Top 11 des tendances en matière de protection des données

Ernst & Young

Description

Les professionnels doivent anticiper les défis de demain pour répondre aux enjeux d'aujourd'hui. Quelles sont les tendances 2011 en matière de protection des données ?
Lire "Top 11 des tendances en matière de protection des données"
Voir sur ey.com

Sujets

• Informatique dans les nuages
• Gendarmerie royale du Canada
• Régulation
• Réseau social
• Tendance
• 2011

Informations

• Publié par: Ernst-And-Young
• Publié le: 01 février 2011
• Nombre de lectures: 83
• Langue: English
• Poids de l'ouvrage: 1 Mo

Extrait

Insights on IT risk

January 2011

Privacy trends 2011 Challenges to privacy programs in a borderless world

Summary of trends • Regulation, laws and enforcement. Historically, enforcement of privacy legislation has been inconsistent or nonexistent. Today’s regulators plan on changing that by expanding their reach and imposing tougher penalties. • Additional breach notication requirements. Governments around the world are drafting and adopting breach noti cation legislation. Organizations need to adapt based on their industry and jurisdictions of operations. • Governance, risk and compliance (GRC) initiatives. Organizations are expanding GRC initiatives to converge with governance and enhance business performance with risk management. There is only a small number of GRC technologies available, but that number is growing. In 2011, expect technology rms to produce and update modules that attempt to address privacy monitoring. • Cloud computing. Organizations transitioning their business  processes to a cloud environment need to have robust vendor risk management and third-party reporting capabilities in place that address privacy risks. • Mobile devices. Portable media means portable personal information. Employees and organizations alike need to understand and respect the power, limitations and technical controls of mobile devices.   Increased investment. Organizations are increasing their investment in • governance and tools that help manage privacy and data protection, in part because of regulation, but also because of increasing risks. • More privacy assessments. Look for internal audit departments to identify speci c parts of their organizations on which to conduct deeper privacy audits and for other assessments to expand. • Ser Stan rep • Priv priv the i prac • Soci priv emp • Evol bec area

Introduction For years, the xed boundaries of an ofce’s four walls have, for the most part, enabled companies to manage the privacy of the data they keep. But in an era of anytime, anywhere access to information, these traditional boundaries are disappearing. It is a new world — technology-driven, ever-connected, globally extended and well beyond the scope of conventional privacy protection approaches. In Borderless security: Ernst & Young’s 2010 Global Information Security Survey , 81% of executives interviewed indicate that managing privacy and protecting personal data is very important or important to their organization. And no wonder: highly publicized incidents of data leaks or identity theft pose huge brand and reputation risks for businesses — a concern survey participants ranked even higher than privacy protection (84%). As a result, executives are investing more money to protect the privacy of personal information — to respond to ever-increasing government regulation and enforcement and to stem the rising tide of risk. But are they spending it in the right places? With parts of the global economy still limping toward recovery, executives continue to ask this burning question as they search for the right balance between spending on privacy protection and taking appropriate levels of risk to manage costs. One thing is certain: technological advances will only continue to accelerate, and organizations need to be ready. While governments are stepping up regulation and enforcement, privacy protection lacks international cohesion. It is a compliance patchwork with levels of consistency that vary from country to country and industry to industry. Organizations do not have time to wait for global regulatory bodies to reach consensus. They need to take action now to proactively develop and implement enterprise-wide privacy protection strategies that match the organization’s risk pro le. By looking upon privacy strategies to drive regulation rather than the other way around, companies can meet today’s needs and also anticipate tomorrow’s challenges.

