Managing Privacy in a Global Organization

Stewart Dresner
Chief Executive, Privacy Laws & Business
5th floor, Raebarn House, 100, Northolt Road, Harrow, Middlesex, HA2 0BX, United Kingdom Tel: + 44 208 423 1300 Fax: + 44 208 423 4536 E-mail stewart@privacylaws.com

www.privacylaws.com

Contents
1. Fundamental differences between US, Europe and Asia
2. Implementation requires a balance between a legally correct policy and everyday procedures 3. Staff training 4. Credible privacy audits

5. Penalties and sanctions

6. Integrating privacy into your business strategy

Fundamental differences US/Europe

1. European law/rights based privacy compared with US transaction/sectoral approach. 2. Frustration when IT systems cannot be used as intended - often alternative legal approach after discussion 3. Need to understand the European Unions approach and the Member States differences 4. Success = balancing details and the big picture

Implementation: A balance between a legal policy and everyday procedures

1. Key to success is the ability of the CPO to make privacy policy compatible with the corporate culture 2. Why legal advice is necessary but not sufficient

3. Legal advice may be correct but must be in plain language to be really useful
4. Some legal advice may be too cautious

5. Advice relevant to each department/level of staff?

6. How do you know?

Staff awareness and training

1. All managers and staff handling personal data 2. Relevant messages in their operational context 3. All staff dealing with customers and prospects 4. Check messages understood and implemented 5. Advantages and disadvantages of internal/

external training provider

6. Training needs to be repeated and updated 7. Managing privacy is never a quick fix

Why Audit?
The key reasons for carrying out audit activities are: 1. To assess the level of compliance with national privacy laws 2. To assess the level of compliance with the organizations own privacy compliance system 3. To identify potential gaps and weaknesses in the privacy law system 4. To provide information for a privacy compliance system review

What should you audit?

1. Retention - appropriate weeding and deletion of information 2. Documentation on authorised use of systems, e.g. codes of practice, guidelines etc. 3. Compliance with individuals rights, such as right of access to information 4. Compliance with privacy laws in the context of other pieces of legislation such as human rights laws and freedom of information laws

Penalties and sanctions

1. Enforcement by privacy regulators - criminal law 2. Civil suits for damage and distress 3. Negative publicity from media coverage - loss of consumer confidence 4. Withdrawal of privacy seals 5. Opportunity cost of having not taken privacy seriously and consequences for future marketing

Integrating privacy into business strategy

1. CPO can try to influence top management parallel with environmental issues 2. Stress the positive aspects of privacy 3. Transforming risk assessment into everyday compliance with privacy laws 4. Privacy as a competitive advantage 5. Integrating privacy into your business strategy - Brand value - Reputation