and Data Protection for Employers Jodi D. Taylor Why Talk About This Now? Landscape is changing Enforcement by federal and state governments on the rise Legislation on

More information

Prepare for the Worst: Best Practices for Responding to Cybersecurity Breaches Trivalent Solutions Expo June 19, 2014

Prepare for the Worst: Best Practices for Responding to Cybersecurity Breaches Trivalent Solutions Expo June 19, 2014 Prepare for the Worst: Best Practices for Responding to Cybersecurity Breaches Trivalent Solutions Expo June 19, 2014 2014, Mika Meyers Beckett & Jones PLC All Rights Reserved Presented by: Jennifer A.

More information

Cyber Exposure for Credit Unions

Cyber Exposure for Credit Unions Cyber Exposure for Credit Unions What it is and how to protect yourself L O C K T O N 2 0 1 2 www.lockton.com Add Cyber Title Exposure Here Overview #1 financial risk for Credit Unions Average cost of

More information

Policy Considerations for Securing Electronic Data

Policy Considerations for Securing Electronic Data Policy Considerations for Securing Electronic Data CYBER SECURITY INDUSTRY ALLIANCE APRIL 2005 A firestorm of reaction to recent breaches of security at data brokers, universities, and other entities that

More information

Online Lead Generation: Data Security Best Practices

Online Lead Generation: Data Security Best Practices Online Lead Generation: Data Security Best Practices Released September 2009 The IAB Online Lead Generation Committee has developed these Best Practices. About the IAB Online Lead Generation Committee:

More information

INFORMATION EXCHANGE AGREEMENT BETWEEN THE SOCIAL SECURITY ADMINISTRATION AND THE STATE OF [NAME OF STATE], [NAME OF STATE AGENCY]

INFORMATION EXCHANGE AGREEMENT BETWEEN THE SOCIAL SECURITY ADMINISTRATION AND THE STATE OF [NAME OF STATE], [NAME OF STATE AGENCY] 2012 MODEL STC AGREEMENT INFORMATION EXCHANGE AGREEMENT BETWEEN THE SOCIAL SECURITY ADMINISTRATION AND THE STATE OF [NAME OF STATE], [NAME OF STATE AGENCY] AS THE STATE TRANSMISSION/TRANSFER COMPONENT

More information

DATA SECURITY: A CRUCIAL TOPIC FOR CORPORATE COUNSEL AND MANAGEMENT

DATA SECURITY: A CRUCIAL TOPIC FOR CORPORATE COUNSEL AND MANAGEMENT Advisor Article DATA SECURITY: A CRUCIAL TOPIC FOR CORPORATE COUNSEL AND MANAGEMENT By James R. Carroll, David S. Clancy and Christopher G. Clark* Skadden, Arps, Slate, Meagher & Flom Customer data security

More information

Data Security Best Practices for In-House Counsel

Data Security Best Practices for In-House Counsel Donna L. Wilson, Linda D. Kornfeld and Rebecca Perry Association of Corporate Counsel San Diego August 6, 2015 1 DONNA L. WILSON Tel: (310) 312-4144 Email: DLWilson@manatt.com Donna L. Wilson is co-chair

More information

Information Collected. Type of Information Collected. We may collect two general types of information when you use the Site:

Information Collected. Type of Information Collected. We may collect two general types of information when you use the Site: Privacy Policy (Last revised March 1, 2016) This website is owned and operated by Temple Square Hospitality Corporation ( Operator ). The following Privacy Policy (the Policy ) describes how Operator collects,

More information

Law & Ethics, Policies & Guidelines, and Security Awareness

Law & Ethics, Policies & Guidelines, and Security Awareness Law & Ethics, Policies & Guidelines, and Security Awareness Modifications by Prof. Dong Xuan and Adam C. Champion Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of

More information

Federal Trade Commission Privacy Impact Assessment. for the: Secure File Transfer System

Federal Trade Commission Privacy Impact Assessment. for the: Secure File Transfer System Federal Trade Commission Privacy Impact Assessment for the: Secure File Transfer System June 2011 1 System Overview The Federal Trade Commission (FTC, Commission or the agency) is an independent federal

More information

Data breach! cyber and privacy risks. Brian Wright Michael Guidry Lloyd Guidry LLC

Data breach! cyber and privacy risks. Brian Wright Michael Guidry Lloyd Guidry LLC Data breach! cyber and privacy risks Brian Wright Michael Guidry Lloyd Guidry LLC Collaborative approach Objective: To develop your understanding of a data breach, and risk transfer options to help you

More information

MASSIVE NETWORKS Online Backup Compliance Guidelines... 1. Sarbanes-Oxley (SOX)... 2. SOX Requirements... 2

MASSIVE NETWORKS Online Backup Compliance Guidelines... 1. Sarbanes-Oxley (SOX)... 2. SOX Requirements... 2 MASSIVE NETWORKS Online Backup Compliance Guidelines Last updated: Sunday, November 13 th, 2011 Contents MASSIVE NETWORKS Online Backup Compliance Guidelines... 1 Sarbanes-Oxley (SOX)... 2 SOX Requirements...

