About this third edition, contributors and the author |
|
ix | |
Introduction |
|
xi | |
Key terms |
|
xiii | |
Key concepts |
|
xv | |
The field: data protection, privacy and security |
|
xv | |
The territory: Europe, U.S. and ROW |
|
xvii | |
The species: personal data, PI I and sensitive data |
|
xx | |
Activities encountered: transfers and other forms of processing |
|
xxiii | |
The observed: data controllers, processors |
|
xxiv | |
The game wardens: data protection authorities, officers |
|
xxv | |
|
|
|
1 Starting a compliance program |
|
|
1 | (27) |
|
|
1 | (2) |
|
Working with internal stakeholders and outside advisors |
|
|
3 | (1) |
|
Appointing a privacy officer |
|
|
4 | (7) |
|
|
11 | (16) |
|
|
27 | (1) |
|
2 International data transfers -- selecting compliance mechanisms |
|
|
28 | (31) |
|
|
30 | (5) |
|
Options to clear hurdle 3 -- prohibition of international transfers |
|
|
35 | (4) |
|
Compliance mechanisms compared |
|
|
39 | (12) |
|
|
51 | (5) |
|
Data transfers from other jurisdictions |
|
|
56 | (3) |
|
|
59 | (43) |
|
Why are you creating the document? |
|
|
59 | (3) |
|
|
62 | (2) |
|
Categories and examples of documentation |
|
|
64 | (4) |
|
|
68 | (10) |
|
|
78 | (2) |
|
How to obtain valid consent |
|
|
80 | (2) |
|
Opt-in, out and in between |
|
|
82 | (4) |
|
Above and beyond opt-in consent |
|
|
86 | (2) |
|
Other considerations for consent drafting |
|
|
88 | (2) |
|
|
90 | (6) |
|
|
96 | (1) |
|
Questionnaires and data submission forms |
|
|
97 | (1) |
|
Documenting decisions and compliance efforts |
|
|
98 | (1) |
|
Government notifications, approvals |
|
|
99 | (3) |
|
4 Maintaining and auditing compliance programs |
|
|
102 | (4) |
|
|
106 | (82) |
|
|
107 | (2) |
|
Brexit, GDPR, ePrivacy and Privacy Shield |
|
|
109 | (2) |
|
|
111 | (13) |
|
Data retention and residency requirements |
|
|
124 | (4) |
|
Employee data and monitoring |
|
|
128 | (11) |
|
|
139 | (1) |
|
Government investigations, information requests |
|
|
140 | (3) |
|
|
143 | (2) |
|
Internet of Everything, big data and data brokers |
|
|
145 | (3) |
|
|
148 | (3) |
|
|
151 | (1) |
|
|
152 | (1) |
|
|
153 | (1) |
|
Notification of data security breaches |
|
|
154 | (4) |
|
|
158 | (1) |
|
|
159 | (1) |
|
|
160 | (1) |
|
Rights, remedies, enforcement |
|
|
161 | (5) |
|
|
166 | (2) |
|
|
168 | (5) |
|
Unsolicited communications (spam email, cold calls, etc.) |
|
|
173 | (5) |
|
|
178 | (2) |
|
|
180 | (1) |
|
X-ray, genes, fingerprints, faces -- biometric data |
|
|
181 | (2) |
|
Y -- Why protect data privacy? |
|
|
183 | (3) |
|
ZIP codes, IP addresses and other numbers |
|
|
186 | (2) |
Checklist: Data privacy and security compliance program |
|
188 | (4) |
Resources |
|
192 | (2) |
Abbreviations |
|
194 | (3) |
Index |
|
197 | |