GDPR Applicability to non-EU Citizens

When the European Union's General Data Protection Regulation becomes effective on May 25, 2018, anyone residing in the EU, not just EU citizens, will have the right the insist that corporations remove their personal information from its databases, or be provided with an explanation as to why this cannot be done.

PCI Data

PCI data refers to payment card industry data. The Payment Card Industry Data Security Standard (PCI DSS) is administered by a special council which aims to secure credit card holder data and prevent fraud. Any organization that handles a significant amount of credit card data must file a Report on Compliance. The PCI Security Standards Council's official publication imposes 12 requirements:

Requirement 1: Install and maintain a firewall configuration to protect cardholder data Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters Requirement 3: Protect stored cardholder data Requirement 4: Encrypt transmission of cardholder data across open, public networks Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs Requirement 6: Develop and maintain secure systems and applications Requirement 7: Restrict access to cardholder data by business need to know Requirement 8: Identify and authenticate access to system Requirement 9: Restrict physical access to cardholder data Requirement 10: Track and monitor all access to network resources and cardholder Requirement 11: Regularly test security systems and processes.

Requirement 12: Maintain a policy that addresses information security for all personnel

Electronic Discovery Institute Course - Class 17 - Data Privacy

Here's a continuation of my postings about the Electronic Discovery Institute's online e-discovery certification program, that you can subscribe to for just $1. I last blogged about this program on January 19, 2018. Go to https://www.lawinstitute.org/ to sign up for it.

This course on Data Privacy is taught by David Moncure, legal counsel for Shell Oil; Erin Pope, Chief Privacy Officer for Golden Living; and Christina Ayiotis an attorney specializing in privacy and data protection.

Introduction & Overview

Data privacy rules concern personal data, not business information. A document that contains some personal information, may still be produced if it has business information. Private information may also include the trade secrets and intellectual property of a business. There may be technical solutions, such as digital rights management, that will allow parties to only access the information they need.

Companies are gathering more information on both their employees and customers than ever before. There are more than 100 countries with privacy regulations - up by 50% from 10 years ago. There are special rules governing, PHI, personal health information, and PII, personally identitable information.

Personal data means anything that can identify a person - even an IP address from a computer. Sensitive personal information, includes biometric, health, criminal and other types of information.

Data Privacy in the Corporate Context

Corporations must have special procedures in place for storing personal information.

Data Breach and Cybersecurity

A data breach is a legal term of art - a specific definition under statutes.

There is usually a lot of co-mingling of data in different systems in any one business. Cybersecurity must properly address the protection of multiple networks. Cybersecurity must be accompanied by physical security and personnel security. New employees must be assessed as potential bad actors.

Data Privacy Laws & Breach Notification Requirements

There are many state specific laws addressing breach notification. The Gramm-Leach-Bliley Act addresses the privacy of financial information. Regulations called PCI standards govern the protection of credit card information. There is no overarching federal law governing privacy. There are federal laws concerning banking and healthcare which address privacy concerns. These various laws are not necessarily consistent. Some address only ESI, where others also cover hard copy records.

United States Privacy Framework

The FTC has general jurisdiction over unfair and deceptive practices. The HHS has jurisdiction over healthcare entities. Privacy issues can be addressed by these agencies.

There is a proposal to impose a federal standard, but this is objected to by some states that have more comprehensive rules for data privacy. Massachusetts has a law requiring the personal information of its citizens to be encrypted in some cases.

There are growing concerns about keeping information private in legal proceedings. A protective order may be issued to protect the personal data of individuals.

Law Enforcement

Law enforcement agencies used to have carte blanche access to the information held by companies. This has changed due to the Snowden revelations and the Schrems case. The U.S. Department of Commerce's safe harbor program was invalidated by the Schrems case. The U.S. / E.U. privacy shield is a new mechanism allowing for the transfer of personal data.

If a server is in a particular location, law enforcement will need a warrant to access the information on it. There are some circumstances where law enforcement can get information from service providers and prevent them from disclosing to their customers that the data has been accessed.

Health Insurance Portability & Accountability Act

HIPAA requires doctors and pharmacies to give patients privacy notices. A person's medical condition is covered by the privacy requirements of HIPAA. It requires that patients be informed if a breach occurs. The notice must indicate when the breach occurred and what steps are being taken to remedy the situation.

The portability aspect of the law allows patients to move their medical records from one healthcare provider to another. Some information is excluded from the requirements of HIPAA.

The EU, Canada, and Australia all recognize that an individual has the right to control information about themselves. Silicon Valley companies may be a force in preventing lawmakers from giving Americans more rights to control data about themselves.

HIPAA makes a distinction between secured and unsecured data. If data has been secured through encryption, the same reporting obligations won't apply in the event of a breach. There are different types of encryption. Data may be encrypted in motion or at rest.

The Cloud

Cloud data stored in Europe may not be fully transferable to the United States because of data privacy regulations there.

Social Media

People tend to regard social media data as being private even thought it is publicly available.

International Data Privacy

The European Union has very strict rules with respect to processing personal data, and transferring it out of the EU. Data can be transferred out of the EU in one of four ways.

1. Safe Harbor program.

2. Personal consent.

3. Model clauses - in agreements between service providers and their customers.

4. Binding corporate rules - companies' internal policies approved by regulators allowing for the flow of data.

The General Data Protection Regulation will be effective in May of 2018. Any business that deals with EU citizens will have to comply with the GDPR. Companies must have data privacy officers.

The GDPR includes the right to be forgotten. An individual can force a company to erase the data that it has about them.

In the Asia Pacific region, there is an overarching privacy framework, but it is not mandatory.

Canada has a privacy scheme similar to that of the European Union. There are federal level privacy protections given to individuals. Data can be transferred from Canada to the EU more easily than it can be transferred from the United States.

Argentina has been recognized by the EU as a country which has adequate data protections.

Best Practices & Conclusions

One should always keep track of what data is collected, from whom it is collected, and where the collected data is stored.

One of the easiest methods of compliance with the GDPR will be binding corporate rules.

Bear in mind that technology will always outpace the law.