Insights on IT risk | January 2011

1

Regulations, laws and enforcement

Historically, enforcement of information protection legislation and for improving cooperation and coordination among member has lacked teeth. Today’s regulators plan on changing that by nations. In advance of the release of new regulations under the expanding their reach and imposing tougher penalties. The US EU Data Protection Directive, several EU countries have been busy Health Information Technology for Economic and Clinical Health intensifying existing enforcement policies. (HITECH) Act of 2009 (the HITECH Act) is one such example. Under the HITECH Act, state attorneys general can investigate and take  This year, Mexico, a signicant outsourcing destination, joined action against organizations for failing to secure protected health  about 50 other countries in adopting a broad privacy regulation information. The year 2011 will bring additional clarity and detail  t P h r a o t t   e fo ct c i u o s n e   s o   f  o P n  e t r h s e o   n p a r l i   v D a a t t e  a s   e H c e t l o d  r. b   y T   h P e r   i F v e a d te e   r P al a   r L ti a e w s     o w n il   l t  i h m e  pact  regarding the provisions of regulations that address the online  many large US-based companies operating in Mexico. environment in many countries. In the EU, the European Commission is in the process of updating  i S m im p i o l r a t r a ly n , t     t o h u e  t E so U u  f r o ci u n n g d     d t e h s e t   i d n a a t t a i   o p n r   o fo te r  c t t h io e  n E  l U a , w  p s r  o o f v   i I d sr e a d e   l a ,  n a   n  the 1995 EU Data Protection Directive. Plans for strengthening  “adequate level of data protection” relative to the EU Data enforcement include providing data protection authorities with the ability to investigate and sue organizations that do not comply,  t P h r e o   t E e U c   ti a o n n d    I D s i r r a ec el t   i c v a e. n     T n h o is w     d m es o i v g e n   a m ti u o c n h     m m e o a r n e  s f   r t e h e a l t y  data between  .

Questions to consider  Have you stayed current with the regulations impacting your particular industry and • the personal information your organization processes? • Have you reviewed whether regulations have changed in the jurisdiction(s) where you operate? • Have you assessed your compliance with applicable regulations recently?

2

Insights on IT risk  |  January 2011

Additional breach notication requirements

Breach notication goes beyond regulatory compliance. Its Breach notication cannot be discussed without raising the focus is on transparency, which has fundamentally altered how concern of the “insider threat.” Individuals who are authorized to organizations approach privacy and data protection. Breach access and use information are increasingly found at the center notication failures have resulted in reputational damage and of high-prole incidents. Such misuse of information may be attracted the attention of regulators. In the US, most states have due either to lack of awareness or to malicious intent. Training adopted breach notication requirements that commonly address and awareness are key to addressing the unintended disclosure sensitive and nancial identiers. The HITECH Act introduced of information. Technical controls, such as tools for monitoring similar requirements for protected health information. And, information trafc, can be of great help when addressing more while the US has been an early adopter of breach noti cation malicious cases. requirements, these types of requirements are increasingly taking  Data loss prevention (DLP) tools can also help by monitoring hold in other places around the world.  unintentional or intentional data leaks from within the organization. In Canada, an amendment to the Personal Information Protection In 2011, we will continue to see the popularity of these tools and Electronic Documents Act (PIPEDA) is making its way through increase as organizations look for a technical control to limit their the regulatory process and includes breach noti cation obligations. breach exposure. However, it takes more than the purchase of a In the EU, a breach notication regulation for the telecommunications DLP tool to achieve effective monitoring of personal information industry will come into effect in 2011. In addition, the EU’s review to prevent loss. Adopting these tools requires appropriate of the Data Protection Directive is expected to result in noti cation consideration of the policy that will guide the extent of the tool’s requirements for all EU member countries. Some EU countries are implementation (e.g., to stop a possible leak or just report it for a adding their own breach noti cation provisions. In the UK, for later investigation) as well as cross-functional leadership support example, regulators are working on a law that will force organizations and the necessary stafng to implement it. to publicly acknowledge any data breaches to regulators and to  Regardless of jurisdiction, organizations have to adapt to new inform those affected.  requirements regarding breach noti cation. Whatever thei r In Asia, Japan is leading the way with breach noti cation reliance is on technical controls for combating the loss of personal requirements that have been in place for several years. Much information, organizations need to have effective programs in like in the US, the expense associated with such breaches can place to detect, address and resolve breaches. They also need to lead to a signicant number of direct and indirect expenses for have open and transparent communication plans to inform those organizations operating there. affected when their data is compromised.

Questions to consider • Have you developed and implemented an incident response plan for handling breaches of personal information? • Have you identied the relevant breach noti cation requirements in your industry and jurisdiction(s) of operation?  Have you looked into the adoption of a DLP tool or using DLP services to • monitor your organization’s network for possible loss of personal information?

