In this digital age, an organization’s ability to collect, analyze, aggregate, associate, and securely share data around the world is mission-critical. However, an increasing number of laws have been adopted across the globe regulating and restricting the transfer of information, ranging in type from data privacy-focused regulations to national security-focused regulations.
Regulatory restrictions can present significant challenges for global organizations, as they could directly impact business transformations (e.g., new cloud sourcing arrangements, the collection of mobile and Internet data, big data analysis projects, and the like) and corporate compliance initiatives (e.g., auditing, monitoring, internal investigations, e-discovery, whistleblower hotlines, and other similar compliance undertakings).
Knowing what these restrictions are, how they impact the business, and how the organization is addressing compliance are key to the board’s oversight of data management practices, which are an increasingly fundamental business element.
Knowledge is Power
Because regulations are increasingly impacting how information may be collected, used, and transferred, it is essential for directors and executives to understand these regulations and to apply best practices. By doing so, boards can help their organizations mitigate the risk of exposure to regulatory noncompliance, in particular as the potential penalties for noncompliance become increasingly material. To accomplish this, boards must ensure that their organizations are informed of the five W’s of data to stay ahead of the compliance curve:
Who – Who are we, who are our data subjects, and who has access to our data?
Where – Where do we keep our data and where do we transfer our data?
Why – Why do we collect and transfer this data?
When –When are we retaining data and for how long, and when do we share it with others outside the organization?
What – What solutions do we have in place to safeguard regulated data and what elements are in place address any local requirements, including cross-border transfer requirements?
Data Privacy-Related Cross-Border Transfer Restrictions
Outside of the United States, many jurisdictions, including those in the European Union, regulate the collection, processing, and transfer of personal data via comprehensive data protection laws that cover a broad range of personal data and activities related to such information, including its collection, use, and transfer. Considering the ubiquity of data collection for marketing, commerce, and employment purposes, these regulations have significant implications for a broad range of businesses.
Personal data covered by these regulations is often broadly defined to include any information relating to, or that could be linked to, an identified or identifiable individual, including the following:
Email address (including work email address)
Payment card information
These regulations often restrict the transfer of such personal data across international borders unless certain conditions are met. The first question in the analysis is often whether the data is being transferred to a jurisdiction that provides similar or “adequate” protection for personal data.
If the answer is “no,” then investigate whether:
adequate safeguards have been put in place or some other justification for the transfer can be relied upon; and/or
whether a derogation applies (e.g., the data subject has consented to the transfer or the transfer is required for the performance of a contract).
It is important to note that accessing personal data remotely in a different jurisdiction from the one in which it is stored is often viewed by foreign regulators as a transfer to that other jurisdiction (e.g., viewing data stored in Germany from a computer in the U.S.). It is also noteworthy that United States’ legal protections for personal data frequently fail to meet the “adequacy” standards of authorities in more highly regulated jurisdictions, such as those in the European Union.
Data Privacy-Related Cross-Border Transfer Solutions
There are several solutions for organizations that need to transfer personal data across borders to countries that may not be deemed to provide “adequate” protection to personal data by certain foreign authorities, such as the United States. Boards should ask management teams to verify that one or more of the following solutions is in place to comply with applicable cross-border data transfer restrictions:
Consent – Where appropriate, ensure that the data subject has given his/her voluntary and unambiguous consent to the proposed transfer. It is important to note that this option may not be available for employee data in certain jurisdictions in which employees are generally not seen as able to provide voluntary consent to their employers, such as in Germany or France.
Data Transfer Agreements – Review whether or not contractual provisions designed to provide adequate protection to the personal data transferred are utilized by the organization both for internal cross-border transfers between affiliated entities and for transfers to third parties (e.g., the EU Standard Contractual Clauses).
Binding Corporate Rules – Determine whether the organization should adopt enhanced internal personal data protection policies and procedures within the group of companies, referred to as Binding Corporate Rules, and have those approved by the applicable regulators in order to rely on them as a solution.
