According to research we conducted in late 2019, 80% of respondents have updated their organization’s privacy notice one or more times in the last 12 months.

Well, it’s time for the IAPP to do it, too.

We first conducted a major overhaul of our website’s privacy notice in anticipation of the May 25, 2018, effective date of the EU General Data Protection Regulation. Our goal was (and still is) to offer information to our members about what personal data we collect from them, under what circumstances and why in a way that embodied what the GDPR expects of data controllers.

Since that version, we have not necessarily engaged in many new data-processing practices. But we have continued to learn more about them. We have also paid attention to questions sent in by alert members who — as privacy pros will do — have been reading our privacy notice carefully either out of curiosity or when they have a specific question.

Here’s an example: When someone seeks to sit for one of the IAPP’s certification exams, they register through the IAPP’s website. But we must share this information with another company — Pearson Vue, presently — which is in the business (among other things) of hosting electronic exams for organizations like the IAPP all over the world. Pearson, in turn, has arrangements with testing centers that operate brick-and-mortar locations for test takers to sit for an exam, complete with proctors and secure computers. The testing centers collect personal data from test takers regardless of whose exam they are taking to verify that they are not sitting for someone else’s exam. This can surprise some who have just studied for a privacy test! And we have heard about it from a few members.

So, we have made upgrades to our privacy notice to explain this practice in more detail. At the same time, we are confirming this information is also clearly communicated upon scheduling the exam — when it is most timely and relevant.

There are a few other changes and updates in the notice, which are explained briefly in this post. As mentioned, some of them come from listening to our members who seek clarification, but others come from the benefit of time and ongoing learning about our own data-processing practices.

Credit belongs, I must say, to new employees with data science and analytics skills who are incredibly good at finding data. If I’ve learned anything in the past few months, it’s that working with data scientists is not only a joy, but it’s also essential to the privacy office. Both we and they have a lot to learn from each other, and the partnership produces the best and most comprehensive view of data processing, storage and transfer practices. This, in turn, enhances the organization’s compliance position, as well as its ability to do privacy by design.

Here is a summary of updates to the IAPP’s privacy notice:

• We have provided additional explanation of the categories of personal information collected from those who register for our live events, as well as how we use the data to help us plan the event and future events.
• We have clarified co-sponsorship of our web conferences and the roles of the IAPP and co-sponsors in collecting contact information for use in follow-up marketing messages. This is in response to the California Consumer Privacy Act, even though the IAPP (as a nonprofit with no shareholders or owners) is not a “business” under the CCPA. Many of our co-sponsors are businesses and wish to ensure the transaction is not considered a sale of data under the law.
• Subscribers to the IAPP’s newsletters who are opted in to “marketing” cookies may notice that the IAPP keeps a record of when they click on a link in the newsletter and are directed to an article or white paper on the IAPP’s website. For those who are curious about this operation, we provided more detail.

This short summary does not do justice to the many hours that went into getting here today.

Whenever someone writes to dpo@iapp.org with a question about our data-processing practices, we react with a sense of urgency and curiosity. Our members are often highly sophisticated and knowledgeable about privacy and data protection laws, so we are humble enough to admit we can always learn a thing or two. As well, we are aware that such questions provide us an opportunity to communicate internally, develop a deeper understanding of our own practices and perhaps even reach out to a data processor with questions and clarifications. This helps them learn, too.

Sometimes input from our members results, after investigation and several meetings, in changes either in our practices or in our transparency about them. This, I think, is not an admission of neglect but just the opposite. Data privacy is not something achieved at a point in time, it is an ongoing and iterative process requiring cooperation and communication throughout the enterprise.

What a pleasure it is to work with such privacy-dedicated colleagues — the IAPP team and all of you!