Insights on IT risk  |  January 2011

3

Governance, risk and compliance (GRC) initiatives

Organizations have been investing heavily in GRC initiatives for update a common roster that identi es where an organization’s years. But in the wake of the worst economic crisis since the Great data resides. In 2011, we expect technology  rms large and small Depression, some reports are suggesting that  nancial institutions to produce new modules that will attempt to better integrate alone were spending up to US$100 billion on mitigating risks in 2010. privacy into control monitoring. In an Ernst & Young survey of 567 organizations across Europe, the GRC tools, however, should not be seen as a one-dimensional Middle East, India and Africa in 2010, 1 69% of participants indicate solution for managing risk. Often, organizations need to completely that they are highly reliant on their GRC activities as a safeguard transform their risk functions. In 2011, we expect to see progressive against failure. And yet, 67% of respondents suggest that more organizations take an integrated approach that aligns risk and work is needed to enhance their GRC functions. strategic business objectives. This means shifting GRC investment to From a technology perspective, the market for GRC tools continues  focus on the risks that matter, and looking across the enterprise to identify compliance control redundancies. From there, organizations to develop and offer risk management solutions, and more speci cally,  may wish to consider compliance convergence, which streamlines solutions for managing privacy. In a   r 2 k 0 e 0 t. 9     H a o n w d  e 2 v 0 er 1 ,  0 fe , t w e  v c e h n n d ol o o rs g   y o   ffer  controls horizontally rather than vertically within the organization.  h a  e fu a l v l  y G w R e C i   g s h o t l s u   t e i n o t n e ,  r a e n d d  t  e h v e  e G n  R fe C w  m er offer sophisticated or easy to use  s C t o r n ai v n e   r t g h e at n   c r e e   p o e f  a c t  o a n u tr d o it l  s a  p ct u i t v   i o ti n e   s r   e w s i o ll u  r r e c d es u . c  I e t     a m u a d y it     a f l a s t o i   g p u r e o   d a u n c d e  t   he  modules for privacy management. This is partly due to the complex  the much-needed cost efciencies many budget-conscious nature of the requirements and partly due to the dif culty involved in automating key privacy-related updates. But while the giant  organizations still seek. GRC technology rms may still be nding their feet when it comes As organizations endeavor to implement a risk transformation to privacy management, some boutique software companies, program to improve GRC performance, privacy professionals need seeing a gap to ll, are entering the market. These smaller  rms  to make sure they have a seat at the table to ensure that privacy are aggressively exploring ways to automate regulatory and policy  concerns remain a top priority for risk leaders and an integral part mapping, incorporate a framework for integrated compliance and  of any comprehensive GRC solution. risk assessments, and provide the ability for multiple users to

Questions to consider • Have you considered different approaches for continuously monitoring key aspects of your privacy program? • Have you assessed GRC solutions that offer a wide range of monitoring areas, including privacy? • Have you asked your current GRC vendor for updated modules to help monitor risk and compliance related to the use of personal information?

  1   The multi-billion dollar black hole — Is your governance, risk and compliance investment being sucked in? , Ernst & Young’s survey of 567 companies in Europe, the Middle East, India and Africa, conducted in the second quarter of 2010.

4

Insights on IT risk  |  January 2011

“Cloud computing has enormous social and economic potential. It can help businesses save money and create jobs. It can help governments increase ef ciency and better serve their citizens. And it can help schools better educate their students. However, privacy concerns remain a signi cant impediment to the adoption of cloud computing for many potential customers. To ensure that society can maximize the benets of cloud computing, removing the blockers around privacy is critical. Cloud service providers can start by building customers’ con dence in the cloud. They can do this by demonstrating an inherent respect for privacy that is embodied in transparent business practices and a commitment to accountability.” Brendon Lynch, Chief Privacy Of cer, Microsoft

