Speakers. Navigating Through The Legal Complexities And Cloudy Conditions To Implement A Successful Global OBA Program

Transcription

1

2 Speakers Navigating Through The Legal Complexities And Cloudy Conditions To Implement A Successful Global OBA Program Speakers: Ashlen Cherry, Americas Privacy Officer, Dell, ashlen_cherry@dell.com Ruth Cullinane, EMEA Data Protection Officer, Dell, ruth_cullinane@dell.com Reed Freeman, Partner, Morrison Foerster, rfreeman@mofo.com

3 Overview and Global Trends General overview of OBA legal framework US, EU, APJ Background and examples of how Dell manages global requirements Key takeaways

4 US

5 U.S. Current Framework FTC Privacy Report (March 2012) DOC Privacy Code of Conduct White House Consumer Privacy Bill of Rights Do Not Track Self-regulatory principles Enforcement

6 EU

7 EU Cookie Regulations Article 5(3): the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information. about the purposes of the processing. Consent defined in article 2(h) of Directive 95/46/EC: any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed. Prior consent may be required for certain cookies, in certain countries; e.g Portugal, Netherlands

8 Advice from Regulators 1. Find your cookies Identify what cookies or other tracking devices you are using on your website. 2. Classify your cookies Identify the different types of cookies and grade them according to the level of privacy intrusiveness. 3. Identify any strictly necessary cookies Identify whether any cookies might fall within the strictly necessary exemption. 4. Make a compliance plan and decide when and where to obtain consent Think about your options as to how you are going to obtain a user s consent to cookies: acceptance of the terms and conditions in a registration process; an information banner or pop-up box.

9 Asia-Pacific/Japan

10 Japan Legal Framework Law Concerning Protection of Personal Information Law itself is a series of guidelines, intended to be implemented by various Ministries in ways specific to their sectors No overarching government regulator, but OBA (sometimes called life-log ) has been a focus of Consumer Affairs Agency (established September 2009) Data Collectors: Must: Describe specifically and publicize the purposes of the collection (by any method) Provide ability for user to opt out of data sharing with third parties Take necessary steps to assure security of collected data, including physical and technical means Disclose information collected about an individual and allow correction Must Not: Exceed the scope of the announced purposes of collection Share personal information with third parties (including affiliates) without consent Prefectures and Cities have own personal information rules, too Authorized Personal Information Protection Organizations Certain Ministries (e.g. METI) certify private organizations to assist businesses in implementing the law

11 Japan Regulatory Efforts CAA Report (2010) OBA data is personal if identifiable to a specific individual with easy reference to other information, including records of online activities and GPS data Lays out 6 basic principles: publicizing OBA; transparency; user participation; fair collection; appropriate security; and accountability Specific references to US Do-Not-Track and EU right to be forgotten want to increase interoperability JIAA Self-Regulatory Guidelines Applies only to Non-Personal Information collected for OBA Guidelines Require: Transparency: Easily accessible and understandable statement, prominently displayed Includes clear statement of purpose, uses, and practices Ability for consumers to choose who may use collected behavioral information Appropriate collection techniques (unspecified) Proper Data Security, including downstream restrictions on use Consumer Education Rapid response to consumer requests and complaints

12 Japan Regulatory Efforts CAA Report (2010) OBA data is personal if identifiable to a specific individual with easy reference to other information, including records of online activities and GPS data Lays out 6 basic principles: publicizing OBA; transparency; user participation; fair collection; appropriate security; and accountability Specific references to US Do-Not-Track and EU right to be forgotten want to increase interoperability JIAA Self-Regulatory Guidelines Applies only to Non-Personal Information collected for OBA Guidelines Require: Transparency: Easily accessible and understandable statement, prominently displayed Includes clear statement of purpose, uses, and practices Ability for consumers to choose who may use collected behavioral information Appropriate collection techniques (unspecified) Proper Data Security, including downstream restrictions on use Consumer Education Rapid response to consumer requests and complaints

