Building Your DPIA/PIA Program: Tips & Case Studies | TrustArc Webinar

PRIVACY INSIGHT SERIES Summer / Fall 2017 Webinar Program

Building Your DPIA/PIA Program: Tips & Case Studies September 12, 2017

© 2017 TrustArc Inc Proprietary and Confidential Information

Today’s Speakers

Alexia Maas SVP - General Counsel, Volvo Financial Services

Beth Sipula Sr. Privacy Consultant, TrustArc

Privacy Insight Series - trustarc.com/insightseries

© 2017 TrustArc Inc

Today’s Agenda • Welcome & Introductions • • • •

GDPR compliance requirements Essential elements for building your program Recommendations for success Q&A

Privacy Insight Series - trustarc.com/insightseries

© 2017 TrustArc Inc

Poll Question Do you have an internal PIA or DPIA process in place?

A. Yes B. No 4%

TrustArc / Dimensional Research 2017 4

Privacy Insight Series - trustarc.com/insightseries

Š 2017 TrustArc Inc

PRIVACY INSIGHT SERIES Summer / Fall 2017 Webinar Program

GDPR Requirements for DPIAs

© 2017 TrustArc Inc Proprietary and Confidential Information

The EU GDPR – May 25, 2018 Deadline Significant Compliance Requirements

6

Privacy Insight Series - trustarc.com/insightseries

© 2017 TrustArc Inc

GDPR Requirements for DPIAs

(Articles 35 and 36)

Processing likely to result in high risk

DPIA Required Article 35(1) • •

•

No •

Systematic description of the processing Assessment of necessity and proportionality Assessment of the risks to the rights and freedoms of data subjects Measures to address the risks

Is residual risk high?

No DPIA Required No

No DPA Consult Required Privacy Insight Series - trustarc.com/insightseries

DPA Consult Required © 2017 TrustArc Inc

PIAs and DPIAs: Similarities and Differences • The terms “PIA” and “DPIA” are used interchangeably by many organizations. An organization may use a DPIA, even if a DPIA is not required, to conduct an assessment to ensure the required data protection controls are in place and to demonstrate compliance with GDPR requirements.

• DPIAs are required of organizations acting as Data Controllers.

Data Processors may also use DPIAs to assess whether they are processing data in a manner that supports the Controller in meeting its compliance obligations under the GDPR.

• Both PIAs and DPIAs enable organizations to identify the controls needed to address and reduce risk—be it a risk to the rights of individuals, a compliance risk of the organization, or both.

Privacy Insight Series - trustarc.com/insightseries

© 2017 TrustArc Inc

Processing Likely to Result in High Risk – Key Criteria Based on Article 29 Working Party Guidelines WP 248 (4 Apr 2017) • • • • • • • • • •

Automated-decision making with legal or similar significant effect Evaluation or scoring Systematic monitoring Sensitive data Data processed on a large scale Datasets that have been matched or combined Data concerning vulnerable subjects Data transfer across borders outside of the EU Innovative use or applying technological or organizational solutions Where the processing itself prevents individuals from exercising a right or using a service or a contract

Privacy Insight Series - trustarc.com/insightseries

© 2017 TrustArc Inc

Poll Question #2 How many PIAs will your organization complete in 2017?

A. B. C. D. E.

Less than 10 11 - 50 51-100 100+ I have no idea

Privacy Insight Series - trustarc.com/insightseries

Š 2017 TrustArc Inc

PRIVACY INSIGHT SERIES Summer / Fall 2017 Webinar Program

Essential Elements for Building Your Program

© 2017 TrustArc Inc Proprietary and Confidential Information

Build Your Program – 6 Essential Elements Integrated Governance

Identify stakeholders. Establish program leadership and governance.

Define program mission, vision and goals.

Risk Assessment

Identify, assess and classify datarelated strategic, operational, legal compliance and financial risks.

Resource Allocation

Establish budgets. Define roles and responsibilities. Assign competent personnel.

Policies & Standards

Develop policies, procedures and guidelines to define and deploy effective and sustainable governance and controls for managing datarelated risks.

Processes

Establish, manage, measure and continually improve processes for PIAs, vendor assessments, incident management and breach notification, complaint handling and individual rights management.

Awareness & Training

Communicate expectations. Provide general & contextual training.

Build Establish, maintain and evolve an integrated privacy and data governance program aligned with other data management and information risk functions such as security, IP, trade secret protection and e-discovery

Learn and Evolve Over Time

Privacy Insight Series - trustarc.com/insightseries

Š 2017 TrustArc Inc

1. Integrated Governance Identify your key stakeholders: Establish program leadership and governance. Define program mission, vision and goals.