Cloud computing

While cloud computing may be on the rise, many organizations still Today in the US, it’s easier to subpoena or otherwise compel the have reservations about the inherent data privacy and security release of information when it is held by a third party (such as a risks associated with using cloud providers. In our 2010 Global cloud provider) than its original owner. And then there are laws Information Security Survey, only 23% of participants indicate that such as the PATRIOT Act, which for some speci c purposes allows they currently use cloud computing-based delivery solutions. A the government to gain access to personal information residing in a further 55% say they have no plans to use cloud computing in the third-party cloud provider without the knowledge of the information next 12 months. But this will change quickly — according to a 2010 owner or data subject. w G i a ll r   t s n e e e r     p r r e i s v e a a c r y c  c h o  p n u c b e l r i n c s a   t a io s  n a ,     r b e y a   s 2 o 0 n 1   4 n   o l t e   s t s o     t j h oi a n n     t 1 he 0   % c   l o o f u  c d o . 2 mpanies Further,  as more companies choose to use a third-party cloud provider in 2011, they need to outline speci c requirements that The major attractions of cloud computing are cost and  exibility. As enable them to meet their privacy regulatory obligations. Before some global economies struggle to recover, organizations are looking moving data to the cloud, organizations should analyze their data for more ways to streamline operations and save money. Cloud and develop policies that address both the risks associated with computing can be a huge cost-saver. It is particularly attractive to sensitive data and regulatory requirements. small- and medium-size busin esses that use it to stay competitive.  Policies should include how soon the cloud provider needs to alert But with cloud use comes responsibility. Organizations need to have the organization of a suspected breach so that the organization can robust vendor risk management, including third-party reporting notify relevant regulatory bodies and individuals. Organizations will capabilities that address data privacy risks. For example, cloud also want to be clear about retention periods, where the data can services located in different geographies raise regulatory challenges or cannot be transferred, logging of access by cloud administrators as personal information travels across jurisdictions. and the ability of other parties to access the data for market research or other secondary activities.

Questions to consider  Have you conducted a risk-based review of what business processes and related personal • information are needed before a move can be made to a cloud environment, and what varying levels of protection and control they require? • Have you reviewed what contractual and regulatory limitations may exist over the use of a cloud provider, including questions surrounding geographic location, data retention and security? • Have you explored your ability to monitor the adherence of your cloud providers to the terms set in your agreement with them, including the protection of personal information?   2  “Predicts 2011: Enterprises Should Not Wait to Find Solutions for Business-Critical Privacy Issues,” Gartner, 8 November 2010, © 2010 Gartner, Inc. and/or its Af liates.

Insights on IT risk  |  January 2011

5

Mobile devices

Laptops, cell phones, smart phones and tablets: in today’s wireless world, there is an array of mobile devices that employees can use to stay connected to the of ce without stepping foot in the building. This kind of mobility offers huge opportunities for organizations to enhance productivity. But there are risks. Portable media lead to portable personal information. In 2011, we expect increased regulation that directly addresses protecting personal information on mobile devices, and the sensitive information revealed by geo-location tracking of mobile devices. Geo-location Technology advances are increasingly enabling organizations to identify the physical location of a device, as well as the person using it. In terms of privacy, organizations need to understand where to draw the line in using location data. On the employee level, organizations can keep track of their workforce, comparing where their employees are at any given time versus where they are supposed to be. On the customer level, organizations can offer marketing programs that are based on immediate location. If organizations decide to use physical location to track employees or reach out to customers with special offers, transparency is paramount. Employees need to know what the policies are regarding geo-location and what tools they may have at their disposal to shield their privacy by choosing how much information they share on the device. Customers must have the opportunity to provide informed consent before allowing any organization to track their location.

Encryption Traveling data means understanding and adhering to state, federal and international privacy regulations that will vary from one jurisdiction to another. Some emphasize the encryption of personal information on mobile devices (e.g., the State of Massachusetts in the US). But, in most cases, hard drive encryption is only useful when a mobile device is lost or stolen and it is in the “off” or “hibernation” mode. It doesn’t protect against hackers, nor does it necessarily protect information that is being backed up. Encryption is an effective tool for protecting some data, but it is not preventing attacks and it is likely not addressing your organization’s top security risks. Training and transparency The benets to organizations and employees of being able to work in different locations and in different time zones (think telecommuting) bring increased responsibility for protecting the personal information employees use for work. Employees and organizations alike need to understand and respect the limitations and technical controls of mobile devices. When employees use personal devices for work, organizations may be able to apply technical controls (e.g., require a download of a certain load set before allowing a personal device to connect to the rm’s network) that provide visibility into various content and activities on those devices. However, where should the organization draw the line in terms of infringement on personal privacy? Organizations need to ensure that they have specic policies regarding the use of each mobile device issued, and the extent to which personal devices used for work purposes may be monitored. Organizations should clearly communicate to employees what information is being monitored, how it is being monitored and the consequences for not adhering to mobile device policies.

