Technology: Corporate counsel’s role in governing privacy and security risk
The advent of the chief privacy officer role has occurred largely within the regulated sectors of health care and financial services, but has spread to many industries and companies of all sizes.
March 29, 2013 at 07:24 AM
8 minute read
The original version of this story was published on Law.com
The advent of the chief privacy officer role has occurred largely within the regulated sectors of health care and financial services, but has spread to many industries and companies of all sizes. The spread has no doubt been quickened by the FTC's enforcement of Section 5 of the FTC Act, prohibiting “unfair or deceptive acts or practices in or affecting commerce.” The most common enforcement actions undertaken by the FTC have been against companies whose use of their customer's personal information is in violation of their own stated privacy policies. These types of mishaps reveal an underlying lack of coordination between the privacy and security functions. Therefore, the quality of the relationship between an organization's privacy and security functions may be a key predictor of compliance success.
The introduction of a privacy program within an organization can sometimes cause tension with the information security function. These tensions arise out of the common goals and purposes shared between the two groups. Further, shared interest in common technologies that provide for confidentiality of information, the primary objective of both groups, can confuse program scope or worse, foster unhealthy competition. In-house counsel can work to ensure the relationship between privacy and security functions is conducive to reducing risk, not introducing it.
In-house counsel can provide leadership to executives and prove instrumental in harmonizing the privacy and security programs within their organizations. Counsel should consider the privacy and security functions in context with each other, understanding the relationships and dependencies between the two groups. The key is for counsel to remain informed and abreast of the goals and strategies of the privacy and security functions, and recognize points of reliance and points of divergence between the two. With advance planning and guidance, tensions that commonly arise between the two functions can be defused, and both programs can thrive in part due to the success of the other.
Counsel should consider the following. First, privacy is usually not attainable without security. Arguably, the primary objective of an information security program is to protect the confidentiality of sensitive information from unauthorized disclosure. The privacy program is focused on the same objective for a subset of the organizations sensitive data: personally identifiable information, or PII. The privacy team can and should rely on the vast arsenal of technologies deployed by corporate information security departments to preserve confidentiality. Since the privacy function doesn't need to replicate these technologies, it can focuses on privacy process and policy.
Second, the policies produced by each group have important differences. Privacy policies often embody requirements found in unique state, federal and international laws and regulations that apply to individual consumers, whom these laws are designed to protect. What information about the person is collected and why? How will it be used? How will the corporation's technology interact with that person and her data? For example, how will cookies be used to capture and track a customer's online behavior?
By contrast, information security policies are rooted in best-practice, industry consensus frameworks, as much as they are based on legislative frameworks. While such frameworks for privacy are strengthening, such as the generally accepted privacy principles there are many more and robust frameworks available for information security. Care should be taken to correlate privacy policies with security policies so that one doesn't step on the other. A common misfire of privacy programs is to produce privacy policies that create redundancies or inconsistencies with security policies.
Third, as corporate governance mechanisms continue to evolve and mature, they are capable of contemplating and overseeing the management of security and privacy risk. Legal officers might be more likely than CISOs or CPOs to participate in the governance committees of an organization. If a risk, operations, or information officer has not already sounded the call to information governance, the general counsel may bring to light the management of these unique and ever-growing risks.
In summary, in house counsel can do the following with regards to guiding the privacy and security functions in achieving overall risk management objectives:
- understand the common and diverging goals of each program
- recognize the dependencies between privacy and security programs
- understand that security and privacy policies should be complementary, can co-exist within the corporate policy framework, but have unique differences.
- engage corporate governance functions as appropriate to oversee privacy and information security risk management
The advent of the chief privacy officer role has occurred largely within the regulated sectors of health care and financial services, but has spread to many industries and companies of all sizes. The spread has no doubt been quickened by the FTC's enforcement of Section 5 of the FTC Act, prohibiting “unfair or deceptive acts or practices in or affecting commerce.” The most common enforcement actions undertaken by the FTC have been against companies whose use of their customer's personal information is in violation of their own stated privacy policies. These types of mishaps reveal an underlying lack of coordination between the privacy and security functions. Therefore, the quality of the relationship between an organization's privacy and security functions may be a key predictor of compliance success.
The introduction of a privacy program within an organization can sometimes cause tension with the information security function. These tensions arise out of the common goals and purposes shared between the two groups. Further, shared interest in common technologies that provide for confidentiality of information, the primary objective of both groups, can confuse program scope or worse, foster unhealthy competition. In-house counsel can work to ensure the relationship between privacy and security functions is conducive to reducing risk, not introducing it.
In-house counsel can provide leadership to executives and prove instrumental in harmonizing the privacy and security programs within their organizations. Counsel should consider the privacy and security functions in context with each other, understanding the relationships and dependencies between the two groups. The key is for counsel to remain informed and abreast of the goals and strategies of the privacy and security functions, and recognize points of reliance and points of divergence between the two. With advance planning and guidance, tensions that commonly arise between the two functions can be defused, and both programs can thrive in part due to the success of the other.
