Respond

Respond

1. Respond - aims to reduce organizational risk and bolster compliance to regulations

2. Information Requests

   • Complaints, issues, concerns from individuals
     • Requires more formality than just reponding to questions.
       • Needs a centralized intake process by which complaints are routed to the privacy team
         • With possible exec engagement if necessary
     • Complaints and privacy rights can be difficult to distiguish - need integration and flexibility if teams are separate to transition
     • Might result in an ethics/complaint process
       • Compliance hotline might be important if internal corruption
   • Requests for information
   • Corrections of inaccurate data
   • Clarifications on privacy matters
   • Subject access requests (UK Data Protection Act and similar international laws.

3. Handling Procedures

   • Processes/procedures to handle privacy questions/complains
   • As long as privacy resources and the privacy team are communicating with one another to ensure consistency and timely responses there are benefits to being less structured.
     • Preferable to encourage personal to come forward with questions
       • Understand limits of privacy advice that each personal can dispense
         • When first tier responders do not have the answers they must promptly involve privacy team
   • Access
     • Process where internal/external indiv can reach you easily
       • Phone, email, intranet, post box and physical
     • Need a written policy for responding to an access request with adequate verification and consistency in reasoning for granting access
     • Redresss
       • "To set right; remedy"
       • To remove the cause of a grievance or complaint
       • Redress should be clearly defined in your complain process
       • Correction
         • I.e. address change - need clear communication channel to communicate this and documented process
   • Data Integrity
     • Human Failure
       • Need a strong system to educate and resolve i.e. data entry errors
     • Systematic Error
       • Data fields are not aligned - can be costly to fix/store and resolve

4. Legal Compliance

   • Preventing Harm
     • Allow affected person to protect form identitty theft or other harm
       • I.e. financial loss, reputation or other damage
     • Primary focus when managing any privacy incident is always harm prevention and/pr minimzation
     • Data controller/owner should send out breach notifications not contractor
       • Though contract may pay a set of liquidated damages if they caused the breach per incident
     • Fed guidelines cautions agains notification where risk of little or no harm to avoid confusion
     • Five Factors
       • Nature of the data elements breached
         • Number of individuals affected
           • Likelihood that info is accessible/usable
             • Likelihood that a breach may lead to harm
               • Orgs ability to mitigate the risk of harm
   • Accountability
     • Foster a culture of privacy
     • Implementing appropriate risk controls
     • Effective compliance using these controls
     • Documenting risk mitigation
     • External Audits
     • Accountability during an incident
       • In US many companies fail to comply and they are not held accountable
         • Potentially due to reputational damage
           • Risk of tort liability is NOT significant
             • Owed a duty of care i.e. obligation to prevent access
               • failed to meet applicable standards of care
                 • Proximate to cause damage = causation is difficult to prove
       • Typicall causes of breaches
         • Third Party Hacker
         • Customer Failure
         • Lost or stolen computer equiment
         • Misconduct of customer employees
       • Accountability to a regulator is usually after a significant event that is poorly handled

5. Monitoring and Enforcement

   • Over time, monitoring and reporting on privacy compliance allows your org to identify systematic issues and prevent compliancegaps from becoming endemic

6. Incident Planning

   • Know your roster of of Stake Holders
     • Info Security Team
       • Planning: Help identify vulns before bad actors exploit them. Also detection, isolation, removal and preservation of affected system
       • During Breach: forensic investigation, evidence preservation, deletion of malware, correcting vulns - often should bring in experts
     • Legal
       • Planning - seek experienced counsel vs internal teams - limit liability and eco impact. Read leg. NEgotiate reqs on biz partners
       • During a breach: Advising corporate of notification requirements to certain groups. Recommend sound evidence collection and preservation. Read contracts for reporting reqs.
     • HR
       • Planning: Employee data handling, security awareness training and incident recognition/response training
       • During a breach: updating employees. Helping with concerns. Help investigators. Work out consequenses.
     • Marketing
       • Incident Planning: Role due to how much data they handle
       • During Breach: Expert communicators, work with PR and management for messaging
     • Business Dev
       • Planning: manages vital biz relationships
       • Breach: Notify key accounts.
     • Communications and PR
       • During a breach: Front of line communicators. Message and accuracy
       • Planning: strategic programs to handle image and informatoin
     • Union Leadrship
       • Planning: Represent union intersets for employee data
       • Breach: Provide updates
     • Finance
       • Planning: cost effective measures to mitigate breach risk. Negotiate contracts with data breach resolution providers
       • Breach: budget parameters for a response to an event. Cyber insurance. Notification expenses.
     • CEO
       • Planning: Set tone for planning.. Personal accountability.
       • Breach: allocate funds/man power to resolve a breach. Publicly comment. Talk to authorities.
     • Customer Care
       • Breach: remain calm, escalate - internal or hire depending on org
       • Planning: Deploy tech to stop phishing/soclai engineering, employee training and awareness. Deter crim activity and breaches. Prep call center staff

