Francoise Gilbert
This document was uploaded by user and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this DMCA report form. Report DMCA
Overview
Download & View Francoise Gilbert as PDF for free.
More details
- Words: 1,042
- Pages: 15
Intellectual Property Society Managing Intellectual Property Rights And Privacy Issues In Outsourcing Mountain View , CA - January 20, 20004
Keeping Information Safe: Privacy and Security Issues Françoise Gilbert Palo Alto, CA
(650) 804-1235 [email protected] © 2004 IT Law Group
www.itlawgroup.com
1
INFORMATION PRIVACY AND SECURITY IN 2004 • Increased consumers’ awareness – need to protect privacy – risks of theft identity – burden of spam
• Increasing number of laws or regulations • Increased government and private scrutiny – Government investigations (e.g. FTC, State agencies) – Private suits (individual or class action) – Actions by private organizations (e.g. TRUSTe) © 2004 IT Law Group
www.itlawgroup.com
2
RISKS AND EXPOSURE • • • •
Public relations disasters Damages and penalties Payment of plaintiff's attorneys fee Obligation to implement strict privacy, security procedures • Obligation to submit to audits and government scrutiny • Inability to pursue contemplated transaction © 2004 IT Law Group
www.itlawgroup.com
3
TODAY’S PRESENTATION • Understand the restrictions and requirements before attempting BPO – Privacy and Security in the US • Selected US and State laws • Litigation
– Global companies’ concerns
• Understand the exposure in transferring data abroad – Data Protection outside of the US – Selected foreign laws
• Tools and tips to reduce privacy and security risks in Outsourcing – Due diligence – Contract
© 2004 IT Law Group
www.itlawgroup.com
4
COMPLEX LEGAL FRAMEWORK • Sectoral approach; no legislation of general application • Some federal laws (e.g. financial information, health information, children on-line information) • Some state laws (e.g. California SB 1386) • Agency regulations (e.g. FTC, Office of Treasury) • Sect. 5 of FTC ACT and state “mini FTC Acts”, which address unfair or deceptive practices
© 2004 IT Law Group
www.itlawgroup.com
5
HIPAA A Covered Entity • May use and disclose Protected Health Information only as permitted or required • May disclose PHI to Business Associates and may allow a Business Associate to create of receive PHI on its behalf only if it obtains “satisfactory assurance” (documented in written agreement) that the Business Associate will appropriately safeguard the information • Will not be in compliance if Business Associate agreement is not adequate, not in place or not enforced © 2004 IT Law Group
www.itlawgroup.com
6
GRAMM-LEACH-BLILEY ACT • Creates an affirmative duty for Financial Institutions to – Respect the privacy of its customers – Protect the security and confidentiality of Non Public Information
• FI must give the customer clear and conspicuous notice of the FI’s privacy practices • FI may not disclose an individual’s Non Public Information to non affiliated third parties unless the FI has provided the individual with: – Prior written notice of its intent to disclose; and – Right to opt-OUT (direct that the information not be disclosed) © 2004 IT Law Group
www.itlawgroup.com
7
CALIFORNIA LAW SB 1386 If a breach of security occurs, the affected entities must: • disclose any breach of security of the system • following discovery or notification of the breach of security • in the most expedient time possible and without unreasonable delay • in writing • to any resident of California • whose unencrypted personal information – was, or – is reasonably believed to have been acquired by an unauthorized person © 2004 IT Law Group
www.itlawgroup.com
8
PRIVACY POLICIES AND TRANSFER OF DATABASES Toysmart.com • Privacy policy stated: "you can rest assured that your information will never be shared by a third party" • Attempted sale of database of customer information • FTC and 39 state AGs filed injunction to prevent sale • Ultimately, Disney, which had a controlling interest in Toysmart.com, purchased the list for $50,000 and destroyed it
© 2004 IT Law Group
www.itlawgroup.com
9
PRIVACY & SECURITY ABROAD EXAMPLES OF COUNTRIES WITH DATA PROTECTION LAWS
• • • • • • • • • •
15 EU Members Argentina Australia Brazil Bulgaria Canada Chile Czech Republic Estonia Hong Kong
© 2004 IT Law Group
• • • • • • • • • •
Hungary Iceland Israel New Zealand Norway Paraguay Poland Russia Slovakia Switzerland
www.itlawgroup.com
10
