72 Hours’ Notice: Incident Response Management under the GDPR | TrustArc

PRIVACY INSIGHT SERIES Winter / Spring 2018 Webinar Program

72 Hours Notice: Incident Response Management under the GDPR 18 April 2018

© 2018 TrustArc Inc Proprietary and Confidential Information

Today’s Speakers Ashley Slavik Senior Counsel & Data Protection Officer Veeva Systems Inc.

K Royal Consulting Director (West) Senior Privacy Consultant TrustArc

2

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

Today’s Agenda • Welcome & Introductions

• Legal requirements • Practical approach • Operational effectiveness • Case study

3

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

PRIVACY INSIGHT SERIES Winter / Spring 2018 Webinar Program

Thanks for your interest in the webinar slides!

To watch the on-demand recording please CLICK HERE.

© 2018 TrustArc Inc Proprietary and Confidential Information

PRIVACY INSIGHT SERIES Winter / Spring 2018 Webinar Program

Legal Requirements

5

© 2018 TrustArc Inc Proprietary and Confidential Information

Definitions • Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

• Controller: determines the purposes and means of the processing of personal data.

• Processor: processes personal data on behalf of the Controller.

6

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

Notification requirements • Controller: without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the supervisory authority unless it is unlikely to result in a risk to the rights and freedoms of natural persons.

• Controller: When likely to result in a high risk to the rights and freedoms of natural persons, notify the data subject without undue delay.

• Processor: notify Controller without undue delay after becoming aware of a personal data breach.

7

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

Documentation requirements • Controller: must document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.

8

Privacy Insight Series - trustarc.com/insightseries

Š 2018 TrustArc Inc

Lifecycle of an event

Nonevent

Event

Possible incident

Incident

Possible breach

Breach

A non-event may be screened out from alerting at all.

An event is a trigger that looks like something out of the normal occurred.

This may become a possible incident (or they may be used interchangeably) if it appears the systems were compromised or personal data was involved.

An incident is when it is verified that something occurred and may be the same as a possible breach.

A breach is a compromise to the integrity of systems or unauthorized access or disclosure of personal data.

9

Privacy Insight Series - trustarc.com/insightseries

Š 2018 TrustArc Inc

Possible event / incident Is this a breach?

Breach is a legal issue Two main points: • Don’t use the word “breach” when communicating about an “event” that may have disclosed information without permission.

• Don’t make that call yourself.

• Alert someone who can make the decision.

10

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

Privacy vs. Security Breach • You can have a privacy breach without impacting the information systems.

• Examples: misfax, lost USB. • You can have a security breach without involving personal data.

• You can have breaches that involve both.

• You can also think it is one type of breach and then learn the other type is also involved.

• Incident plans need to accommodate all scenarios.

• Incident managers need to know how to identify all areas impacted.

11

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

Privacy vs. Security Breach • You can have a privacy breach without impacting the information systems.

– Examples: misfax, lost USB.

• You can have a security breach without involving personal data.

• You can have breaches that involve both.

• You can also think it is one type of breach and then learn the other type is also involved.

• Incident plans need to accommodate all scenarios.

• Incident managers need to know how to identify all areas impacted.

12

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

PRIVACY INSIGHT SERIES Winter / Spring 2018 Webinar Program

Practical approach

13

© 2018 TrustArc Inc Proprietary and Confidential Information

How to identify and classify threats • Examples: unauthorized access, data loss, compromised data, system failure • Automated detection systems • Investigation: First line, IT and Security employees • Internal reporting: Senior level management

14

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

How to manage questions about breach • Communication policy

• Escalation path • From the Luxembourg DPA:

15

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

Breach: now what?

Practical responses Document circumstances of breach, including whether or not personal data had been protected by appropriate technical protection measures, effectively limiting the likelihood of identity fraud or other forms of misuse.

16

Privacy Insight Series - trustarc.com/insightseries

Š 2018 TrustArc Inc

To notify or not?

• What happened: Theft of a customer database • What harm: data may be used to commit identity fraud or financial loss • What happened: loss or inappropriate alteration of a staff telephone list • What harm: minimal effect on individuals outside organization

17

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

PRIVACY INSIGHT SERIES Winter / Spring 2018 Webinar Program

Operational effectiveness

18

© 2018 TrustArc Inc Proprietary and Confidential Information

Incident response plans

• Incident Management Policies • Incident Response Procedures • Incident Report Generation Work Instructions

19

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

Simulated breach: lessons learned • Andrea Jelinek, new Chair of the EU Art 29 WP suggests one of her biggest recommendations around breach is to prepare internally by doing a simulation exercise.

• Mock table tops i.e. planting a fake breach and either letting the teams know (or not) to see how they respond.

• Most likely cause of breach is human error. Make sure your workforce is your biggest asset, not your greatest risk.

20

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

True cost of breach • Not whether you suffer a breach but how quickly and in what manner you respond • Loss of trust and damage to reputation OR

• Resilience and cooperation with authorities

21

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

Enforcement View from DPAs • UK ICO currently has 200 case workers and a 60-strong “enforcement team” with FBI-style jackets to enter businesses for “dawn-raids.”

They plan to add another 150 people to the ICO team, bringing it to more than 400 and with a budget of 34 million GBP per annum.

Infringements of the organisation’s obligations, including data security breaches, will be subject to the lower level, as opposed to individual’s privacy rights will be subject to the higher level.

• France’s data protection authority, the CNIL, publicly acknowledged the difficulty of complete GDPR compliance, stating that companies not yet fully compliant “can expect to be treated leniently initially provided that they have acted in good faith.”

• The Dutch DPA has stated that “fines will only be imposed at the beginning if it is obvious something is very wrong” in response to the fears of local municipalities.

22

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

PRIVACY INSIGHT SERIES Winter / Spring 2018 Webinar Program

Case study: Red teaming

23

© 2018 TrustArc Inc Proprietary and Confidential Information

Practice makes perfect • • • •

Ethical hacking Kidnapping executives Competitors Using field level employees to compromise system or provide information • Government subverting an employee • Using passwords across accounts

24

Privacy Insight Series - trustarc.com/insightseries

© 2018 TrustArc Inc

PRIVACY INSIGHT SERIES Winter / Spring 2018 Webinar Program

Thanks for your interest in the webinar slides!

To watch the on-demand recording please CLICK HERE.

© 2018 TrustArc Inc Proprietary and Confidential Information

PRIVACY INSIGHT SERIES Winter / Spring 2018 Webinar Program

Questions?

26

© 2018 TrustArc Inc Proprietary and Confidential Information

PRIVACY INSIGHT SERIES Winter / Spring 2018 Webinar Program

Contacts Ashley Slavik K Royal

27

ashley.slavik@veeva.com kroyal@trustarc.com

© 2018 TrustArc Inc Proprietary and Confidential Information

PRIVACY INSIGHT SERIES Winter / Spring 2018 Webinar Program

Thank You! Register now for the next webinar in our 2018 Winter / Spring Webinar Series “One Week to Go – Are you Ready for May 25?” and is due to take place on May 16, 2018.

See http://www.trustarc.com/insightseries for the 2018 Privacy Insight Series and past webinar recordings.

28

© 2018 TrustArc Inc Proprietary and Confidential Information