Leverage relationships with key internal stakeholders (and build new ones) to drive change and adoption Key Stakeholders

Key Area (examples)

IT/Security

Responsible for data protection and securing internal systems

Human Resources

Responsible for HR data and systems

Marketing

Responsible for services to customers (both internal and external)

Legal

Responsible for ensuring legal requirements are met

Internal Audit

Responsible for managing an audit trail

Procurement

Responsible for vetting and contracting with vendors and third parties

Privacy Insight Series - trustarc.com/insightseries

Š 2017 TrustArc Inc

2. Risk Assessment Identify and assess risk: Classify data-related strategic, operational, legal compliance and financial risks.

Key Risks (examples) Significant infrastructure or systems changes New Product development where data is collected; changes to existing products new uses for data collected

New regulations and compliance requirements (GDPR) Mergers and acquisitions New vendors and third party business partners Ongoing HR related data requirements (example: employee monitoring)

Privacy Insight Series - trustarc.com/insightseries

Š 2017 TrustArc Inc

3. Resource Allocation Identify resource needs: Establish budgets. Define roles and responsibilities. Assign knowledgeable and trained personnel.

Resource Needs to Consider Executive Champion; “top down” support essential to success Training and knowledgeable personnel needed to manage PIA/DPIA process; Define roles and responsibilities

Systems needed to support the program; automation New regulations and compliance requirements (monitoring) Outside consulting and legal resources

Privacy Insight Series - trustarc.com/insightseries

© 2017 TrustArc Inc

4. Policies and Standards Develop policies and standards: Procedures and guidelines to define and deploy effective and sustainable governance and controls for managing data-related risks.

• IT Security, Data Security and Acceptable Use • Privacy Notices and Policies • Data Use, Retention and Disposal • Data Classification • Marketing Operations • Product Development

Privacy Insight Series - trustarc.com/insightseries

© 2017 TrustArc Inc

5. Processes Establish, manage, measure and continually improve processes: Ensure a unified approach to PIAs/DPIAs, vendor assessments, incident management and breach notification, complaint handling and individual rights management.

Build

• • •

Assess

Implement

Manage

Demonstrate

One size does not fit all. Organizations should develop and follow a process that makes sense for their size, type of processing, and resources PIAs/DPIAs need to be conducted according to a documented process to ensure consistency Documentation to demonstrate accountability is also critical (on demand)

Privacy Insight Series - trustarc.com/insightseries

© 2017 TrustArc Inc

6. Awareness & Training

Communicate expectations

Embed in established training cycles

Privacy Insight Series - trustarc.com/insightseries

Provide general & contextual training

Š 2017 TrustArc Inc

PRIVACY INSIGHT SERIES Summer / Fall 2017 Webinar Program

Recommendations

© 2017 TrustArc Inc Proprietary and Confidential Information

Recommendations for Success • Assign clearly defined roles for all stages • Having an Executive “Champion” or Sponsor • PIA/DPIA processes need to be simple, repeatable, concise, and they need to map to the GDPR requirements • One size does not fit all – consider the level of risk – Also consider a process with traditional PIAs for all projects and EU DPIAs for projects that trigger EU DP rules • Build a robust process with scalability in mind – Consider the system you are using, what it’ll take to make the process more efficient and automate • Over communicate and reinforce training at every opportunity

Privacy Insight Series - trustarc.com/insightseries

© 2017 TrustArc Inc

Additional Resources

www.trustarc.com/resources 21

Privacy Insight Series - trustarc.com/insightseries

Š 2017 TrustArc Inc

PRIVACY INSIGHT SERIES Summer / Fall 2017 Webinar Program

Contacts

Alexia Maas Beth Sipula

alexia.maas@vfsco.com bsipula@trustarc.com

© 2017 TrustArc Inc Proprietary and Confidential Information

Privacy Insight Series – 2017 Calendar

www.trustarc.com/insightseries

23

Privacy Insight Series - trustarc.com/insightseries

Š 2017 TrustArc Inc

PRIVACY INSIGHT SERIES Summer / Fall 2017 Webinar Program

Thank You! Register for the next webinar in our Series – October 11th

“Profiling, Big Data & Consent Under the GDPR” For full Summer/Fall schedule and past webinar recordings visit: http://www.trustarc.com/insightseries

© 2017 TrustArc Inc Proprietary and Confidential Information