13 Korea Legal Framework No law specific to OBA treated by law like general online advertising. Two sources of statute law: Personal Information Protection Act Applies to all sectors, all personal information, and all data online as well as off Personal information: any information from which an individual is easily identifiable or which makes an individual identifiable after easy combination with other data Data handlers must: Get informed consent for the collection, use or disclosure to a third party of any personal information Personal information: Any information from which, either alone or in combination, an individual can be uniquely identified Inform user of purposes of collection/use; kind of information sought; period of retention and use Get specific consent for collection of sensitive information (e.g., Government ID #s or information regarding beliefs) Establish and publish a personal information handling policy To the extent that another, more specific and more protective law exists its provisions apply instead of PIPA

14 Korea Legal Framework Two Sources of Law (Cont.) Promotion of Information Communications Network Utilization and Protection of Information Act Requires ISPs and TelCos to protect personal data protects same data as PIPA Requires all ed commercial advertisements whether OBA or not to detail how users may opt-out of further such advertisements Means to exercise the opt-out must be explicitly provided in the Is separate from PIPA and enforced separately Regulatory Guidance Korean Communications Commission is regulator Is drafting OBA guidelines Guidelines have not been enacted or even been published yet No Self-Regulation

15 Hong Kong Personal Data (Privacy) Ordinance Applies to personal data Relating to a living individual; from which identity can be practicably ascertained; in a form in which processing is practicable Adopts Six Data Protection Principles Purpose and manner: Tracking must be related to an activity of the user and not excessive Accuracy and duration: Data must be accurate and kept only as long as necessary Use: Data may only be used for purposes stated; must get express consent to change Security: Protect data using reasonably practicable steps Generally available data: Must make a statement of privacy policy and collection practices Access: Subjects of the collection may ask for a copy of and request changes to their data Direct marketers must also offer an opt-out, including from unsolicited advertising All collectors urged to adopt Fair & Transparent Practices Inform users what data is collected; whether third parties collect data; and offer an opt-out, explaining the consequences of so doing Should be user-friendly, easily accessible and comprehensible For cookies, set a reasonable expiration date; encrypt the contents; and respect user preferences (e.g., through browser settings no zombie cookies!)

16 Hong Kong Application Before collection, data collectors must get consent Applies to personal information Information which practicably allows the individual to be identified Must informing users: Whether the collection is required (and consequences of refusal) Purposes of collection To whom data may be transferred Right to access and correct data Recent Guidance (Dec & July 2012): Disclose use of cookies yours or 3 rd parties regardless of whether they collect personal information Unsure if collected data is personal? Refer to and apply Fair & Transparent Practices No enforcement actions No self-regulatory program or initiatives

17 Australia Privacy Act of 1988 Establishes 10 National Privacy Principles for private organizations Require disclosures before collection or sharing of personal information Secondary uses forbidden, unless (in the case of marketing): Impracticable to get user consent Will not charge to honor a request to opt-out User has not opted-out User is notified in each communication of ability to opt-out Contact information is disclosed Forbid using identifiers assigned by government agencies to track individuals Allow trans-border migration of data only to countries where data will be protected by laws or regulations that are similar to the NPPs Little law interpreting the Act, and little public enforcement

18 Australia Self Regulatory Best Practice Guideline for OBA, published by several Australian Advertising and Online groups Guidelines apply only to 3 rd party OBA Use of cookies for first-person tracking generally accepted Generally applies only to anonymous data Principles May only combine OBA/tracking data with Personal Information if OBA is treated as Personal Information under Privacy Act Third parties should give notice of practices on own websites, and give enhanced notice on sites where ads appear Operators of sites where 3 rd Party OBA occurs should disclose that fact User choice: Third Parties create an easily accessible opt-out mechanism Service Providers (e.g., ISPs, browsers) get explicit consent for OBA, and allow for easy withdrawal of that consent Data Security; Careful Handling of data relating to children and other sensitive information; Consumer Education; Accountability

19 OBA in China No Chinese Privacy Law, but Internet Regulations Apply only to ISPs Must obtain prior consent before collecting personal information (via cookies or other means) Any information that can be used to identify a user, alone or in combination; can include IP addresses Must notify user of intended use of data in getting consent No specific restrictions on collection/tracking/use once there is consent No government opinions, guidance or enforcement regarding OBA No self-regulatory program or initiatives

20 Dell s Approach

21 How Dell Manages Risk in this Environment Staying on top of the business initiatives Privacy by design U.S. Self-regulatory program Tracking the trackers (Cookies/tracking technology inventory and management) Dell s Cookie Audit program Progress Challenges

