1. Recent Privacy Developments ISACA January 12, 2012 Keith A. Cheresko and Robert L. Rothman Principals, Privacy Associates International LLC

2. Purpose

9. Areas or Topics of Privacy Activity Breach Cloud Geo-location Facial Recognition BYOD Marketing Social Media OBA Consumer Financial Protection Bureau Federal Trade Commission COPPA Health Care International EU Cookie Rules EU Data Protection Directive APEC USA PATRIOT ACT Supplier Relationships

10. Focus on Several Items Social Media Breach Marketing Supplier Relationships Privacy Developments from the EU TEST!

11. US Developments

12. Breach PII

13. States Continue Tightening Requirements

14. Class Actions Proliferating

15. Breach Notification No general national beach notification law - BUT

16. Breach Notification Internal processes Training Policies and practices Supplier action implications

17. Social Media

18. Endorsements

19. HR Implications

20. Social Media Labor Relations

21. Social Media NLRB Actions

22. Social Media Policies and practices Internal processes Training Enforcement

23. BYOD

24. Marketing

25. OBA – Online Behavioral Advertising

26. Geo-Location

27. COPPA

28. Texting

29. Marketing Policies and practices Internal processes Training Enforcement

30. Facial Recognition

31. Supplier Relationships

32. Cloud Computing

33. Supplier Relationships Contracts!

34. Supplier Relationships Contract Allocation of liability Responsibility for actions of others

35. European Data Protection Directive

36. The European Data Protection Laws Have Been a Compliance Headache for Companies Around the World

37. Proposed New Data Protection Regulation

38. The Good News DIRECTIVE REGULATION

39. The Bad News Nearly Everything Else

40. Significantly Increased Fines and Penalties

41. Consent Narrowed

42. Data Breach Notification

43. Right to Be Forgotten

44. Data Minimization

45. Accountability

46. Mandatory Data Privacy Officer

47. Companies Outside Europe Potentially Subject to the Regulation

48. Status of Regulation

49. My Head Hurts

50. BULL NO-BULL TEST

51. Statements about the Update Bull – the statement is not true Not Bull – the statement is true Requires audience participation – Vocalization of response – Be careful of “trick” statements

52. Sample Statement The proposed EU privacy regulation will finally prevent the possibility of English mad cows from entering this country.

53. BULL NO-BULL

54. BULL

55. Statement One The US is unique in the world by requiring notification to individuals who are affected by a security breach involving the loss of personal information.

56. BULL NO-BULL

57. BULL

58. Statement Two The Proposed EU Data Privacy Regulation will require all companies to appoint an independent data protection officer to serve for a term of not less than two years.

59. BULL NO-BULL

60. BULL

61. Statement Three Personal Identification Information breaches in the US are regulated by the federal breach notification statute.

62. BULL NO-BULL

63. BULL

64. Statement Four Product claims made on social media are not covered by normal FTC advertising rules under the “Zuckerman” exception.

65. BULL NO-BULL

66. BULL

67. Statement Five The basic rule in the EU is that personal data can not be sent to the US because the US does not have adequate privacy laws.

68. BULL NO-BULL

69. NO BULL

70. Question Six A company can not contract away all its privacy responsibility to its suppliers.

71. BULL NO-BULL

72. NO BULL

73. Final Statement This has been an interesting and informative and somewhat entertaining session.

74. Contact Information Keith A. Cheresko Privacy Associates International LLC kcheresko@privassoc.com www.privassoc.com (248) 535-2819 Robert L. Rothman Privacy Associates International LLC rrothman@privassoc.com www.privassoc.com (248) 880-3942