1. Recent Privacy Developments ISACA January 12, 2012 Keith A. Cheresko and Robert L. Rothman Principals, Privacy Associates International LLC

2. Purpose

3. Purpose

4. Purpose

5. Purpose

6. Purpose

7. Purpose

8. Purpose

9. Areas or Topics of Privacy Activity • Breach • Cloud • Geo-location • Facial Recognition • BYOD • Marketing • Social Media • OBA • Consumer Financial Protection Bureau • Federal Trade Commission • COPPA • Health Care • International • EU Cookie Rules • EU Data Protection Directive • APEC • USA PATRIOT ACT • Supplier Relationships

10. Focus on Several Items • Social Media • Breach • Marketing • Supplier Relationships • Privacy Developments from the EU • TEST!

11. US Developments

12. Breach PII

13. States Continue Tightening Requirements

14. Class Actions Proliferating

15. Breach Notification No general national beach notification law - BUT

16. Breach Notification • Internal processes • Training • Policies and practices • Supplier action implications

17. Social Media

18. Endorsements

19. HR Implications

20. Social Media Labor Relations

21. Social Media NLRB Actions

22. Social Media • Policies and practices • Internal processes • Training • Enforcement

23. BYOD

24. Marketing

25. OBA – Online Behavioral Advertising

26. Geo-Location

27. COPPA

28. Texting

29. Marketing • Policies and practices • Internal processes • Training • Enforcement

30. Facial Recognition

31. Supplier Relationships

32. Supplier Relationships Cloud Computing

33. Supplier Relationships Contracts!

34. Supplier Relationships • Contract • Allocation of liability • Responsibility for actions of others

35. European Data Protection Directive

36. The European Data Protection Laws Have Been a Compliance Headache for Companies Around the World

37. Proposed New Data Protection Regulation

38. The Good News DIRECTIVE REGULATION

39. The Bad News Nearly Everything Else

40. Significantly Increased Fines and Penalties

41. Consent Narrowed

42. Data Breach Notification

43. Right to Be Forgotten

44. Data Minimization

45. Accountability

46. Mandatory Data Privacy Officer

47. Companies Outside Europe Potentially Subject to the Regulation

48. Status of Regulation

49. My Head Hurts

50. BULL NO-BULL TEST