EU-U.S. Privacy Shield Framework – For transfers of personal data from the European Economic Area to the United States, determine whether the recently approved EU-U.S. Privacy Shield Framework, which provides that organizations self-certified to the Framework are deemed to provide “adequate” protection to personal data by the European Commission, may be an appropriate solution.
These solutions will likely continue to evolve, along with the various regulations that impose the restrictions, in order to address the ever-changing digital marketplace. For example, under the new European General Data Protection Regulation (GDPR), which comes into effect in May of 2018, requirements around what constitutes valid data subject consent will have more prescriptive conditions and any new decisions by the European authorities deeming that a non-EU jurisdiction provides “adequate protection for personal data” will likely be subject to more rigorous requirements (although existing “adequacy” decisions will be grandfathered). The penalties are also increasing, with fines for violating the GDPR going up to EUR 20,000,000, or 4 percent of the total worldwide annual turnover of the preceding financial year, whichever is higher. Furthermore, beyond data privacy-related cross-border transfer restrictions, boards should also be aware that there may be additional potentially applicable cross-border transfer restrictions on organizations, including those related to national security or state secrets.
Given the significant financial and regulatory burdens for non-compliance, boards need to understand how these cross-border transfer regulations may impact their organization and stay informed of their organization’s compliance position, and any risk decisions made related thereto, when it comes to both current and future data collections and uses.
As a partner at Baker & McKenzie LLP, Michael Egan advises clients across a range of industries regarding the legal aspects of global privacy and data protection, data security, information technology, and related restrictions on data collection and transfer. Joan Meyer chairs the North America Compliance, Investigations & Government Enforcement Practice Group at the firm.
The major cyber breach that Yahoo announced last week has ripple effects not only for the multimedia platform, but for every company. The incident already has caught the attention of a senator who is calling on the U.S. Securities and Exchange Commission (SEC) to investigate how Yahoo disclosed the breach to shareholders and the public.
Background on the Breach
Ashley Marchand Orme
Account data for at least 500 million users was stolen by what Yahoo has called a “state-sponsored actor” in what CNN Money calls one of the largest data breaches ever. Compromised information includes names, email addresses, phone numbers, dates of birth, encrypted passwords, and security questions.
Yahoo has not named a country of origin for the hacker. The company, which Verizon is seeking to acquire, is still one of the busiest online sites, boasting one billion monthly users.
The breach occurred in late 2014, according to Yahoo, but the company just disclosed the incident in a press release dated Sept. 22, 2016. The Financial Times reports that Yahoo CEO Marissa Mayer may have known about the breach as early as July of this year, raising questions as to why it wasn’t disclosed sooner.
Attention From Lawmakers
Sen. Mark R. Warner (D.-VA), a member of the Senate Intelligence and Banking Committees and cofounder of the Senate Cybersecurity Caucus, sent a letter to the SEC yesterday asking the agency to investigate whether Yahoo complied with federal securities law regarding how and when it disclosed the incident.
“Data security increasingly represents an issue of vital importance to management, customers, and shareholders, with major corporate liability, business continuity, and governance implications,” the senator wrote.
Warner—who cofounded the company that became Nextel, a wireless service operator that merged with Verizon—also told the SEC that “since published reports indicate fewer than 100 of approximately 9,000 publicly listed companies have reported a material data breach since 2010, I encourage you to evaluate the adequacy of current SEC thresholds for disclosing events of this nature.”
And Warner isn’t the only lawmaker pushing for increased cyber regulations. Earlier this month, New York Governor Andrew Cuomo (D-NY) announced proposed cybersecurity regulations to increase the responsibility of banks and insurance to protect their information systems and customer information. The regulations, if instated, would apply to companies regulated by the New York Department of Financial Services (NYDFS) and would require them to—among other steps—establish a cybersecurity policy and incident response plan. Companies would also have to notify the NYDFS within 72 hours of any cyber event that is likely to affect operations or nonpublic information.
The Boardroom Response
Any company—whether public, private, or nonprofit—can fall prey to a breach, and even companies with formal cybersecurity plans can find themselves the victims of a breach. Preliminary data from the 2016-2017 NACD Public Company Governance Survey show what corporate directors are already doing to oversee cyber-related risks.
