About this second edition, contributors and the author |
|
x | |
Key terms |
|
xii | |
How to use this Field Guide |
|
1 | (3) |
|
|
4 | (10) |
|
1.1 The field: data protection, privacy and security |
|
|
4 | (2) |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
1.1.4 Data privacy as an umbrella term |
|
|
6 | (1) |
|
1.2 The territory: Europe, United States and ROW |
|
|
6 | (1) |
|
1.3 The species: personal data, PII and sensitive data |
|
|
7 | (3) |
|
|
8 | (1) |
|
1.3.2 Personally identifiable information (PII) |
|
|
9 | (1) |
|
|
9 | (1) |
|
1.4 Activities encountered: transfers and other forms of processing |
|
|
10 | (2) |
|
1.5 The observed: data controllers, processors |
|
|
12 | (1) |
|
1.6 The game wardens: data protection authorities, officers |
|
|
13 | (1) |
|
2 Starting a compliance program |
|
|
14 | (26) |
|
|
14 | (2) |
|
2.2 Working with internal stakeholders and outside advisors |
|
|
16 | (1) |
|
2.2.1 Internal stakeholders |
|
|
16 | (1) |
|
|
16 | (1) |
|
2.3 Appointing a privacy officer |
|
|
17 | (6) |
|
2.3.1 Requirement to appoint a data protection officer under German law |
|
|
18 | (3) |
|
2.3.2 Mandatory or beneficial appointments in other jurisdictions |
|
|
21 | (2) |
|
2.4 Preparing a task list |
|
|
23 | (15) |
|
2.4.1 Take inventory of your data |
|
|
26 | (1) |
|
2.4.2 Define your objective and priorities |
|
|
26 | (1) |
|
2.4.3 Find the best approach for your company |
|
|
27 | (2) |
|
2.4.4 Identify legal and other requirements |
|
|
29 | (2) |
|
2.4.5 Data privacy by region -- an overview for orientation purposes |
|
|
31 | (3) |
|
2.4.6 What other laws and requirements have to be considered? |
|
|
34 | (1) |
|
2.4.7 Identify applicable substantive compliance requirements |
|
|
34 | (3) |
|
2.4.8 Identify applicable formal compliance requirements |
|
|
37 | (1) |
|
|
38 | (2) |
|
3 International data transfers |
|
|
40 | (28) |
|
|
42 | (6) |
|
3.2 Compliance mechanisms compared |
|
|
48 | (10) |
|
3.2.1 Consent and contracts can offer flexibilities |
|
|
48 | (1) |
|
3.2.2 Geographical and topical coverage of data and transfers |
|
|
49 | (1) |
|
3.2.3 Implementation costs and timing |
|
|
50 | (1) |
|
3.2.4 Ongoing administration |
|
|
51 | (1) |
|
|
52 | (2) |
|
3.2.6 Submission to European law and jurisdiction |
|
|
54 | (1) |
|
3.2.7 Customer and public relations benefits |
|
|
55 | (3) |
|
|
58 | (8) |
|
3.3.1 Statutory, contractual transfer obligations |
|
|
58 | (3) |
|
|
61 | (1) |
|
3.3.3 Data transfers based on standard contractual clauses |
|
|
61 | (2) |
|
3.3.4 Safe Harbor Certification |
|
|
63 | (2) |
|
3.3.5 Binding Corporate Rules |
|
|
65 | (1) |
|
3.4 Data transfers from countries outside the EEA |
|
|
66 | (2) |
|
|
68 | (42) |
|
4.1 Why are you creating the document? |
|
|
68 | (3) |
|
|
69 | (1) |
|
|
70 | (1) |
|
4.1.3 Organizational purposes |
|
|
71 | (1) |
|
4.2 Who is your audience? |
|
|
71 | (2) |
|
4.3 Categories and examples of documentation |
|
|
73 | (2) |
|
4.3.1 Other labels, e.g., policies |
|
|
74 | (1) |
|
|
75 | (10) |
