On May 25, 2018, a major new piece of data protection regulation will come into effect across the European Union (EU), and with it comes the potential for hefty fines or penalties for your organization. Even if you do not directly operate in the EU, chances are that the General Data Protection Regulation (GDPR) still pertains to your company.
The regulation covers any entity that processes the personal data of EU citizens (referred to as “data subjects”), even if the organization does not provide goods or services to EU citizens and only handles or processes their data. Unless you are categorically sure that your organization does not and will not process EU citizens’ personal data, compliance is not optional.
The fine for an infringement can be €20 million (approximately $23 million at today’s exchange rate), or 4 percent of your worldwide annual turnover, depending on which is the higher amount. It is essential for directors to pay attention to the data and information security practices in place to ensure that the organization is prepared and compliant.
The Policy Details of GDPR
The GDPR was written to ensure that organizations:
protect the personal data of ‘EU Natural Persons’ (i.e. living people);
are transparent, fair, and lawful about the processing of personal data;
only request and process necessary personal data;
do not share data with third parties or countries unless the correct legal agreements and processes are implemented; and
gain consent from data subjects to process their data.
Personal data is defined in the policy as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
There are six principles that apply to the processing of personal data. According to the policy, personal data shall be:
processed lawfully, fairly, and in a transparent manner;
collected for specified, explicit, and legitimate purposes;
adequate, relevant, and limited to what is necessary;
accurate and, where necessary, kept up to date;
kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; and
processed in a manner that ensures appropriate security of the personal data.
Data subjects are provided with a set of legal rights under GDPR, including the right:
Each EU member state has a designated supervisory authority. These regulatory bodies are responsible for monitoring the application of GDPR, and have the power to audit organizations and determine relevant warnings, reprimands, and fines for violations of the organization. When breaches of personal data occur, companies will be subject to a high level of scrutiny, and will have only a 72-hour window to report on the breach. A personal data breach is described as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.”
There is a requirement for some organizations to appoint a data protection officer (DPO), whose responsibility it is to advise and inform on GDPR and to monitor compliance within the organization. The DPO acts as the main contact for both data subjects and the supervisory authority, must report to the highest level of management within the organization, and cannot perform any tasks or duties which result in a conflict of interest.
You need to ensure your organization has fully investigated the nuances of the requirements to ascertain whether you need to appoint such a role or prepare to meet other personnel or technical demands.
Where do we start?
Your organization first needs to define the team that will drive GDPR compliance and management. Within the C-suite this should include the chief information officer and the chief information security officer, in addition to representatives from legal counsel, human resources, risk and compliance, and privacy. Determine if you need to appoint a DPO. Once your team is assembled, assess your current state, so that you can plan next steps accordingly. This team should present results at least to your board’s audit committee, if not the full board, given the financial and reputational risks involved.
Understand your personal data retention
You should ask your GDPR team the following questions to determine what categories of personal data your organization is dealing with:
To whom does data you collect and retain pertain?
Is it necessary to collect and keep this data?
If so, how long do you need to keep it?
Do you have permission from the data subject to process the data?
How is consent obtained from data subjects for each method of personal data collection?
Encourage your team to follow others’ personal data on its journey through and beyond the organization. Doing so will help the GDPR team understand how the data is collected, stored, transmitted, accessed, and secured, and understand where and how it is passed on to any third parties.
Review how your organization collects consent from individuals to process their personal data
EU citizens must be able to give and rescind consent for their personal data to be processed. Consent means any “freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”
In a contractual situation, the provision of a service may require personal data to be processed in order for the service to function correctly. In this case, this has to be made clear to the data subject when they register for the service.
Identify partner and supplier risk
Review third party legal agreements to ensure the EU citizen’s personal data provided to a third party is handled in a compliant manner. Otherwise, your organization will be held accountable for vendors’ data breaches or a data loss scenario. If you process personal data on behalf of another organization, you will need to demonstrate your compliance with GDPR, and ensure your legal agreements reflect this accordingly.
Ensure your cybersecurity programs are up to par
Your security posture and processes impact the journey and security of personal data, and should be assessed accordingly. GDPR Article 32 stipulates that you must ensure a level of security appropriate to the risk involved with the data. This might require adjustments to your security program, especially if you have weighted your security setup to focus primarily on prevention and are lighter in the areas of detection and correction. Visibility across your ecosystem is vital for determining risk. Knowing your weak points will help you understand where to bolster your security, and testing out your processes will determine whether they are fit for purpose.