EXAMPLES OF COUNTRIES WITH LIMITED OR NO DATA PROTECTION • Most of Asia except Russia • China • India (in progress) • Japan (in progress) • Malaysia
© 2004 IT Law Group
• • • • • •
Philippines Singapore Central America Mexico Middle East except Israel Africa
www.itlawgroup.com
11
TRANSBORDER DATA FLOW IN EU/EEA • The EU Data Protection Directive requires that the laws of the member countries preclude transmission of data outside the EEA if the data are undergoing processing, or are intended for processing after the transfer, unless the non EEA country ensures an "adequate" level of protection • Exception: – Unambiguous consent by the data subject (i.e. OPT-IN) – Transfer is necessary for performance of a contract, to protect vital interest of the data subject or public interest – Data controller enters into a contract with the third party that ensures the same level of protection as provided under the EU state law © 2004 IT Law Group
www.itlawgroup.com
12
DUE DILIGENCE BEFORE OUTSOURCING • Are there restrictions to giving access to data to a third party? • Which privacy/security laws or regulations govern Company’s activities? • What are Company’s privacy and information security requirements or needs? • What additional cost will result from responding to these needs? • Are Company’s needs and restrictions compatible with Vendor's operations? • Does Vendor (and subcontractors) have adequate information security procedures to protect Company's databases? • What data protection laws are in place in Vendor’s country? © 2004 IT Law Group
www.itlawgroup.com
13
OUTSOURCING CONTRACT • Establish privacy and security policies and guidelines • Define limitations on collection, use, transfer of PII • Require Vendor’s assistance in complying with Company's obligations to clients, employees or law enforcement authorities • Address ownership of PII collected during the relationship • Address Vendor’s ability to subcontract services to third parties • Provide for warranties, indemnification with respect to privacy and security • Consider compliance audits • Address changes required by new law and jurisprudence • Define actions upon termination of the outsourcing relationship © 2004 IT Law Group
www.itlawgroup.com
14
QUESTIONS? Françoise Gilbert [email protected] (650) 804-1235 www.itlawgroup.com
© 2004 IT Law Group
www.itlawgroup.com
15
Keeping Information Safe: Privacy and Security Issues Françoise Gilbert Palo Alto, CA
(650) 804-1235 [email protected] © 2004 IT Law Group
www.itlawgroup.com
1
INFORMATION PRIVACY AND SECURITY IN 2004 • Increased consumers’ awareness – need to protect privacy – risks of theft identity – burden of spam
• Increasing number of laws or regulations • Increased government and private scrutiny – Government investigations (e.g. FTC, State agencies) – Private suits (individual or class action) – Actions by private organizations (e.g. TRUSTe) © 2004 IT Law Group
www.itlawgroup.com
2
RISKS AND EXPOSURE • • • •
Public relations disasters Damages and penalties Payment of plaintiff's attorneys fee Obligation to implement strict privacy, security procedures • Obligation to submit to audits and government scrutiny • Inability to pursue contemplated transaction © 2004 IT Law Group
www.itlawgroup.com
3
TODAY’S PRESENTATION • Understand the restrictions and requirements before attempting BPO – Privacy and Security in the US • Selected US and State laws • Litigation
– Global companies’ concerns
• Understand the exposure in transferring data abroad – Data Protection outside of the US – Selected foreign laws
• Tools and tips to reduce privacy and security risks in Outsourcing – Due diligence – Contract
© 2004 IT Law Group
www.itlawgroup.com
4
COMPLEX LEGAL FRAMEWORK • Sectoral approach; no legislation of general application • Some federal laws (e.g. financial information, health information, children on-line information) • Some state laws (e.g. California SB 1386) • Agency regulations (e.g. FTC, Office of Treasury) • Sect. 5 of FTC ACT and state “mini FTC Acts”, which address unfair or deceptive practices
© 2004 IT Law Group
www.itlawgroup.com
5
HIPAA A Covered Entity • May use and disclose Protected Health Information only as permitted or required • May disclose PHI to Business Associates and may allow a Business Associate to create of receive PHI on its behalf only if it obtains “satisfactory assurance” (documented in written agreement) that the Business Associate will appropriately safeguard the information • Will not be in compliance if Business Associate agreement is not adequate, not in place or not enforced © 2004 IT Law Group