More information

Fair Credit Reporting Act (FCRA) Basics. A Primer for U.S. Employers from Littler Mendelson, the Nation s Largest Workforce Law Practice

Fair Credit Reporting Act (FCRA) Basics. A Primer for U.S. Employers from Littler Mendelson, the Nation s Largest Workforce Law Practice Fair Credit Reporting Act (FCRA) Basics A Primer for U.S. Employers from Littler Mendelson, the Nation s Largest Workforce Law Practice Fair Credit Reporting Act (FCRA) Basics A Primer for U.S. Employers

More information

Summary. Background and Justification

Summary. Background and Justification Supporting Statement for the Recordkeeping and Disclosure Requirements Associated with the Guidance on Response Programs for Unauthorized Access to Customer Information (FR 4100; OMB No. 7100-0309) Summary

More information

Impact of Legal and Regulatory Compliance on Higher Education Information Security Management. Dan Han Virginia Commonwealth University

Impact of Legal and Regulatory Compliance on Higher Education Information Security Management. Dan Han Virginia Commonwealth University Impact of Legal and Regulatory Compliance on Higher Education Information Security Management Dan Han Virginia Commonwealth University A little about me Worked in IT for close to 15 years, with 12 years

More information

Moving Towards an Electronic Real Estate Transaction

Moving Towards an Electronic Real Estate Transaction Moving Towards an Electronic Real Estate Transaction The Electronic Signature Legal Overview (U.S.) August 2010 1 Introduction Every real estate transaction involves the parties to the transaction putting

More information

Credit Reports and the Fair Credit Reporting Act. The Credit Bureaus

Credit Reports and the Fair Credit Reporting Act. The Credit Bureaus Credit Reports and the Consumer Law Eric E. Johnson eejlaw.com Konomark Most rights sharable. The Credit Bureaus 1 State law causes of action against credit bureaus Defamation Invasion of privacy State

More information

ACCOUNTABLE HEALTHCARE IPA HIPAA PRIVACY AND SECURITY TRAINING. By: Jerry Jackson Compliance and Privacy Officer

ACCOUNTABLE HEALTHCARE IPA HIPAA PRIVACY AND SECURITY TRAINING. By: Jerry Jackson Compliance and Privacy Officer ACCOUNTABLE HEALTHCARE IPA HIPAA PRIVACY AND SECURITY TRAINING By: Jerry Jackson Compliance and Privacy Officer 1 1 Introduction Welcome to Privacy and Security Training course. This course will help you

More information

HIPAA Security COMPLIANCE Checklist For Employers

HIPAA Security COMPLIANCE Checklist For Employers Compliance HIPAA Security COMPLIANCE Checklist For Employers All of the following steps must be completed by April 20, 2006 (April 14, 2005 for Large Health Plans) Broadly speaking, there are three major

More information

BIG DATA AND INSURANCE SYMPOSIUM

BIG DATA AND INSURANCE SYMPOSIUM BIG DATA AND INSURANCE SYMPOSIUM ATTORNEY GENERAL GEORGE JEPSEN UNIVERSITY OF CONNECTICUT SCHOOL OF LAW APRIL 3, 2014 (REVISED FOR PUBLICATION) *** This Article reproduces the keynote address delivered

More information

Cyber Warfare. Global Economic Crime Survey. Causes of Cyber Attacks. David Childers, CEO Compli Vivek Krishnamurthy, Foley Hoag LLP. Why Cybercrime?

Cyber Warfare. Global Economic Crime Survey. Causes of Cyber Attacks. David Childers, CEO Compli Vivek Krishnamurthy, Foley Hoag LLP. Why Cybercrime? Cyber Warfare David Childers, CEO Compli Vivek Krishnamurthy, Foley Hoag LLP Global Economic Crime Survey Cyber crime is the fastest growing economic crime up more than 2300% since 2009 1 in 10 companies

More information

708.1.2f - INDEPENDENT CONTRACTOR SERVICES AGREEMENT The University Of North Carolina at Chapel Hill WITNESSETH

708.1.2f - INDEPENDENT CONTRACTOR SERVICES AGREEMENT The University Of North Carolina at Chapel Hill WITNESSETH 708.1.2f - INDEPENDENT CONTRACTOR SERVICES AGREEMENT The University Of North Carolina at Chapel Hill This Independent Contractor Services Agreement (this Agreement ), made and entered into effective as

More information

(1) regulate the storage, retention, transmission, and security measures for credit card, debit card, and other payment-related data;

(1) regulate the storage, retention, transmission, and security measures for credit card, debit card, and other payment-related data; Legal Updates & News Legal Updates Pending Changes to California s Data Breach Law: New Burdens for Retailers? September 2007 by Christine E. Lyon, William L. Stern Related Practices: Privacy and Data

More information

Security & Data Breach Prevention

Security & Data Breach Prevention Security & Data Breach Prevention A Case Study ChoicePoint Inc (2005) Presenters: David T. Lee Robinson School of Business, Georgia State University Steve Travis - IBM 1 There are two types of Risk: -