Counsel should consider the following. First, privacy is usually not attainable without security. Arguably, the primary objective of an information security program is to protect the confidentiality of sensitive information from unauthorized disclosure. The privacy program is focused on the same objective for a subset of the organizations sensitive data: personally identifiable information, or PII. The privacy team can and should rely on the vast arsenal of technologies deployed by corporate information security departments to preserve confidentiality. Since the privacy function doesn't need to replicate these technologies, it can focuses on privacy process and policy.
Second, the policies produced by each group have important differences. Privacy policies often embody requirements found in unique state, federal and international laws and regulations that apply to individual consumers, whom these laws are designed to protect. What information about the person is collected and why? How will it be used? How will the corporation's technology interact with that person and her data? For example, how will cookies be used to capture and track a customer's online behavior?
By contrast, information security policies are rooted in best-practice, industry consensus frameworks, as much as they are based on legislative frameworks. While such frameworks for privacy are strengthening, such as the generally accepted privacy principles there are many more and robust frameworks available for information security. Care should be taken to correlate privacy policies with security policies so that one doesn't step on the other. A common misfire of privacy programs is to produce privacy policies that create redundancies or inconsistencies with security policies.
Third, as corporate governance mechanisms continue to evolve and mature, they are capable of contemplating and overseeing the management of security and privacy risk. Legal officers might be more likely than CISOs or CPOs to participate in the governance committees of an organization. If a risk, operations, or information officer has not already sounded the call to information governance, the general counsel may bring to light the management of these unique and ever-growing risks.
In summary, in house counsel can do the following with regards to guiding the privacy and security functions in achieving overall risk management objectives:
- understand the common and diverging goals of each program
- recognize the dependencies between privacy and security programs
- understand that security and privacy policies should be complementary, can co-exist within the corporate policy framework, but have unique differences.
- engage corporate governance functions as appropriate to oversee privacy and information security risk management
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllInside Track: Late-Career In-House Leaders Offer Words to Live by
In-House Leaders Trying to Contain Political Divisiveness Face Maze of Challenges
5 minute readFTC Bans Exec From Chevron Board—Exercising Authority It Doesn't Have, GOP Dissenters Say
5 minute readTrending Stories
Who Got The Work
Dechert partners Andrew J. Levander, Angela M. Liu and Neil A. Steiner have stepped in to defend Arbor Realty Trust and certain executives in a pending securities class action. The complaint, filed July 31 in New York Eastern District Court by Levi & Korsinsky, contends that the defendants concealed a 'toxic' mobile home portfolio, vastly overstated collateral in regards to the company's loans and failed to disclose an investigation of the company by the FBI. The case, assigned to U.S. District Judge Pamela K. Chen, is 1:24-cv-05347, Martin v. Arbor Realty Trust, Inc. et al.
Who Got The Work
Arthur G. Jakoby, Ryan Feeney and Maxim M.L. Nowak from Herrick Feinstein have stepped in to defend Charles Dilluvio and Seacor Capital in a pending securities lawsuit. The complaint, filed Sept. 30 in New York Southern District Court by the Securities and Exchange Commission, accuses the defendants of using consulting agreements, attorney opinion letters and other mechanisms to skirt regulations limiting stock sales by affiliate companies and allowing the defendants to unlawfully profit from sales of Enzolytics stock. The case, assigned to U.S. District Judge Andrew L. Carter Jr., is 1:24-cv-07362, Securities and Exchange Commission v. Zhabilov et al.
Who Got The Work
Clark Hill members Vincent Roskovensky and Kevin B. Watson have entered appearances for Architectural Steel and Associated Products in a pending environmental lawsuit. The complaint, filed Aug. 27 in Pennsylvania Eastern District Court by Brodsky & Smith on behalf of Hung Trinh, accuses the defendant of discharging polluted stormwater from its steel facility without a permit in violation of the Clean Water Act. The case, assigned to U.S. District Judge Gerald J. Pappert, is 2:24-cv-04490, Trinh v. Architectural Steel And Associated Products, Inc.
Who Got The Work
Michael R. Yellin of Cole Schotz has entered an appearance for S2 d/b/a the Shoe Surgeon, Dominic Chambrone a/k/a Dominic Ciambrone and other defendants in a pending trademark infringement lawsuit. The case, filed July 15 in New York Southern District Court by DLA Piper on behalf of Nike, seeks to enjoin Ciambrone and the other defendants in their attempts to build an 'entire multifaceted' retail empire through their unauthorized use of Nike’s trademark rights. The case, assigned to U.S. District Judge Naomi Reice Buchwald, is 1:24-cv-05307, Nike Inc. v. S2, Inc. et al.
Who Got The Work
Sullivan & Cromwell partner Adam S. Paris has entered an appearance for Orthofix Medical in a pending securities class action arising from a proposed acquisition of SeaSpine by Orthofix. The suit, filed Sept. 6 in California Southern District Court, by Girard Sharp and the Hall Firm, contends that the offering materials and related oral communications contained untrue statements of material fact. According to the complaint, the defendants made a series of misrepresentations about Orthofix’s disclosure controls and internal controls over financial reporting and ethical compliance. The case, assigned to U.S. District Judge Linda Lopez, is 3:24-cv-01593, O'Hara v. Orthofix Medical Inc. et al.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250