Questions to consider • Have you considered both the advantages and risks associated with using mobile device   geo-location information for your operations? • Have you assessed what level of encryption (or combination of levels) is merited to protect personal information in the common work settings of your organization? • Have you reviewed your privacy policies recently in light of your organization’s use of mobile devices?

6

Insights on IT risk  |  January 2011

Increased investment

Organizations understand the signi cance of data protection. They start to re-invest in related positions. The increased use of tools to are increasing their investment around personal information, in protect privacy, such as DLP solutions, will also require appropriate part because of regulation, but also because of increasing risks. stafng to monitor and respond to technology alerts. i I n n  v 2 es 0 t 1 m 1  e w nt e s     w t i h ll a  s t  e w e i   ll a  f n o  i c n u c s re o a n s  t e  w in o    i p s r s iv u a e c s y :    p a r n o d g   r d a at m a     i p ni r t o i t a e ti c v ti e o s n  a   nd  In terms of technical controls, 2011 promises more spending in this   area as organizations rely more heavily on controls to manage technical controls.  personal information. Tracing the web, with brand risk management Organizations will once again review their governance structure in mind, is yet another area of investment for organizations in 2011 through a privacy and security lens. They will launch new privacy as employees and customers increasingly interact with (and discuss) programs, including updated policies, new procedures and awareness organizations, products and services. In addition to the GRC and DLP programs, and will recruit talent accordingly. Reacting to the global technologies mentioned in previous sections, organizations will economic downturn, many organizations reduced compliance and continue to invest in internal monitoring solutions to monitor risk management positions. As organizations start to rebound inappropriate activity by insiders who use — and may be abusing — economically, and as privacy risks increase, organizations will personal information.

“In health care, privacy goes back thousands of years to the Hippocratic Oath. The health care profession realized, even then, that the ability to provide care to individuals requires that the interactions between physician and patient remain con dential. Privacy enables trust, and trust is at the core of providing care. If that trust is absent, there can be negative consequences to the health of a patient, as they may not seek the treatment they need.  Unlike breaches in other industries, where you may be able to reimburse an individual after a breach, it is not possible to compensate an individual for an irreversible breach of their privacy. Trust is eroded.  Historically, the health care industry’s focus has been on regulatory compliance. The notion of security as a discipline that is separate from compliance is still relatively new. But as health care increasingly relies on technology as a means of providing care, security needs to mean more than basic guidelines on password length and not inappropriately sharing information.  The growing reliance on technology exposes the health care industry to new threats that go beyond those that have traditionally been a concern to health care. New and rapidly evolving technologies have also increased the stakes in that a breach may now involve thousands of records. Continuously adapting to changing threats and evolving technologies to manage risk and ensure patient privacy is the challenge we face in health care.” Patrick Heim, Chief Information Security Of cer, Kaiser Permanente

Questions to consider • Have you assessed your budget needs in light of the evolving risk and compliance landscape? • Have you reviewed the necessary positions for effective governance over your privacy and data protection activities? • Have you consulted with your organization’s privacy professionals regarding the investment in technology to monitor the use (and possible abuse) of personal information?