When asked which cybersecurity oversight practices the survey respondents’ boards had performed over the past 12 months—and directors could select multiple answers—the most common responses included:
Reviewed the company’s current approach to protecting its most critical data assets (76.6%)
Reviewed the technology infrastructure used to protect the company’s most critical data assets (73.6%)
Communicated with management about the types of cyber-risk information the board requires (64.4%)
Reviewed the company’s response plan in the case of a breach (59.3%).
“Corporate directors should ask management for an accurate and externally validated report on the state of the organization with respect to cyber risk,” said Robert Clyde, a board director for ISACA, which is a global IT and cybersecurity professional association, and White Cloud Security. “They should also ask what framework is being followed for IT governance.”
Aside from high-profile breaches of emails and email providers, Clyde says that breaches related to ransomware are increasing.
“Ransomware encrypts data that can only be decrypted by paying the attacker a fee in Bitcoins. According to the NACD Cyber-Risk Oversight Handbook and many other organizations, the key control to reduce the risk of attack—including ransomware—is restricting user installation of applications, called ‘whitelisting’ or ‘Trusted App Listing,’” Clyde said. “Yet this highly recommended control is rarely implemented. Boards should ask organizations for their plans to implement this specific control.”
NACD recently announced a new online cybersecurity learning program for directors. The multi-module course aims to enhance directors’ understanding of cybersecurity, and the difference between the board’s and management’s responsibilities related to cyber risks. Participants in the program, which is the product of partnership between NACD, Ridge Global, and the CERT Division of Carnegie Mellon University’s Software Engineering Institute, will work through a cyber-crisis simulation and take a comprehensive exam. Successful completion of the program will earn the participant a CERT Certificate in Cybersecurity Oversight.
This is the second of a three-part series looking at the global economy and uncertainty in 2016. In our first post, we addressed the challenges of slow growth in developed and emerging markets. In our next post, we will focus on the outlook for 2017.
DJ Peterson, President, Longview Global Advisors
Businesses need supportive, stable political and legal institutions to prosper, yet the global landscape has become increasingly unstable as many once-implausible events have become realities.
Since the start of 2016, the United Kingdom has voted itself out of the European Union. The U.S. Republican Party is pulling itself apart over policy and personalities. In Europe, fences are replacing open borders and Jihadi terrorists are targeting festivals, shopping centers, churches, and other public gathering places. Investors pay to lend their money to governments even as debt risks mount.
In conversations, business leaders and directors repeatedly express surprise and concern at the turn of events. What’s fueling this instability? Are recent events indicative of a “new normal,” a brief detour, or a transition to a new equilibrium? And, as the end-of-year business strategy season approaches, what should corporate directors and executives focus on?
Each country has unique characteristics, but there are some important interdependencies. Four powerful, converging political forces are at play.
1. Slow growth is fueling political volatility
As noted in a previous post, global growth has been muted and uneven since the global financial crisis, prompting some economists to ask whether the world has entered a period of “secular stagnation.” Energy and commodities exporters such as Australia, Brazil, Russia, and countries in much of Africa have been particularly hard hit.
Economic hardship often leads to political volatility, but there is a larger political force at play today: A lack of policy consensus and latitude. To turn the situation around, global financial institutions have been calling on governments to undertake bold structural reforms and assertive stimulus measures such as investing in infrastructure. But thanks to large debt piles and continuing calls for austerity from fiscal hawks, big spending increases are not politically feasible in the U.S. and Europe. Emerging markets dependent on commodities exports have been forced into belt-tightening mode as well. The inability of governments to reignite growth has forced central bankers to step into the breech with extraordinary measures.
Policymakers struggle to reignite growth, people are disaffected, and the sum of this instability is the political uncertainty and volatility we are experiencing today.
