RADAR Blog

For those tasked with the daily, detailed work of ensuring their organizations’ compliance with data breach notification regulations–particularly in light of the complexity of preparing for new regulations to go into effect, namely GDPR–it could be easy to forget the person in personal data. Speakers from this year’s IAPP Global Privacy Summit reminded us of just how reductive that vantage point can be, touching on the very human element that lies behind every privacy incident.

This article is part of an ongoing IAPP Privacy Advisor series on privacy program metrics and benchmarking for incident response management. Find earlier installments of this series here. 

Data controllers and processors benefit from RADAR’s automated risk quantification and notification guidance under the GDPR, the capability to take into account the scope and sensitivity of personal data within each organization, and the ability to ensure and simplify compliance with both regulatory and contractual notification obligations.

This article is part of an ongoing IAPP Privacy Advisor series on privacy program metrics and benchmarking for incident response management. Find earlier installments of this series here. 

Working with privacy and compliance professionals, one of the challenges we often hear about is how difficult it can be to keep up with ever-changing breach notification regulations. Think of it this way: in the US alone there are 48 separate state breach notification laws (along with Washington, D.C. and three territories), each with their own unique definitions, breach notification triggers, and compliance requirements.

Last weekend on January 28 we observed Data Privacy Day, an internationally recognized day intended to raise awareness and promote privacy and data protection practices. First celebrated in the United States and Canada ten years ago, the day commemorates the Jan. 28, 1981 signing of Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the first international treaty dealing with privacy and data protection.

About this time last year, we predicted 2017 would see continued vigilance from the Department of Health and Human Services’ Office for Civil Rights (OCR) in regulating and issuing enforcement actions for HIPAA violations. The results are in, and there was sustained momentum from OCR in the last year, including 196 separate breach cases listed for 2017 on the OCR’s so-called “Wall of Shame” breach portal and notable financial settlements for HIPAA violations – in total, OCR received $19,393,000. A full listing of these enforcement settlements from 2017 can be found here.

OCR Enforcement Trends

This article is part of an ongoing series on privacy program metrics and benchmarking for incident response management, brought to you by RADAR, Inc., a provider of purpose-built decision support software designed to guide users through a consistent, defensible process for incident management and risk assessment. Find earlier installments of this series here.

PORTLAND, Ore., — January 23, 2018 – With organizations facing an increase in data privacy and security concerns, regulatory complexities, and associated organizational risks, penalties, and legal costs, SaaS solution provider RADAR, Inc. and law firm Stoel Rives have formed a preferred provider alliance to leverage and promote the use of RADAR’s purpose-built solution for compliance with data breach laws. Using and recommending the patented RADAR decision-support software for consistency in incident risk assessment and efficiency in response management will allow Stoel Rives to help clients reduce compliance costs while providing strategic data breach response services.

This year has barely begun and already there’s something new in the world of state breach notification requirements. On Jan 1, 2018, revisions to the Maryland Personal Information Protection Act (HB 974) went into effect, adding more specificity to the state’s breach notification requirements.

In December I had the pleasure of acting as emcee for Pitch Oregon 2017, an annual event hosted by TiE Oregon featuring regional early stage startup entrepreneurs pitching in front of a panel of judges for cash and investment opportunities. I’ve been involved in the entrepreneur scene in Portland for more than a decade, both as a mentor and volunteer and as an employee at start-up and growth stage companies. This event serves as a great representation of what the region has to offer, and the role that leaders at startups and established enterprises can have in fostering opportunities for budding organizations.

On November 28, 2017, the Article 29 Working Party (WP29) closed its public consultation period for WP250, guidance issued by the European advisory body on personal data breach notifications to supervisory authorities and data subjects under the GDPR.

On November 21, 2017, Uber disclosed a data breach potentially affecting 57 million passengers and drivers around the world, including over 10,000 Washingtonians. One week later, on November 28, 2017, Washington State Attorney General Bob Ferguson filed a consumer protection lawsuit.

Last month during the annual Privacy.Security.Risk. event, the IAPP released the results of the 2017 IAPP-EY Annual Governance Report. We always look forward to this report, now in its third year, having now compiled survey responses provided by nearly 600 privacy professionals across the globe. The findings have been consistent with what we’re hearing from customers and industry partners, who are making frantic efforts to prepare to comply with the rigors of GDPR and its risk based framework.

This article is part of an ongoing IAPP Privacy Advisor series on privacy program metrics and benchmarking for incident-response management. Find earlier installments of this series here.