GDPR: What can we expect, and how should I guide my Board? April 12, 2018

Transcription

1 GDPR: What can we expect, and how should I guide my Board? April 12, 2018 ADVANCING EXEMPLARY BOARD LEADERSHIP

2 Presenters Randi W. Singer (moderator) Partner, New York Weil, Gotshal & Manges LLP Barry Fishley Partner, London Weil, Gotshal & Manges (London) LLP Jonathan Kuai General Counsel and Managing Director Business Affairs Korn Ferry 2

3 Housekeeping Submit a question and receive a live response Tweet live Download the presentation, access additional resources, evaluate presentation You will automatically receive 1 NACD skill-specific credit for your participation (live program only). Credit may be applied to NACD Fellowship programs. Contact Fellowships@NACDonline.org for more details. This webinar is CLE eligible. Materials will be sent in followup to attendees. Please note that approval will depend on each state s requirements. The replay and slides will be available early next week at NACDonline.org/Webinars 3

4 General Data Protection Regulation (GDPR) Effective 25 May 2018 Replaces existing Directive UK Government confirmed GDPR will apply to UK despite Brexit 4

5 Polling Question #1 How many conversations have you had with your board about GDPR? We have not had any conversations about GDPR We ve addressed GDPR during at least one board meeting, but it is not a regular topic of discussion GDPR is a regular topic of discussion at our board meetings I don t know Please note: this slide will be replaced with an interactive polling question in the webinar console. 5

6 Key Takeaways Territorial Scope Sanctions Data Breach Notification Right to Erasure ( to be forgotten ) Consent Data Processors Governance Data Portability Extends to Non-EEA organizations which process personal data in connection with goods/services offered to EU citizens or monitors their behavior. Much stronger fines up to greater of 20 m or 4% of worldwide turnover. Introduction of universal reporting obligation (if possible within 72 hours) where breach likely to result in high risk to individuals. New right to be forgotten e.g. where individual withdraws consent to processing and no other processing condition applies More difficult to rely on implied consent silence and pre-ticked boxes insufficient. Bundled consent prohibited. Direct liability imposed on processors. Agreements with data processors must contain additional provisions. Certain organizations required to appoint a data protection officer. Greater obligation to demonstrate compliance through paper trail. Also applies to DPs. Notification no longer required. Privacy impact assessments. Data protection by design and by default. Right to receive their personal data and transmit to another controller in a structured, commonly used and machine readable format where: processing carried out by consent or where necessary for contract and processing carried out by automatic means. 6

7 Key Takeaways (cont.) Fair Processing Information Legitimate Interests Data Protection Principles Data Processing Conditions Data Subject Access Rights Right to Object International Data Transfers Harmonisation Additional information to be provided to data subjects Consider individual s reasonable expectations. Document decision making. Provision of information Not much change in practice Not much change in practice but note changes for consent, legitimate interest and children s data Not much change in practice except cannot charge and within one month versus 40 days Not much change in practice Not much change in practice Direct effect may reduce country variations 7

8 Impact on Companies Outside of Europe We have no presence in Europe so we don t need to bother correct? What if our website is accessible to Europeans are we caught? 8

9 Polling Question #2 How prepared is your company/board for GDPR to take effect in May? 0-30% - we are not well prepared 31-60% - we are moderately prepared 61-99% - we are well prepared 100% - we are completely prepared I don t know Please note: this slide will be replaced with an interactive polling question in the webinar console. 9

10 How should I guide my Board? Education and Context GDPR (Generally) Data Privacy (Generally) Nature of Company Data Historical Company Response Plan of Action Resources Governance Action steps Impacts to Business Expectations/ Market response Progress Reporting/ Updates Pre and Post May 2018 Other Intersections ERM/ Risk Management Insurance Third Parties/ Public Communications Incident Management 10

11 Where do we start/prioritize? Don t panic! Sectorial differences Team Key stakeholders Risk committee Risk-based approach identify key risk areas Types of data Customer/user Employee Identify data flows Identify assessment tools e.g. UK ICO s checklists 11

12 Where do we start/prioritize? (cont.) Assess consents Review and update materials e.g. privacy policies, IT security/incident response plan, etc. Identify and review key vendor contracts for processor language See what peers are doing Monitor regulator guidance 12

13 What will happen on May 25 th? 13

14 Q&A You can submit a question through the Ask the Experts box at the top right-hand side of your screen. ADVANCING EXEMPLARY BOARD LEADERSHIP

15 ADVANCING EXEMPLARY BOARD LEADERSHIP

16 ADVANCING EXEMPLARY BOARD LEADERSHIP

17 Don t Miss Our Next Webinar Join NACD and Weil for our next Strategic-Asset GC Series webinar on June 7, 2018 at 2:00 PM (EST) To register, visit 17

18 NACD Credit and Fellowship Information If you have any questions regarding NACD credit or the Fellowship programs, please contact: Meghan Metzbower, Senior Fellowship Program Manager Phone: (571) To learn more about NACD Fellowships, visit us at NACDonline.org/Fellowships. 18

19 Thank You ADVANCING EXEMPLARY BOARD LEADERSHIP