Information Governance Roadmap Mitigating Privacy Risks, Reducing Costs And Meeting Obligations
Speakers Heather Buchta Quarles & Brady Partner Rebecca Perry Jordan Lawrence CIPP/US/G Director of Professional Services
Over Retention Is Costly and Dangerous 3
Defensible Deletion Solves the Problems 4
What is Information Governance? 5
Gartner s Definition: The specification of decision rights and an accountability framework to ensure appropriate behavior in the valuation, creation, storage, use, archiving and deletion of information. It includes the processes, roles and policies, standards and metrics that ensure the effective and efficient use of information in enabling an organization to achieve its goals. 6
Multi-Faceted Information security Data science Electronic discovery Business management Compliance Business intelligence Analytics Records management Finance Audit Privacy Risk Management IT and Infrastructure Management - Information Governance Initiative 7
ABC Company s Retention Schedule DOOM 9
Start With a Solid Foundation MEDIA DATA SUBJECTS SENSITIVITY PRIVACY RECORD TYPE DNA STORAGE REGULATORY USAGE & RETENTION 10
What Do You Have? Accident/Incident Records Advertising Records Benefit Records Budget Records Contracts & Agreements Coupon Records Credit Approvals Customer Information Customer Orders Employee Medical Files Gift Card Functions Payment Records Sales Receipts 11
Where Is It? 1010100011 1001010011 0 1 1 0 1 0 0 1 0 0 1 0 1 1 0 1 0 0 1 1 0 1 0 0 1 1 0 1 1 0 0 0 1 0 0 1 12
What Are the Requirements? BUSINESS NEEDS SENSITIVITY REQUIREMENTS Cardholder Data Corporate Sensitive Government IDs Intellectual Property PII Bio Metric Patient Health Info. DOL FSMA GLB HIPAA OSHA SEC State Privacy Laws 13
14
15
16
17
Actionable Retention Schedule 18
Retention For All Information Valid Business Records LEGITIMATE RETENTION REQUIREMENTS Litigation Holds Reference Value RETENTION VARIES Most Information HAS LITTLE RETENTION VALUE 19
Deletion Strategy for Email INBOX = 180 DAYS NON-ESSENTIAL COMMUNICATION SENT ITEMS = 180 DAYS DELETED ITEMS = 2 DAYS BUSINESS NEED COMMUNICATIONS 18 MONTH RETENTION (ALL DEPARTMENTS) DEPARTMENTAL EXCEPTIONS 6 YEAR RETENTION HR 7 YEAR RETENTION LEGAL 7 YEAR RETENTION TAX 20 DISABILITY RECORDS 6 YEARS
Leverage Technology RECORDS NON-RECORDS 6 Years 3 Years 18 Months
Eliminate Obsolete Paper Records 44% Of Boxes Eligible for Immediate Destruction Remaining Boxes 56% Destroyed Boxes 44% 22
Training ABC Company s Records Management Training 23
Build Your Audit Trail Require Regular Policy Attestation Records Retention Policy 24
Mitigating Privacy Risks Assessing Privacy Risks and Steps to Risk Reduction 25
Privacy Assessment Privacy Audit Due Diligence INTERVIEWS INVESTIGATION Identify Who? What? When? Where? Why? DATA CONSUMER OR BUSINESS? SOURCE ONLINE OR OFFLINE? GEOGRAPHY US OR FOREIGN? CONTEXT PURCHASES OR SWEEPSTAKES? STORAGE ONSITE OR OFFSITE? USAGE SHARED OR USED INTERNALLY? 26
Categorize your Data Create a data map Is your data sensitive? PERSONALLY IDENTIFIABLE? FINANCIAL? HEALTH RELATED? EMPLOYEE RELATED? Resulting risk profile and potential exposure 27
Regulatory Review UNITED STATES PERSONAL INFORMATION HEALTH INFORMATION FINANCIAL INFORMATION EMPLOYEE INFORMATION FEDERAL FTC Act COPPA CAN-SPAM TCPA FERPA STATE Breach Notification Point of Sale Collection State Consumer Protection Security Obligations FEDERAL HIPAA HITECH Health Breach Notification Rule GINA STATE HIPAA-like FEDERAL GLB FCRA FACTA STATE GLB-like FEDERAL ERISA FMLA Whistleblower Protection Act STATE Contract law 28
Industry Review CREDIT CARD DATA PCI DSS V.3 NEVADA 603A.215 MINNESOTA 325E.64 ONLINE TRACKING DIGITAL ADVERTISING ALLIANCE OBA AND RETARGETING NATIONAL INSTITUTE OF STANDARDS & TECHNOLOGY (NIST) MEDIA SANITATION CYBERSECURITY FRAMEWORK NORTH AMERICAN ELECTRIC RELIABILITY CORPORATION (NERC) 29
Self-Imposed Obligations Contractual VENDORS CUSTOMERS Privacy Policies and Privacy Notices 30
Security Appropriate and Reasonable Security audit SYSTEMATIC, MEASURABLE TECHNICAL ASSESSMENT OF HOW THE ORGANIZATION'S SECURITY POLICY IS EMPLOYED AT A SPECIFIC SITE (SYMANTEC 2003) What is involved? PERSONAL INTERVIEWS VULNERABILITY SCANS (PEN-TESTING) EXAMINATIONS OF OPERATING SYSTEM SETTINGS ANALYSES OF NETWORK SHARES AND OTHER DATA 31
When, Not If WISP Consider Insurance Options Identify Key Team Members KEY EXECUTIVES COMPLIANCE CISO? LEGAL MARKETING/HR PR IT/FORENSICS INCIDENT RESPONSE VENDOR? Incident Response Plan Tabletop Exercises 32
Next Steps.. 1. Internal Privacy Program 2. Data Retention Schedule 3. Regularly Review 4. Continuing process. 33
Heather Buchta 602.229.5228 heather.buchta@quarles.com Partner Quarles & Brady Rebecca Perry 636.821.2251 rperry@jordanlawrence.com CIPP/US Director of Professional Services Jordan Lawrence 35