7. Incident Response and BCP Plan

   • BCP
     • Departmental responsibilities and actions before/after an event
     • Knowledge of the plan can make or brake an incident response
     • Tabletop exercise - simulation with a focus on familiarization of the plan. Conduct semi annually.
     • Updating the Plan - Add tabletop insights. Keep current. Update personnel as to changes.
     • Budgeting/training - long term costs outweigh benefits in good training of employees
       • Exposing gaps in applications, procedurs and plans in pre phase.
       • Greater overall security
       • Reduced financial liability and reg exposure
       • Lower breach related costs
       • Preservation of brand reputation and integrity in the market place
     • Breach response best practice -allocate sufficent funds.
   • Incident Detection
     • Privacy Definitions
       • Privacy Incident - potential or actual compromise of personal information -intentional or unintentional access by third parties. Incident/breach interchangeably.
     • Insiders/Third parties not hackers are the cause generally
       • Employee error or negligence is one of biggest causes of privacy breaches.
     • Encountering a Breach
       • Training should teach employees to recognize, report breaches.
       • Reporting Worksheets
     • Notification Requirements and Guidelines
       • Escalation - internal process of notification.
       • Notification - process of informing affected individulas
         • Mishandling can lead to fines and unbudgeted expenses
       • Immediately lock down internal communications and control
       • Confirm notification response timelines with legal counsel
   • Security is a Shared Responsibility
     • Ie HR and IT should work together to train and handle incidents
       • Hiring and promotion, layoffs and terminations - work with IT and Facilities
     • Physical Security
       • Facilities and IT should work together
     • Third Parties
       • Binding contractual obligations and reporting obligations
     • Tools of prevention
       • Pre- Notification Process -
         • Confirm event constitutes a reportable breach
         • Forensic Firms and Legal Counsel
           • Can deploy fast - chain of custody, document actions taken
           • Counsel handle legal obligations
       • Elements of a Privacy Incident Response Plan
         • Key Stakeholders - involved
           • Execution Timeline - should be in incident response plan
             • Progress Reporting - keeps everyone on track and informed
               • Response evaluation and modifications - breach is a strong teaching tool
               • Hourly - rare i.e. call center metrics immediately after
                 • Daily - for a few weeks - mail -senior management
                   • Weekly - investors and sakeholders
                     • Monthly - managers, stake holders, leaders and employees
             • Internal Announcements - send properly worded announcements to all employees
               • At same time as external statements
               • Employee only FAQs
               • Response Training for HR and call center
               • Explanatory letters
               • External Annoncements
                 • Closely coordinate with call center
                   • FAQ and training
                 • Staffing assesment for coverage
                 • Regulator Notifications
                   • Seek advice from legal
                   • Letter Drops
                     • + emails most common form of breach notification
                       • Check with law enforcement
                     • Call center
                       • Remediation Offers
                         • in letter i.e. credit monitoring
                       • Ensure adequate headcount and training
         • Developing an Incident Response Plan
           • Determine a Team Leader carefully.
             • Keep on track/objectives
             • Track budges for all response activities
             • Contact outside resources to confirm engagement and monitor resoureces
             • Prepare a final analysis of the response and post evaluation process
             • Response Team Members
               • Employees from all departments (including stakeholders) better to over communicate than neglect departments
                 • IT and IS
                   • Secure Transmission method for data files intended for print vendor or incident call center
                   • Find potentially compromised data
                   • No. of records breached and types of info
                   • Clean up mailing lists
                   • Sort through data to identify population requiring special handling
                   • Monitor for additional attacks
                   • Fix gaps in IT systems if applicable
                 • Legal - make decisions on:
                   • Notify regs and law enforcement
                   • Respond to media inquiris
                   • Alert credit agencies
                   • Negotiate contracts to mirror orgs commitments
                   • Manage evidence and investigation
                   • Review comms for liability
                 • HR
                   • Employee interviews internal/external
                   • Identifying indic who are in need of training
                   • Meetings to summarize updates
                   • Escalating concerns to dep heads
                   • Finance
                     • Setting aside and managing appropriate reserves
                     • Work with vendors to extend payment terms
                     • Pay invoices for breach related activities
                     • Meet daily to track incident expenses
                     • Request ongoing reports from breach providers to manage costs
                     • Marketing and PR
                       • Marketing practices to increase letter open rates
                       • Perform address hygine to improve delivery/response
                       • Analyze media and report developments
                       • Scripts for incident response call center
                       • Customer rentention campaigns
                       • Customer Care
                         • Handle aftermath/work with call center to estb service levels
                         • Outside Resources
                           • Use specialists
                           • Print Vendors
                             • Call center
                               • Remediation Providers