Keeping Information Safe: Privacy and Security Issues
- 1. Intellectual Property Society Managing Intellectual Property Rights And Privacy Issues In Outsourcing Mountain View , CA - January 20, 20004 Keeping Information Safe: Privacy and Security Issues Françoise Gilbert Palo Alto, CA (650) 804-1235 fgilbert@itlawgroup.com © 2004 IT Law Group www.itlawgroup.com 1
- 2. INFORMATION PRIVACY AND SECURITY IN 2004 • Increased consumers’ awareness – need to protect privacy – risks of theft identity – burden of spam • Increasing number of laws or regulations • Increased government and private scrutiny – Government investigations (e.g. FTC, State agencies) – Private suits (individual or class action) – Actions by private organizations (e.g. TRUSTe) © 2004 IT Law Group www.itlawgroup.com 2
- 3. RISKS AND EXPOSURE • Public relations disasters • Damages and penalties • Payment of plaintiff's attorneys fee • Obligation to implement strict privacy, security procedures • Obligation to submit to audits and government scrutiny • Inability to pursue contemplated transaction © 2004 IT Law Group www.itlawgroup.com 3
- 4. TODAY’S PRESENTATION • Understand the restrictions and requirements before attempting BPO – Privacy and Security in the US • Selected US and State laws • Litigation – Global companies’ concerns • Understand the exposure in transferring data abroad – Data Protection outside of the US – Selected foreign laws • Tools and tips to reduce privacy and security risks in Outsourcing – Due diligence – Contract © 2004 IT Law Group www.itlawgroup.com 4
- 5. COMPLEX LEGAL FRAMEWORK • Sectoral approach; no legislation of general application • Some federal laws (e.g. financial information, health information, children on-line information) • Some state laws (e.g. California SB 1386) • Agency regulations (e.g. FTC, Office of Treasury) • Sect. 5 of FTC ACT and state “mini FTC Acts”, which address unfair or deceptive practices © 2004 IT Law Group www.itlawgroup.com 5
- 6. HIPAA A Covered Entity • May use and disclose Protected Health Information only as permitted or required • May disclose PHI to Business Associates and may allow a Business Associate to create of receive PHI on its behalf only if it obtains “satisfactory assurance” (documented in written agreement) that the Business Associate will appropriately safeguard the information • Will not be in compliance if Business Associate agreement is not adequate, not in place or not enforced © 2004 IT Law Group www.itlawgroup.com 6
- 7. GRAMM-LEACH-BLILEY ACT • Creates an affirmative duty for Financial Institutions to – Respect the privacy of its customers – Protect the security and confidentiality of Non Public Information • FI must give the customer clear and conspicuous notice of the FI’s privacy practices • FI may not disclose an individual’s Non Public Information to non affiliated third parties unless the FI has provided the individual with: – Prior written notice of its intent to disclose; and – Right to opt-OUT (direct that the information not be disclosed) © 2004 IT Law Group www.itlawgroup.com 7
- 8. CALIFORNIA LAW SB 1386 If a breach of security occurs, the affected entities must: • disclose any breach of security of the system • following discovery or notification of the breach of security • in the most expedient time possible and without unreasonable delay • in writing • to any resident of California • whose unencrypted personal information – was, or – is reasonably believed to have been acquired by an unauthorized person © 2004 IT Law Group www.itlawgroup.com 8
- 9. PRIVACY POLICIES AND TRANSFER OF DATABASES Toysmart.com • Privacy policy stated: "you can rest assured that your information will never be shared by a third party" • Attempted sale of database of customer information • FTC and 39 state AGs filed injunction to prevent sale • Ultimately, Disney, which had a controlling interest in Toysmart.com, purchased the list for $50,000 and destroyed it © 2004 IT Law Group www.itlawgroup.com 9
- 10. PRIVACY & SECURITY ABROAD EXAMPLES OF COUNTRIES WITH DATA PROTECTION LAWS • 15 EU Members • Hungary • Argentina • Iceland • Australia • Israel • Brazil • New Zealand • Bulgaria • Norway • Canada • Paraguay • Chile • Poland • Czech Republic • Russia • Estonia • Slovakia • Hong Kong • Switzerland © 2004 IT Law Group www.itlawgroup.com 10
- 11. EXAMPLES OF COUNTRIES WITH LIMITED OR NO DATA PROTECTION • Most of Asia except • Philippines Russia • Singapore • China • Central America • India (in progress) • Mexico • Japan (in progress) • Middle East except Israel • Malaysia • Africa © 2004 IT Law Group www.itlawgroup.com 11
- 12. TRANSBORDER DATA FLOW IN EU/EEA • The EU Data Protection Directive requires that the laws of the member countries preclude transmission of data outside the EEA if the data are undergoing processing, or are intended for processing after the transfer, unless the non EEA country ensures an "adequate" level of protection • Exception: – Unambiguous consent by the data subject (i.e. OPT-IN) – Transfer is necessary for performance of a contract, to protect vital interest of the data subject or public interest – Data controller enters into a contract with the third party that ensures the same level of protection as provided under the EU state law © 2004 IT Law Group www.itlawgroup.com 12
- 13. DUE DILIGENCE BEFORE OUTSOURCING • Are there restrictions to giving access to data to a third party? • Which privacy/security laws or regulations govern Company’s activities? • What are Company’s privacy and information security requirements or needs? • What additional cost will result from responding to these needs? • Are Company’s needs and restrictions compatible with Vendor's operations? • Does Vendor (and subcontractors) have adequate information security procedures to protect Company's databases? • What data protection laws are in place in Vendor’s country? © 2004 IT Law Group www.itlawgroup.com 13
- 14. OUTSOURCING CONTRACT • Establish privacy and security policies and guidelines • Define limitations on collection, use, transfer of PII • Require Vendor’s assistance in complying with Company's obligations to clients, employees or law enforcement authorities • Address ownership of PII collected during the relationship • Address Vendor’s ability to subcontract services to third parties • Provide for warranties, indemnification with respect to privacy and security • Consider compliance audits • Address changes required by new law and jurisprudence • Define actions upon termination of the outsourcing relationship © 2004 IT Law Group www.itlawgroup.com 14
- 15. QUESTIONS? Françoise Gilbert fgilbert@itlawgroup.com (650) 804-1235 www.itlawgroup.com © 2004 IT Law Group www.itlawgroup.com 15