1. Compliance, Defensibility & Usability of Information on a Global Stage Monday, October 19, 2015 9:00 – 10:30 AM Global Legal Issues 1

2. 2

3. 3

4. N ORA K URZOVA Chief Privacy Officer, Data Privacy & Records Management Tyco International Management Company A NTHONY M ARTIN Senior Associate General Counsel Privacy & Information Security Wal-Mart Stores M ARTY P ROVIN, CIPP/US Executive Vice President Jordan Lawrence 4 A NDREA A RIAS Attorney, Division of Privacy and Identity Protection Federal Trade Commission 4

5. 5 The views expressed herein do not represent the Federal Trade Commission or anyone of it’s Commissioners. All views and opinions are solely those of the individual speaker for informational purposes and does not constitute legal advise.

6. “Do The Right Thing” Defensibility of Decisions Comply with Laws & Requirements 6

7. W HAT D OES A R EGULATOR C ARE A BOUT ?  Federal Agencies, States, ICO, CNIL  Past Experience  Future Experience 7

8. A NDI ’ S T OP 6 L IST 8

9. T OP 6 L IST 9 1.Storing information longer than needed when not necessary 2.Using default or easy-to-guess passwords 3.Storing or transmitting information in plain text 4.Failing to take steps to segment or restrict access to data 5.Failing to provide appropriate employee training or oversight 6.Failing to take reasonable steps to detect or investigate breaches

10. R ISK A NALYSIS C ONSIDERATIONS  Litigation  Regulation  Organizational Structure  Geographic Footprint  Past Experience 10

11. R ISK A NALYSIS C OMPONENTS  Start with Security 11  What personal information do you have?  Where is it?  How long are you keeping it?

12. R ISK A NALYSIS C OMPONENTS  Start with Security  Control Access to Data 12  How are you using personal information?  Who has access to sensitive data?

13. R ISK A NALYSIS C OMPONENTS  Start with Security  Control Access to Data  Require Passwords & Authentication 13  How is sensitive information protected?

14. R ISK A NALYSIS C OMPONENTS  Start with Security  Control Access to Data  Require Passwords & Authentication  Store Securely & Protect in Transit 14  How is sensitive information being stored?  How is sensitive information protected in transit?

15. R ISK A NALYSIS C OMPONENTS  Start with Security  Control Access to Data  Require Passwords & Authentication  Store Securely & Protect in Transit  Segment Network & Monitor Intrusion 15  Are you using industry-tested accepted methods?

16. R ISK A NALYSIS C OMPONENTS  Secure Remote Access to Network 16  Who has access to what?  Information encrypted?

17. R ISK A NALYSIS C OMPONENTS  Secure Remote Access to Network  Apply Sound Security Practices 17  Are policies written?  Is compliance verified?  Are employees adequately trained?

18. R ISK A NALYSIS C OMPONENTS  Secure Remote Access to Network  Apply Sound Security Practices  Ensure Vendors do the Same 18  Do you perform vendor risk assessments?

19. R ISK A NALYSIS C OMPONENTS  Secure Remote Access to Network  Apply Sound Security Practices  Ensure Vendors do the Same  Establish Processes/Procedures 19  What testing are you doing?  Are you up to date on patches?

20. R ISK A NALYSIS C OMPONENTS  Secure Remote Access to Network  Apply Sound Security Practices  Ensure Vendors do the Same  Establish Processes/Procedures  Secure Paper/Physical Media 20  Do employees securely dispose of sensitive information?

21. R EPORTING F INDINGS  Who are you reporting to?  How do you report?  How do you make it relevant? 21 Executive Leadership Team Board of Directors

22. W HAT D OES S UCCESS L OOK L IKE ?  Tone at the Top  Resources  Open Communication 22

23. I NFORMATION M ANAGEMENT C OMMITTEE  Privacy  Records Retention  Information Security  Litigation  Business Intelligence  Marketing 23

24. 24

25. 25  Federal Trade Commission | www.FTC.gov www.FTC.gov/TipsAndAdvice/PrivacyAndSecurity  European Commission | www.ec.europa.eu www.ex.Europa.eu/justice/dataprotection/datacollection/index_en.htm  National Association of Corporate Directors | www.nacdonline.org www.nacdonline.org/conference/?gclid+CMm4stOCIccCFQgtaQodCO8PhQ  Federal Trade Commission | www.FTC.gov www.ftc.gov/system/files/documents/plain-language/pdf0205-startwithsecurity.pdf R ESOURCES

26. 26 N ORA K URZOVA Tyco International Management Company nkurzova@tyco.com 609-806-2171 A NTHONY M ARTIN Wal-Mart Stores Anthony.Martin@walmartlegal.com 479-277-6873 M ARTY P ROVIN, CIPP/US Jordan Lawrence mprovin@jordanlawrence.com 636-778-1650 A NDREA A RIAS Federal Trade Commission aarias@ftc.gov 202-326-2715 26