EU Data Protection: Compliance Risks

Julie Kudyba
Global Privacy Officer
Novartis Pharma AG
Where are your risks?
¾International Data Flows
1
¾Data transfers outside the EU
¾Safe Harbor and German requirements

¾Outsourcing Business Processes

2 ¾Managing external vendors
¾Internal centralized databases & processing

¾Changing Environment
3 ¾New Platforms: Cloud computing, mobile devices, etc
¾Social Media

2 | Presentation Title | Presenter Name | Date | Subject | Business Use Only

International Data Flows

•Where is your data? •Data Transfer

agreements •Registration of
•With whom do you databases
share it? •Consent of data
subject •Notices to data
•Does your IT group subjects
understand the impact •Binding Corporate
of changing your Rules •Notifications to DPA’s
infrastructure?
•Safe Harbor •Security for Data
•Are you planning on
moving to the cloud? •Adequacy Finding

3 | Presentation Title | Presenter Name | Date | Subject | Business Use Only

Outsourcing Business Processes

Assess the Legal Requirements

Incident
Contracts Due Diligence
Management
•Standard Language •Security Standards
that account for •Assessments for •Reporting Obligations
strongest country vendors •Response plan with
requirements •Standard reporting outsourcing partners
•Processing that meets regulatory (including affiliates).
agreements scrutiny
•Data transfer
agreements

4 | Presentation Title | Presenter Name | Date | Subject | Business Use Only

Changing Environment
ƒ Cloud Computing
• Can you have a managed cloud?
• Negotiating controls with the cloud provider
• How to manage E-discovery in the cloud

ƒ Mobile Applications
• Informed consent on a mobile application
• Application developers and tracking technologies

ƒ Social media
• Create social media guidelines and policies
• Monitoring blogs in a regulated industry
• Ensuring compliance with country data protection laws.
5 | Presentation Title | Presenter Name | Date | Subject | Business Use Only
Is your Legal Department Structured to Manage
these Privacy Risks?

6 | Presentation Title | Presenter Name | Date | Subject | Business Use Only

Key Considerations
ƒ Your data travels across borders....don’t just focus on the
EU.
• Understand global legal requirements

ƒ Train your lawyers!

ƒ Don’t underestimate the workload!
ƒ Assess skill set of your privacy officers.
• Legal analysis & counsel
• Operational leadership
• Must understand the business
• Some technical savvy helps

7 | Presentation Title | Presenter Name | Date | Subject | Business Use Only