Managing Privacy in a Global Organization Stewart Dresner Chief Executive, Privacy Laws & Business 5th floor, Raebarn House, 100, Northolt Road, Harrow, Middlesex, HA2 0BX, United Kingdom Tel: + 44 208 423 1300 Fax: + 44 208 423 4536 E-mail stewart@privacylaws.com www.privacylaws.com

Contents 1. Fundamental differences between US, Europe and Asia 2. Implementation requires a balance between a legally correct policy and everyday procedures 3. Staff training 4. Credible privacy audits 5. Penalties and sanctions 6. Integrating privacy into your business strategy

Fundamental differences US/Europe 1. European law/rights based privacy compared with US transaction/sectoral approach. 2. Frustration when IT systems cannot be used as intended - often alternative legal approach after discussion 3. Need to understand the European Union’s approach and the Member States’ differences 4. Success = balancing details and the big picture

Implementation: A balance between a legal policy and everyday procedures 1. Key to success is the ability of the CPO to make privacy policy compatible with the corporate culture 2. Why legal advice is necessary but not sufficient 3. Legal advice may be correct but must be in plain language to be really useful 4. Some legal advice may be too cautious 5. Advice relevant to each department/level of staff? 6. How do you know?

Staff awareness and training 1. All managers and staff handling personal data 2. Relevant messages in their operational context 3. All staff dealing with customers and prospects 4. Check messages understood and implemented 5. Advantages and disadvantages of internal/ external training provider 6. Training needs to be repeated and updated 7. Managing privacy is never a quick fix

Why Audit? The key reasons for carrying out audit activities are: 1. To assess the level of compliance with national privacy laws 2. To assess the level of compliance with the organization’s own privacy compliance system 3. To identify potential gaps and weaknesses in the privacy law system 4. To provide information for a privacy compliance system review

What should you audit? 1. Retention - appropriate weeding and deletion of information 2. Documentation on authorised use of systems, e.g. codes of practice, guidelines etc. 3. Compliance with individuals’ rights, such as right of access to information 4. Compliance with privacy laws in the context of other pieces of legislation such as human rights laws and freedom of information laws

Penalties and sanctions 1. Enforcement by privacy regulators - criminal law 2. Civil suits for damage and distress 3. Negative publicity from media coverage - loss of consumer confidence 4. Withdrawal of privacy seals 5. Opportunity cost of having not taken privacy seriously and consequences for future marketing

Integrating privacy into business strategy 1. CPO can try to influence top management - parallel with environmental issues 2. Stress the positive aspects of privacy 3. Transforming risk assessment into everyday compliance with privacy laws 4. Privacy as a competitive advantage 5. Integrating privacy into your business strategy - Brand value - Reputation