www.itlawgroup.com
6
GRAMM-LEACH-BLILEY ACT • Creates an affirmative duty for Financial Institutions to – Respect the privacy of its customers – Protect the security and confidentiality of Non Public Information
• FI must give the customer clear and conspicuous notice of the FI’s privacy practices • FI may not disclose an individual’s Non Public Information to non affiliated third parties unless the FI has provided the individual with: – Prior written notice of its intent to disclose; and – Right to opt-OUT (direct that the information not be disclosed) © 2004 IT Law Group
www.itlawgroup.com
7
CALIFORNIA LAW SB 1386 If a breach of security occurs, the affected entities must: • disclose any breach of security of the system • following discovery or notification of the breach of security • in the most expedient time possible and without unreasonable delay • in writing • to any resident of California • whose unencrypted personal information – was, or – is reasonably believed to have been acquired by an unauthorized person © 2004 IT Law Group
www.itlawgroup.com
8
PRIVACY POLICIES AND TRANSFER OF DATABASES Toysmart.com • Privacy policy stated: "you can rest assured that your information will never be shared by a third party" • Attempted sale of database of customer information • FTC and 39 state AGs filed injunction to prevent sale • Ultimately, Disney, which had a controlling interest in Toysmart.com, purchased the list for $50,000 and destroyed it
© 2004 IT Law Group
www.itlawgroup.com
9
PRIVACY & SECURITY ABROAD EXAMPLES OF COUNTRIES WITH DATA PROTECTION LAWS
• • • • • • • • • •
15 EU Members Argentina Australia Brazil Bulgaria Canada Chile Czech Republic Estonia Hong Kong
© 2004 IT Law Group
• • • • • • • • • •
Hungary Iceland Israel New Zealand Norway Paraguay Poland Russia Slovakia Switzerland
www.itlawgroup.com
10
EXAMPLES OF COUNTRIES WITH LIMITED OR NO DATA PROTECTION • Most of Asia except Russia • China • India (in progress) • Japan (in progress) • Malaysia
© 2004 IT Law Group
• • • • • •
Philippines Singapore Central America Mexico Middle East except Israel Africa
www.itlawgroup.com
11
TRANSBORDER DATA FLOW IN EU/EEA • The EU Data Protection Directive requires that the laws of the member countries preclude transmission of data outside the EEA if the data are undergoing processing, or are intended for processing after the transfer, unless the non EEA country ensures an "adequate" level of protection • Exception: – Unambiguous consent by the data subject (i.e. OPT-IN) – Transfer is necessary for performance of a contract, to protect vital interest of the data subject or public interest – Data controller enters into a contract with the third party that ensures the same level of protection as provided under the EU state law © 2004 IT Law Group
www.itlawgroup.com
12
DUE DILIGENCE BEFORE OUTSOURCING • Are there restrictions to giving access to data to a third party? • Which privacy/security laws or regulations govern Company’s activities? • What are Company’s privacy and information security requirements or needs? • What additional cost will result from responding to these needs? • Are Company’s needs and restrictions compatible with Vendor's operations? • Does Vendor (and subcontractors) have adequate information security procedures to protect Company's databases? • What data protection laws are in place in Vendor’s country? © 2004 IT Law Group
www.itlawgroup.com
13
OUTSOURCING CONTRACT • Establish privacy and security policies and guidelines • Define limitations on collection, use, transfer of PII • Require Vendor’s assistance in complying with Company's obligations to clients, employees or law enforcement authorities • Address ownership of PII collected during the relationship • Address Vendor’s ability to subcontract services to third parties • Provide for warranties, indemnification with respect to privacy and security • Consider compliance audits • Address changes required by new law and jurisprudence • Define actions upon termination of the outsourcing relationship © 2004 IT Law Group
www.itlawgroup.com
14
QUESTIONS? Françoise Gilbert [email protected] (650) 804-1235 www.itlawgroup.com
© 2004 IT Law Group
www.itlawgroup.com
15
Related Documents
Francoise Gilbert
July 2020 3
O-urbanismo-francoise-choaypdf.pdf
November 2019 20
Christopher Gilbert
November 2019 21
Nancy Gilbert
December 2019 26
Gilbert Shelton
October 2019 30