More information

CYBER SECURITY A L E G A L P E R S P E C T I V E

CYBER SECURITY A L E G A L P E R S P E C T I V E A L E G A L P E R S P E C T I V E T H O M A S G. S C H R O E T E R A S S O C I A T E G E N E R A L C O U N S E L P O R T O F H O U S T O N A U T H O R I T Y DISCLAIMER! This presentation: does not include

More information

Creating a Bulletproof BYOD (Bring Your Own Device) Policy for Personal Devices At Work

Creating a Bulletproof BYOD (Bring Your Own Device) Policy for Personal Devices At Work Creating a Bulletproof BYOD (Bring Your Own Device) Policy for Personal Devices At Work FEATURED FACULTY: Amy F. Melican, Associate, Proskauer 212.969.3641 AMelican@proskauer.com Traci Clements, Attorney,

More information

Internet Gaming: The New Face of Cyber Liability. Presented by John M. Link, CPCU Cottingham & Butler

Internet Gaming: The New Face of Cyber Liability. Presented by John M. Link, CPCU Cottingham & Butler Internet Gaming: The New Face of Cyber Liability Presented by John M. Link, CPCU Cottingham & Butler 1 Presenter John M. Link, Vice President jlink@cottinghambutler.com 2 What s at Risk? $300 billion in

More information

Data Security Breach Notice Letter

Data Security Breach Notice Letter View the online version at http://us.practicallaw.com/3-501-7348 Data Security Breach Notice Letter DANA B. ROSENFELD & ALYSA ZELTZER HUTNIK, KELLEY DRYE & WARREN LLP A letter from a company to individuals

More information

HIPAA Compliance in Litigation and Discovery 10 Key Concepts Click to edit Master title style

HIPAA Compliance in Litigation and Discovery 10 Key Concepts Click to edit Master title style HIPAA Compliance in Litigation and Discovery 10 Key Concepts Click to edit Master title style Presented by: Nathan A. Kottkamp, McGuireWoods LLP David J. Pivnick, McGuireWoods LLP Mary C. DeBartolo, McGuireWoods

More information

HIPAA Privacy & Security Rules

HIPAA Privacy & Security Rules HIPAA Privacy & Security Rules HITECH Act Applicability If you are part of any of the HIPAA Affected Areas, this training is required under the IU HIPAA Privacy and Security Compliance Plan pursuant to

More information

Massachusetts Identity Theft/ Data Security Regulations

Massachusetts Identity Theft/ Data Security Regulations Massachusetts Identity Theft/ Data Security Regulations Effective March 1, 2010 Are You Ready? SPECIAL REPORT All We Do Is Work. Workplace Law. In four time zones and 45 major locations coast to coast.

More information

Federal Bureau of Prisons

Federal Bureau of Prisons Federal Bureau of Prisons Privacy Impact Assessment for the Forensic Laboratory Issued by: Sonya D. Thompson, Senior Component Official for Privacy, Sr. Deputy Assistant Director/CIO Approved by: Erika

More information

Maximum Global Business Online Privacy Statement

Maximum Global Business Online Privacy Statement Maximum Global Business Online Privacy Statement Last Updated: June 24, 2008. Maximum Global Business is committed to protecting your privacy. Please read the Maximum Global Business Online Privacy Statement

More information

Delaware Cyber Security Workshop September 29, 2015. William R. Denny, Esquire Potter Anderson & Corroon LLP

Delaware Cyber Security Workshop September 29, 2015. William R. Denny, Esquire Potter Anderson & Corroon LLP Changing Legal Landscape in Cybersecurity: Implications for Business Delaware Cyber Security Workshop September 29, 2015 William R. Denny, Esquire Potter Anderson & Corroon LLP Agenda Growing Cyber Threats

More information

Data Security and Privacy Policy

Data Security and Privacy Policy Data Security and Privacy Policy Overview TRG is a data-driven consulting company that provides arts, cultural and entertainment organizations guidance and solutions for patron-based, sustainable income.

More information

I. U.S. Government Privacy Laws

I. U.S. Government Privacy Laws I. U.S. Government Privacy Laws A. Privacy Definitions and Principles a. Privacy Definitions i. Privacy and personally identifiable information (PII) b. Privacy Basics Definition of PII 1. Office of Management

More information

IDENTITY THEFT PREVENTION PROGRAM

IDENTITY THEFT PREVENTION PROGRAM IDENTITY THEFT PREVENTION PROGRAM This program is launched in response to the Federal Trade Commission Red Flag Rules and Address Discrepancy Rules in conjunction with the Fair and Accurate Credit Transaction

More information

Privacy Policy & Identity Theft Prevention Program

Privacy Policy & Identity Theft Prevention Program Privacy Policy & Identity Theft Prevention Program Orcam Financial Group LLC PO Box 91098 4640 Cass St San Diego, CA 92109 (858) 220-5383 Orcam Financial Group LLC Privacy Policy February, 2014 Page 1

More information