Insights on IT risk  |  January 2011

7

More privacy assessments

Protecting personal information needs to be a never-ending focus of guidance and training should also be performed, as incidents for organizations. Internal auditors are increasingly challenged to involving personal information may result from a lack of awareness identify and assess controls to minimize the risk of data breaches. rather than the intent to cause harm. A a c r c t o i r ci d p in a g n   t t s o     a o r u e  r  al 2 r 0 e 1 ad 0  y  G u lo si b n a g l    I i n n f t o e r rn m a a l  ti a o u n d   i S ti e n c g u  t ri o t   y t   e S st u   r c v o e n y t ,  r 5 ol 4 s  % a   s o   f a     The American Institute of Certi ed Public Accountants (AICPA)  p and  Canadian Institute of Chartered Accountants (CICA) Privacy w m e e   a e n x s p   e o c f  t c  t o h n a t t r   o n ll u in m g b  d er a   t t a o     l i e n a c k r a e g as e  e o . f sensitive information. In 2011,  Task Force’s Generally Accepted Privacy Principles (GAPP)  describe a comprehensive framework developed to allow the In the past, internal audits have had a fairly broad focus. In the auditing and development of privacy programs. The GAPP help future, internal audit departments will begin to identify speci c management develop effective policies to address privacy risks. parts of their organizations to conduct deeper privacy audits. They are gaining widespread recognition and use in the design, This may include reviewing the effectiveness of the monitoring measurement, monitoring and auditing of privacy programs. In of the possible exposure of personal information. Concerns over 2011, organizations will be able to use a newly developed maturity abuses of personal information by employees, whether intentional model to assess themselves with incremental improvement in mind. or unintentional, make privacy an area of risk that internal audit In addition, beginning in mid-2011, changes to reporting standards cannot ignore. Such audits address the effective use of technical for service providers will allow organizations to include the GAPP controls to monitor activities and the use of personal information criteria in the report they receive from their auditors. in databases, repositories and the organization’s network. Audits

Questions to consider • Are there or should there be any privacy internal audits planned for 2011? • Does the internal audit group in your organization have access to professional training about privacy risks? • Have you reviewed the GAPP and their possible use in assessing and further developing your privacy program?

8

Insights on IT risk  |  January 2011

Service provider reporting standards

Even an organization with the most robust privacy practices and  • A description of its system by management of the service controls cannot comply with its privacy commitments if its service  provider, and an assertion of the effectiveness of its controls and providers do not also have equally robust practices and controls. its compliance with its privacy commitments in accordance In our 2010 Global Information Security Survey, 41% of participants with GAPP indicate that service providers and outsourcing rank among their  • An auditor’s opinion on the fairness of the description of the top ve areas of IT risk.  system, effectiveness of controls and compliance with privacy As a result, many organizations desire or require their service  commitments based on GAPP providers to obtain an independen t assessment of their privacy and security practices. Often, organizations seeking such an  • A o   p d in e i s o c n ri ,  p a ti n o d n  t  o h f e     t r h e e s  t ul e t s s t   s o   f p  t e h rf o o s r e  m te e s d t   s by the auditor to arrive at its  assessment have been making do with reports performed in accordance with Statement on Auditing Standards No. 70  This new report will provide transparency and insight into the (SAS 70) reports, although these reports are not intended to  privacy and security practices of service providers, permitting them address privacy, or even security for the most part.  to demonstrate that they have effective privacy and data protection The AICPA is in the process of is suing new guidance on service  practices in place. Many leading service providers are eagerly trols (SOC) o  awaiting this new guidance and their customers are anticipating its o a r t g a a S ni e z r a v t i i c o e n     O c r o g n anization Rel r e e v p an r t ti t n o g     S (S ec O u C r   it 2 y , ,     R A e va p il o a r b t i s l   it o y n ,     Controls  release even more. Processing Integrity, Condentiality and Privacy ), which will allow  Expect 2011 to bring an increased interest in and new discussion service providers to report on their privacy and security controls.  about independent assessments of privacy and security practices. A report prepared using this guidance will provide:  Service providers should become familiar with this new guidance, the principles and criteria of GAPP and the controls necessary to •  p A r   i d v e a s c c y r   i a p n ti d o  s n  e o c f u  t ri h t e y     s o e f  r p vi e c r e s   o p n r a o l v  i i n d f e o r r ’s m  s a y t s i t o e n  m t   h r r e o g u ar g d h i o n u g t     the  address them. Service providers and their customers can follow  its life cycle  the development of this guidance at http://www.aicpa.org/ InterestAreas/InformationTechnology.

Questions to consider • Have you been relying on your service providers’ SAS 70 report as a privacy and security   monitoring mechanism? • Have you discussed with your service providers the controls over the use of personal   information that you expect to see covered in the new reports?

Insights on IT risk  |  January 2011

9