|
4.4.1 To whom do you have to issue notices? |
|
|
78 | (1) |
|
4.4.2 Who should issue notices -- service provider or customer? |
|
|
78 | (1) |
|
4.4.3 Which topics do you typically have to address in privacy notices? |
|
|
79 | (5) |
|
4.4.4 Form and delivery requirements |
|
|
84 | (1) |
|
|
85 | (3) |
|
4.6 How to obtain valid consent |
|
|
88 | (2) |
|
4.7 Opt-in, out and in between |
|
|
90 | (4) |
|
4.7.1 Examples of consent mechanisms |
|
|
90 | (2) |
|
4.7.2 Minimum requirements |
|
|
92 | (1) |
|
4.7.3 Selecting implementation options |
|
|
92 | (1) |
|
|
92 | (1) |
|
4.7.5 Affirmative, express consent |
|
|
93 | (1) |
|
4.8 Above and beyond opt-in consent |
|
|
94 | (1) |
|
4.9 Other considerations for consent drafting |
|
|
95 | (3) |
|
4.9.1 Incorporation of notices into consent declarations |
|
|
95 | (1) |
|
4.9.2 Expressing focused consent |
|
|
96 | (1) |
|
4.9.3 Placement of consent mechanism and declaration |
|
|
97 | (1) |
|
4.9.4 Who should obtain consent -- data controller or processor? |
|
|
97 | (1) |
|
|
98 | (6) |
|
4.10.1 Agreements with data subjects vs. consent from data subjects |
|
|
98 | (1) |
|
4.10.2 Asking for an express acceptance of website privacy statements or general privacy notices |
|
|
98 | (2) |
|
4.10.3 Agreements instead of consent |
|
|
100 | (1) |
|
4.10.4 Commercial agreements between companies |
|
|
100 | (2) |
|
4.10.5 Terms for data processing services agreements |
|
|
102 | (2) |
|
|
104 | (1) |
|
4.12 Questionnaires and data submission forms |
|
|
105 | (1) |
|
4.13 Documenting decisions and compliance efforts |
|
|
106 | (1) |
|
4.14 Government notifications, approvals |
|
|
107 | (3) |
|
5 Maintaining and auditing data privacy compliance programs |
|
|
110 | (5) |
|
5.1 The maintenance challenge |
|
|
110 | (1) |
|
|
110 | (1) |
|
5.3 Taking over or auditing an existing compliance program |
|
|
110 | (2) |
|
5.4 Due diligence in M&A scenarios |
|
|
112 | (3) |
|
5.4.1 Due diligence on service providers and vendors |
|
|
113 | (2) |
|
|
115 | (86) |
|
|
116 | (2) |
|
Big data, data brokers and the Internet of everything |
|
|
118 | (2) |
|
|
120 | (14) |
|
|
134 | (4) |
|
Employee data and monitoring |
|
|
138 | (12) |
|
|
150 | (1) |
|
Government investigations, information requests |
|
|
151 | (3) |
|
|
154 | (2) |
|
Information processing fairness -- FIPs |
|
|
156 | (2) |
|
|
158 | (3) |
|
|
161 | (1) |
|
|
162 | (1) |
|
|
163 | (1) |
|
Notification of data security breaches and other notices and notifications |
|
|
164 | (5) |
|
|
169 | (1) |
|
|
170 | (1) |
|
|
171 | (1) |
|
Rights, remedies, enforcement |
|
|
172 | (5) |
|
|
177 | (2) |
|
|
179 | (5) |
|
Unsolicited communications (spam email, cold calls, etc.) |
|
|
184 | (6) |
|
|
190 | (2) |
|
|
192 | (1) |
|
X-rays, genes, fingerprints, faces -- biometric data |
|
|
193 | (2) |
|
Y -- Why protect data privacy? |
|
|
195 | (3) |
|
Zip codes, IP addresses and other numbers |
|
|
198 | (3) |
Checklist |
|
201 | (4) |
Resources |
|
205 | (2) |
Abbreviations |
|
207 | (4) |
Index |
|
211 | |