Data Privacy and Breaches Creating a culture of privacy awareness and how to respond to a breach Carrie O’Brien

Agenda Data Privacy Data Breaches in Arizona Data Breach exercise

Security and Privacy Data Security—systems of protections around your data to adequately protect it. Data Privacy—laws, regulations, public expectations on the data you maintain

Data Privacy should NOT be the Wild West

How to tackle it?

Sensitivity and Privacy Needs What data and what level of access is needed? Regulations and Laws State, federal and local laws dictate the sensitivity of data. Sensitivity and Privacy Stakeholder Concerns What level of confidentiality do the owners of the data demand?

Do you know your data’s impact? LOW: The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. MODERATE: The loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. HIGH: The loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. National Institute of Standards and Technology FIPS-199

Examine what data you maintain internally Student Records Teacher Records Financial Records Federal and State Programs HR Records

Not All Data Are Created Equal - Group Exercise Restricted Sensitive Public

Procedures for reporting or releasing data Internal Controls Use ID numbers to de-identify student data Role-based access to PII in Databases Data Management (record retention) IT Security Physical security; authentication; firewalls/intrusion protection Procedures for reporting or releasing data Limit access to data to public schools through end user authentication (ADE Connect) Aggregation and redaction in data reports Application and review of all research requests Data Sharing Agreements with all outside parties

How ADE Processed Requests Public Records Request Public Records Request Tracking Legal Aggregated Data Request On-line data request form Data Governance tracking Peer reviewed prior to release PII Data Request Application Packet Reviewed by Chief Privacy Officer/ Chief Data Officer Data Sharing Agreement

Public Records Requests Email! Attachments Looking for a needle in a haystack that might not be there Custom Data Requests ACLU v. DCS (2016) Inadvertent Disclosures

Requests for aggregate data Subgroup Asian Native Amer. African Amer. Hispanic White Total All Students   216 * 217 ELL Free Lunch 171 172 Migrant SPED 30

Creating Workplace Awareness of Data Privacy Frequent and Relevant Employee Trainings on Privacy (and Security) Educate employees on their responsibility to maintain privacy of data and report concerns Mandatory reporting of potential privacy and security breaches by employees to remediate (no privacy JAIL).

Maricopa County Colleges Computer Hack Cost tops $26M Auditors were able to hack Arizona DES during routine cybersecurity review State auditors were able to access confidential information when testing cybersecurity a the Arizona Department of Economic Security, revealing vulnerabilities that could have put residents’ personal information at risk. Jerod MacDonald-Evoy , The Republic | azcentral.com 12:27 p.m. MT April 20, 2017 Maricopa County Colleges Computer Hack Cost tops $26M Mary Beth Faller , The Republic | azcentral.com Published 11:15 a.m. MT Dec. 17, 2014 | Updated 12:58 p.m. MT Dec. 17, 2014 Spear Phishing Attacks are Often the Root Cause of Security Breaches More than one third (34%) of respondents who reported experiencing a spear phishing attack in the past year believe that such an attack resulted in the compromise of user login credentials (e.g., usernames passwords) or unauthorized access to corporate IT systems.

Headlines You Never Want for Your City Target breach exposes personal data of 110 million customers County government settles potential HIPAA violations for $215k Global cyberattack targets 300,000 machines in 150 countries, taking data hostage with ransomware

What are Network Security and Privacy Risks and Costs ? Legal liability to others for breach of credit/debit cards Legal liability to others for breach of personally identifiable info (PII) Legal liability to others for breach of personal health info (PHI)

What are Network Security and Privacy Risks and Costs ? Cyber extortion Loss or damage of data (internal) Loss of Community Confidence

Data Breach Costs

Causes of Data Loss Other 11.4% 3rd Party vendor 4.3% Hacker 18.6% Theft 5.7% System Glitch 3.6% Staff Error 5% Lost / Stolen Device 20.7% Rogue Employee 12.1% Paper Records 8.6% Malware/Virus 10% 2013 NetDiligence® Cyber Liability & Data Breach Insurance Claims A Study of Actual Payouts for Covered Data Breaches. 21

Factors Affecting Public Sector Enormous amount of personal data on employees (birthdates, SSNs, direct deposit/banking info) Data is kept for decades IT equipment not always state-of-the-art Budgetary constraints

Takeaways Expectations for data protection have increased Where is your city or town vulnerable? How will you increase awareness of data privacy expectations? How will you respond to a breach?

Questions? Please contact the presenters: Carrie O’Brien, Gust Rosenfeld (602) 257-7952 CO’Brien@gustlaw.com

Thank You.