Get regular updates on progress and status
As individual reviews are completed, have each leader report back to the core and leadership teams with a set of prioritized actions and milestones. Set up a frequent cycle of reporting to understand the progress of your GDPR compliance status. The spring of 2018 is clearly too late to be finding problems.
If your organization employs, partners with, or serves people who are citizens of the European Union, you are subject to GDPR. Given the detailed stipulations of the regulation, along with the threatening risk of steep fines, it’s not something you can get away with ignoring or procrastinating. As a board member, you’ll want to ensure the organizations you serve are prepared to meet the challenge and reduce the risk.
Corey E. Thomas is president and CEO of Rapid7. He is director of Blue Cross Blue Shield of Massachusetts and the Greater Boston Chamber of Commerce.
In April 2017, the U.S. Securities and Exchange Commission’s (SEC’s) Division of Corporate Finance announced it will not recommend enforcement action for companies that disclose, but do not further investigate usage of conflict minerals which may be from the Democratic Republic of Congo (DRC). Any company manufacturing or contracting to manufacture products using such minerals had previously been required to conduct extensive due diligence on its supply chain and make this diligence publicly known with a note that its products contained minerals which “have not been found to be ‘DRC conflict free.’” However, following a series of partial losses in court, the SEC appears to be backing off the rule—for now.
The Conflict Minerals Rule and Disclosure Requirements
A provision in the Dodd-Frank Act aims to cut off funding sources for armed rebel groups in the DRC and surrounding countries in central Africa. It requires companies manufacturing products containing certain minerals to conduct supply chain audits and disclose if those minerals were known to have originated in the DRC or adjoining countries. The SEC, as the enforcer of this provision, issued a rule requiring issuers of securities who filed reports with the SEC under Sections 13(a) or 15(d) of the Securities Exchange Act of 1934 and who manufactured or contracted to manufacture a product in which the defined conflict minerals were a necessary part, to file a separate special disclosure form, Form SD. Although these obligations were placed on manufacturing issuers, in practice, the diligence requirement was imposed on others in the supply chain because many manufacturers required their supply chain partners to certify origin of minerals and compliance with the rule.
When Form SD was first issued, items 101(a) and (b) required companies using conflict minerals to attempt to identify the country of origin of those minerals. If after conducting a “reasonable country of origin inquiry” the company determined that the country of origin was neither the DRC nor an adjacent country, it had to disclose this finding (and a description of the country of origin inquiry conducted) on its website as well as to the SEC. Per item 101(c) of Form SD, if a company’s minerals may have originated in either the DRC or its neighboring countries, the company was required to conduct additional, more extensive due diligence, and then file and publish a conflict minerals report. This report had to include a description of the company’s due diligence efforts, certified results of an independent private audit, and a list of planned changes as a result of the audit. In the report and on its website, companies also had to describe which products had “not been found to be ‘DRC conflict free,’” although for the first two years of enforcement they could use the label “DRC conflict undeterminable.”
The National Association for Manufacturers challenged these regulations on both procedural and constitutional grounds. After the district court granted the SEC summary judgment, the Association appealed to the DC Circuit of Appeals. Ultimately, the appeals court found that forcing companies to note whether or not their products are DRC conflict free was unconstitutional under the First Amendment. The case was remanded to the U.S. District Court for the District of Columbia, which issued its final judgment in April 2017 and set aside the part of the rule that requires companies to add language that their products are “DRC conflict free” or “have not been found to be ‘DRC conflict free.’” Citing both the court decision and the unclear efficacy of the rule, SEC Chair Michael Piwowar reopened comments and the SEC stayed the compliance portions of the rule pending the conclusion of litigation. The SEC announced it would not pursue enforcement actions against companies who only complete Form SD items 101(a) and (b) and do not pursue more extensive diligence on sourcing or secure an independent audit. The SEC has taken the view that the purpose of item 101(c) of Form SD and the related conflict minerals reports was to determine the status of conflict minerals by requiring the “conflict free” or “not conflict free” labels, and that these measures and the requirements for more detailed due diligence are in need of re-evaluation and clarification given recent court rulings on this matter.