2. Inequality is adding to political frustrations
Free market liberalism is predicated on creating economic opportunity, but the benefits have not been shared. In many countries, inequality has surged since the 1980s. More recently, quantitative easing, a response to slow growth, has lifted a few boats greatly. In the past, governments often played the role of an equalizer; now proximity to political power is seen as conferring huge economic benefits, creating the belief that “the system” is not fair.
Free trade could be a casualty of increasing inequality and diminished opportunity. The perception that the benefits of globalization accrue disproportionately to certain segments of the population while the losers are left to fend for themselves is pervasive. Anti-immigrant sentiment is another by-product of limited opportunity.
Animosity towards politically connected elites in authoritarian markets is kept in check by repression. Open societies may be more at risk to economic and political polarization. As we see with Brexit, the pushback against globalization, and with the rise of anti-immigrant pressures, middle-ground policy pragmatism—a hallmark of stable democracy—is losing credibility in a world of economic resentments.
3. Populists are exploiting the governance gap
The widespread belief that establishment elites are incapable of solving important problems has created a volatile atmosphere where disaffected voters are willing to take risks and throw wrenches.
Private sector entrepreneurs exploit gaps in the market and find new ways to satisfy needs. Political entrepreneurs do the same in the public sphere: They take advantage of volatility, peddle new solutions (often from both left and right), and break rules.
Dramatic, frustration-driven policy stances of political entrepreneurs make compelling platforms—such as Philippine President Rodrigo Duterte’s anti-drug dealer campaign and French presidential candidate Marine Le Pen’s anti-immigrant stance. Donald Trump and Bernie Sanders are political entrepreneurs too.
But that’s only half the story. In this context, calls for pragmatism and staying the course (“Vote Remain!”) from establishment figures sound tired, if not suspect.
4. Social media is catalyzing volatility
Thanks to social media, populists can peddle their ideas with greater ease than previously seen, without having to adhere to the agenda of establishment media and institutions. (The self-described Islamic State is the most extreme example.) Being provocative is essential to gaining visibility in today’s crowded media landscape and this imperative promotes extreme points of view and places pressures on policymakers to react—even though in representative democracies governments are designed to be deliberative and consensual.
Just as individuals may be overwhelmed by the pace and quality of information flows, so too can governing institutions that were built to be slowed by checks and balances. Few would say policymaking in the U.S. has improved over the past couple of decades thanks to better information. Nationalism, ethnocentrism, and religious animosities seem more powerful than ever.
What can corporate directors do?
Western multinationals can no longer take political stability for granted. In these volatile times, directors have an important role to play in asking the right questions and discerning material risks and opportunity in a time of uncertainty.
Integrate political and economic risk assessment into corporate strategy setting. The political forces outlined above are unlikely to change in the foreseeable future which suggests a number of scenarios. Slow growth and low interest rates are likely to persist. The U.S. presidential election is unlikely to fundamentally change the country’s political climate for the better—indeed, it could lead to more disaffection, polarization, and gridlock. Uncertainty will increase in Europe with Brexit negotiations and national elections in France and Germany in 2017. Boards should pressure test macro-assumptions from management about the external environment affecting strategy over the next 12-24 months. What are the most important moving variables and how will they affect growth prospects?
Look for pockets of opportunity. Volatility creates opportunities as well as risks. Good governance and sound policies are differentiators between countries poised to sustain relatively stronger economic performance, and those that will continue face serious challenges in volatile markets. Watch for improving and more agile governance in Brazil, Columbia, Argentina, India, and Myanmar.
Evaluate the firm’s societal commitments.Proactive companies are seeking to address today’s societal challenges rather than just defend themselves from risks. There is a business case for promoting more inclusive growth: Work by International Monetary Fund researchers has shown that, around the world, higher levels of income inequality are correlated with slower growth. Higher wages support increased consumer spending and broader prosperity. On the other hand, failing to address inequality and other societal ills risks lowers productivity, and leads to more regulation, taxation, and labor radicalization.
NACD’s Global Board Leaders’ Summit, themed around the issue of convergence, will have dedicated sessions on global economic and political disruption, featuring subject-matter experts and seasoned directors. Review the Summit agenda to attend Peterson and others’ sessions addressing global disruption.