Nymity Chief Global Privacy Strategist Teresa Troester-Falk, CIPP/US, laid out a hypothetical situation to a room full of privacy professionals at the IAPP Privacy. Security. Risk. conference that attendees may already know all too well.
It is a Thursday night, and the head of the privacy team is about to leave for the day when the head of audit compliance says there is a board meeting next week. The board has gotten wind of a new privacy law, and they want to know where their organization stands before it goes into effect. The panelists of the P.S.R. breakout session offered their thoughts on what privacy professionals should do when they report to their boards, particularly as the California Consumer Privacy Act inches ever closer to its effective date.
Iron Mountain Global Privacy Officer and Senior Director Michael Zurcher, CIPP/US, CIPM, said privacy professionals should consider incidents in which the board will eventually be exposed for liability. Should an organization suffer a data breach or leave data subject access requests unfulfilled, the board will ask privacy professionals why they did not do more to prevent those incidents.
"Suddenly you may have an influx of data breaches and the board will ask, 'Why were we not prepared?' Think about what can go wrong, and go wrong in such a way that your CEO and board will start asking questions," Zurcher said.
One of the challenges privacy professionals may face when they discuss these issues is having the board understand just what is at stake with privacy law compliance. Zurcher recommends using established language to help convey the issues the organization faces.
Zurcher advises this course of action when privacy professionals approach the board for the first time with these concerns. He added that unless the board is filled with "privacy geeks," it is better to focus on broader principles found within privacy laws rather than drilling down into the specific requirements of each state-level bill. This can help facilitate an organization's discussions about whether they will extend data rights to all of their customers, rather than just those located in a particular location.
It may take more than one meeting for the board to fully understand the ins and outs of any given situation.
"The first time it may be different because you need to educate them about what they need to be concerned about," Zurcher said. "The second time may be about the progress you are making."
Privacy professionals may not always have the opportunity to craft a formal presentation when they report to their boards. Blue Ocean Enterprises Director of Information Security and Privacy Alexys Carlton, CIPT, said the relationship between employees and the board at her company is less formal than what may be seen at other organizations.
Carlton said she may strike up a conversation with board members at any time, which means she has to have her talking points ready in case one of them asks about their organization's compliance efforts.
"If I pass them in the kitchen, and they talk about the CCPA and ask are we ready, am I ready to give an elevator pitch on what it is?" Carlton said. "Am I ready to cite an example of risk? Am I ready to ask for resources?"
Zurcher said privacy professionals should read guidance put out by regulators in order to convey potential penalties they may face should they violate a privacy law. Zurcher cited the guidance laid out by data protection authorities ahead of the EU General Data Protection Regulation as resources he used to advise board members ahead of the European Union law.
"Senior leadership will listen if you tell them that if we have a breach, it will cost them that many million dollars. If we don’t have the consent we need to process the information, then we will be subject to fines," Zurcher said. "Read them carefully and how they will impact your business."
Board members will want to hear about how their organization's compliance efforts are proceeding, Zurcher said. Any violations that occur and the penalties dolled out will ultimately fall on their shoulders. It is why Zurcher believes privacy professionals should let them know about what could happen to their organization in order to spare everyone any unwanted surprises.
"The key thing is that you need to be able to explain to your board where you see potential issues, where you believe the organization has exposure," Zurcher said. "In the end, the board and leadership have responsibility and no one wants to be blindsided."