Although companies are not currently expected to conduct the extensive due diligence envisioned by item 101(c) of Form SD, they are still expected to conduct in good faith a reasonable country of origin inquiry and disclose this information to the SEC and the public. Companies and boards still need to ensure there are effective diligence programs in place that allow reasonable inquiry into supply chain partners and components, particularly if conflict minerals are necessary to any product the company manufactures. By statute, the SEC is required to issue a rule relating to due diligence for conflict minerals. Although the “conflict free” labeling requirement has been eliminated, the question remains whether conflict minerals reports, in their current form, are otherwise valid. The SEC is currently developing its future enforcement recommendations with respect to the rule.
In the interim, companies should continue to ensure effective supply chain diligence mechanisms are in place that allow them to confirm where components, particularly conflict minerals, are sourced. To the extent that auditing or diligence measures had already been put into place prior to the final judgment and SEC announcement, companies may want to continue to implement these measures given the lingering uncertainty about future application of the rule. Companies also have the ability to submit comments on the rule to the SEC and should make their views known to influence future enforcement on this issue.
At Baker & McKenzie, Joan Meyer is a partner and chairs the North America Compliance, Investigations & Government Enforcement Practice Group. Reagan Demas is a partner and Maria McMahon is a professional support lawyer in the North America Compliance, Investigations & Government Enforcement Practice Group in Washington, DC.
To learn more about strategy and risk, attend the 2017 Global Board Leaders’ Summit where you will have the opportunity to explore emerging risk issues with peers. A detailed agenda of NACD and Marsh & McLennan’s Board Committee Forum on strategy and risk, can be found here.
A few weeks into the Trump presidency, it is tempting to obsess about the political rhetoric and soundbites coming out of Washington, DC. While the first month of this new administration is certainly unprecedented in style, method, and message, the real cumulative impact on business remains unclear.
The combination of the chaotic start, the many political appointee vacancies across key departments and agencies, conflicting policy views between a Republican White House and Republican-controlled Congress on key issues, and ongoing investigations makes it challenging for businesses to respond and separate signal from noise.
Nevertheless, a recent pulse survey conducted by the National Association of Corporate Directors (NACD) offers some early insight into how companies and their boards are starting to navigate this new political environment.
1. A small majority of respondents (51%) is positive or very positive about the possible impact of the new administration on the growth prospects for their companies in the next 2 years. Almost 29 percent of respondents rated the possible “Trump effect” on business as either negative or very negative.
The differences in outlook are likely influenced by the relative dependence of individual companies on the benefits of international trade, the expected industry benefits of deregulation and infrastructure spending, and perceptions about the impact of a changing US leadership role in the global economy and security architecture.
2. Corporate tax reform, deregulation, and trade protectionism are the most highly ranked “policy” topics that respondents plan to discuss at their next board meeting. That’s not surprising since the (gradual) effect of policy changes in these three areas can significantly alter cost and revenue projections for business. The big question for many boards and executive teams will be whether the potential
fallout from trade protectionism (actions by the United States and possible retaliation by its trading partners) would offset any gains from a reduced tax and regulatory burden.
Trump’s unorthodox approach of injecting himself in the daily business of individual companies and their decisions seems to concern fewer respondents. Only 13 percent plan to discuss reputational exposure and management at their next board meeting.
3. Fifty-one percent of companies are now reassessing core assumptions about the impact of new and proposed policies on their strategic growth plans, which is an important exercise when so many key variables are moving or likely to move in the near future (for example, corporate tax rates, inflation, value of the dollar, interest rates, and import/export barriers).
Also, in response to the speed and ferocity with which consumers in this very polarized environment now react to corporate actions, many business leaders are beginning to proactively communicate the authenticity of their brand and their company’s contributions to society. More than 44 percent of respondents report that their companies are now reaffirming their core values and commitments to key stakeholder groups.
4. Only 25 percent of respondents decided to introduce scenario planning exercises to adapt to changes in the operating environment. Of that group, 85 percent are considering discontinuous scenarios based on major swings in key economic indicators, while 76 percent are scenario planning different outcomes from the planned overhaul of the US corporate tax system. Other macro-issues, for which boards will use scenario-planning in the coming months, include the possible repeal of the Affordable Care Act, the commercial fallout of trade protectionism, and the impact of significant geopolitical crises.
If used effectively, these scenario exercises can help open the minds of decision-makers—corporate directors included—to different signals, and prepare for surprises that directly affect the business strategy. Leading companies actively monitor for such signposts that would trigger course corrections in their strategic pathway.
To help corporate directors sense and respond to changes in this operating environment, NACD continuously assesses and interprets the impact of emerging issues. Every week we post our most recent analyses in our Emerging Issues Resource Center. Stories are accessible to all members.