22 Privacy by Design: Managing OBA at Dell Challenges include Need for awareness and implementation by all employees; Fast-paced innovative environment leads to high demand; Small privacy team providing guidance on often complex issues; Analysis of issues depend greatly on the details, so may require high touch. Address challenges through: Creation and communication of clear policies on collection of information and management of that information throughout its lifecycle, through destruction; Creation of opportunities for self-service; Cross-functional governance groups, variety of communication channels. Robust monitoring and reporting programs to ensure accountability. In action: OBA Steering Committee Business unit OBA Working Group

23 OBA Governance Commercial CRM Working Committee Frequency: Bi - weekly Participation: CRM/Global legal Corporate Privacy Regional Privacy Counsel CRM Program leaders Agenda Review Project Mandates Determine, by country, recommended privacy impact and course of action for each program Provide updates to monthly steering committee Maintain documentation for programs in market Corporate OBA Steering Committee Frequency: Monthly Participation: Relevant Business and Marketing Counsel Corporate Privacy Regional Privacy Counsels CRM Dell Website team Online team project leads (as appropriate) Agenda Working committee project summary Exec escalations (from above) Legislative updates

24 Project Review and Approval Committee Membership: Dell stakeholders with interest in and influence over online behavioral advertising activities, on-site and offsite Process Flow Project Mandate developed by program manager in conjunction with Commercial CRM privacy team Project Mandate briefed to Working Committee Escalated to Steering Committee if required Project plan and milestones developed for pilot / deployment phases Milestones updates provided in subsequent Working Committee meetings

25 Ad Notice and Site Notice

26 Cookie Audit Established Cookie Governance Working Group Pull knowledge and expertise from across the organisation Data Privacy, Legal, CRM, Online team, Marketing, Information Security, Business Controls. Number of drivers for this project: Compliance with cookie requirements in EU eprivacy Directive. Site Stability issues from use of third party pixels and cookies User experience concerns that may affect the website Information Security concerns Legal concerns in managing 3 rd party pixels and cookies on Dell site The easy part: 1 st party cookies Develop a template with all necessary data: Cookie name and owner Purpose/classification Strictly necessary? Lifespan Data collected The challenge: 3 rd & 4 th party cookies Ask key marketing partners for help If necessary, go to the contract involve your legal team Engage at highest level not local Persist!

27 Cookie Governance Single point of ownership of governance Online team responsible for managing Responsible for keeping cookie inventory current Coordinating updates to cookies owned by Dell and process for updating information from 3 rd party vendors Ongoing monitoring using scan data for cookies and web beacons Local online expert for cookie/web beacon/tags and privacy requirements Tool for managing new/change process for cookies Regular liaison with data privacy team for guidance and updates on requirements Monitor global developments by regulators Role within Data Privacy team Interpret requirements and their impact on Dell Wok closely with business teams, legal, IT and edell to assist implementation of requirements to ensure compliance

28 The Curve Ball: Micro Sites There are other websites out there that look and feel like Dell but are managed by 3 rd parties Outside the scope of central on-line team, but set up on behalf of Dell and need to be compliant Spin-off project to create governance for Micro Sites. Call to all business areas to register any sites managed by 3rd parties and complete template Checklist for any business team who wish to set-up a dell micro-site going forward.

29 Wrap Up: Top 5 Things Online behavioral advertising, cookies, tracking technology these are under scrutiny in many jurisdictions around the world. It s not just the EU. It s challenging to keep up with and manage the various global requirements, but there are some ways to make it easier. Facilitate compliance by providing your business partners with easier ways to share their strategy and new initiatives with you. Set clear expectations for the business for what may be required for compliance prior to rolling out a new initiative. Establish processes and teams for managing programs.

30 Q & A A

31 Reference Materials U.S. FTC Privacy Report, Protecting Consumer Privacy in an Era of Rapid Change, March 2012: Guidelines on behavioral advertising issued by Canadian Privacy Commissioner Article 29 Data Protection Working Party, Opinion 04/2012 on Cookie Consent Exemption, 7 June 2012: 29/documentation/opinion-recommendation/files/2012/wp194_en.pdf Article 29 Data Protection Working Part, Opinion 16/2011 on EASA/IAB Best Practice Recommendation on OnlineBehavioural Advertising, 8 Dec 2011: