Ben Gerber

Integrated Data Privacy Professional (IDPP™) - OCEG https://lnkd.in/g-BfE-8i Ultimate Guide to Information Security & Continuity - OCEG https://lnkd.in/gH2F8kfy This eBook addresses the Information Security and Continuity discipline by presenting the fundamental components of an information security program, discussing good practice, and providing references to leading global sources of guidance and good practice information. Greg Hutchins #privacy #cybersecurity #riskmanagement #audit #leadership #data #management #infosec #it Carole Switzer

10

Data Protection Authority #DPA has notified the public release of the draft guidelines on Data Protection Management Program (DPMP) intended to be issued under Sec 12 (2) of the #PDPA. https://lnkd.in/gkmFn6WD Section 2 of the draft guidelines summarizes the key obligations of a controller under the PDPA, while Section 3 describes the internal controls and procedures enabling a controller to comply with the said obligations. The draft guidelines are intended to guide controllers in preparing their internal policy frameworks to meet “accountability requirements” under the PDPA. Acknowledging the expertise of Rory Macmillan, David Satola & Junko Narimatsu , the Leadership of Arjuna Herath & fellow #DPA Board Directors Shehan Wijetilaka Bimsara Seneviratne Dr.Sulakshana Jayawardena , Saumya Amerasekera PC & Nisith Abeysuriya and support from Legal Draftsman’s Dept, Waruna Sri Dhanapala, Sanduni Wickramasinghe Consultants at DPA and the enthusiastic stakeholders of #PDPA for their valuable insights. Documents Related to Personal Data Protection could be downloaded from https://lnkd.in/gm7iC7uw All stakeholders, the public, as well as organizations, are invited to review the draft guidelines and provide their valuable suggestions. Feedback open until 15th October 2024.

136

5 Comments

Latest from China, last week - China's National Cybersecurity Standardization Technical Committee (i.e. TC260) released the Guidelines for Identification of Sensitive Personal Information Issued by China's National Cybersecurity Standardization Technical Committee - effectively immediately. As always with TC260 guidance - they are not law, but they are in practice referenced regularly by regulators for best practice with respect to PIPL compliance - so we generally recommend clients carefully consider and comply with such guidance. Key takeaways to be considered when reviewing your data privacy policies / documents in China: * Various categories of commonly-seen sensitive PI are identified, including: biometric data, religious beliefs, medical and health information, financial accounts, whereabouts data and PI of children under 14 years old. * Biometric information's definition is clarified (compared to PIPL), and businesses are required to refer to other relevant national standards (GB/T35273, GB/T40660, GB/T41819, GB/T41807, GB/T41773, GB/T41806) when identifying what is sensitive PI. * Personal ID is not classified as sensitive PI - but personal ID photos are. * "Standard" health information (e.g. gender, weight, height, blood type, blood pressure, and lung capacity) are not sensitive PI (unless related to diagnosis or medical treatment). * IP addresses, travel records (including flight information and hotel stays), and web browser history are not sensitive PI. Continuously-gathered and precise geolocation data are sensitive PI. * Information relating to credit history, criminal record, sexuality and sex life remain sensitive PI (but marital history and race are not sensitive PI). * There are strict obligations imposed on companies collecting or processing sensitive PI, including: obtaining separate consent from data subjects, conducting impact assessments before any sharing of data and complying with various strict requirements re: cross-border transfer of sensitive PI. #china #dataprivacy #dataprotection #PIPL #digitaleconomy

10

1 Comment

Owners of .jp (dot jp) Domains: ⬬ The domain registration service most commonly used by English Speakers (and many Japanese owners of .jp websites/domains, JapanRegistry (dot) com domain registration service is closing on December 4th, 2024 ⭑ 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿𝘀 𝗻𝗲𝗲𝗱 𝘁𝗼 𝘁𝗿𝗮𝗻𝘀𝗳𝗲𝗿 𝘁𝗵𝗲𝗶𝗿 𝗱𝗼𝗺𝗮𝗶𝗻𝘀 𝘁𝗼 𝗮 𝗻𝗲𝘄 𝗿𝗲𝗴𝗶𝘀𝘁𝗿𝗮𝗿 𝗯𝘆 𝗗𝗲𝗰𝗲𝗺𝗯𝗲𝗿 𝟰𝘁𝗵, 𝟮𝟬𝟮𝟰! ⬅ KEY POINT ⬬ If not transferred by then, domains will be moved to a temporary Onamae (dot) com account (Japanese only service) ⬬ Note: there are important details about using Onamae (dot) com like types of payment methods and proxy services 𝗪𝗵𝗶𝗰𝗵 𝗱𝗼𝗺𝗮𝗶𝗻 𝗵𝗼𝘀𝘁 𝗮𝗿𝗲 𝘆𝗼𝘂 𝗴𝗼𝗶𝗻𝗴 𝘁𝗼 𝘂𝘀𝗲 𝗴𝗶𝘃𝗲𝗻 𝘁𝗵𝗶𝘀 𝗻𝗲𝘄𝘀 𝗳𝗿𝗼𝗺 𝗝𝗮𝗽𝗮𝗻𝗥𝗲𝗴𝗶𝘀𝘁𝗿𝘆 (𝗱𝗼𝘁) 𝗰𝗼𝗺? Any thoughts on choosing a new registrar for your domains? #japan #domain #businessinjapan #business

7

2 Comments

Jointly prepared by the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) 香港個人資料私隱專員公署, the ASTRI - Hong Kong Applied Science and Technology Research Institute, and The Government of the Hong Kong Special Administrative Region 香港特別行政區政府 the report titled “Artificial Intelligence: Model Personal Data Protection Framework” establishes a robust and adaptive framework for safeguarding #personaldata in AI-driven ecosystems. In response to the increasing integration of #artificialintelligence across industries, the framework emphasizes the principles of transparency, accountability, and fairness to mitigate the risks associated with AI deployments. The report offers a comprehensive structure designed to ensure compliance with #dataprotection regulations while fostering innovation. The framework’s core pillars address key challenges in AI governance, including the responsible use of personal data, bias mitigation, and the ethical design of algorithms. By advocating for a proactive approach, the report underscores the necessity of integrating privacy considerations into the AI lifecycle, from development to deployment and monitoring. Special attention is given to the importance of public-private collaboration in establishing harmonized standards that support cross-border data flows, thereby enabling global interoperability without compromising individual rights. The report also highlights the strategic role of stakeholder engagement and the education of AI developers, regulators, and users in advancing data privacy practices. In summary, the report encapsulates the growing imperative to balance technological innovation with ethical considerations and regulatory compliance. As #artificialintelligence reshapes the #globaleconomy and society, a meticulously designed data protection framework is critical to maintaining public trust and ensuring equitable outcomes. This collaborative effort positions #HongKong as a leader in AI governance, demonstrating the region’s commitment to safeguarding personal data while fostering a dynamic, innovation-driven economy. By providing actionable guidance, the framework sets a precedent for addressing the complexities of #AIdrivendataecosystems, ensuring resilience, adaptability, and accountability in an increasingly #digitalworld.

37

You may know about GDPR and PDPA. These are more based on specific country regulations and thus may not be applicable cross- border. The APEC Cross-Border Privacy Rules (CBPR) System was developed by APEC economies with input and assistance from industry and civil society to build consumer, business and regulator trust in cross border flows of personal information. The APEC CBPR System requires participating businesses to implement data privacy policies consistent with the APEC Privacy Framework. These policies and practices must be assessed as compliant with the program requirements of the APEC CBPR System by an Accountability Agent (an independent APEC CBPR system recognised public or private sector entity) and be enforceable by law.

3

💡 #CPC_Blog | Safeguarding Your Data with Comprehensive #Cybersecurity Strategies Another recent data breach involved a public institution in Hong Kong, where personal data stored on contractors' #cloud platforms was not deleted after the contract expired. The incident highlights the importance of choosing trustworthy and experienced cloud service providers. ​ This article will explore a range of ICT solutions, including high-quality cloud services, security measures for safeguarding cloud assets, and cybersecurity solutions. It aims to assist enterprises in protecting business #data and achieving high-quality business development. ​ 🔎Read the blog: https://lnkd.in/gwnZTe7g ​ #CITICTelecomCPC #GlobalLocal #ICTSolutionsPartner #InnovationNeverStops #cybersecurity #DigitalTransformation #Innovation #TrustCSI ​ #cyberthreats #AIDrive #ArtificialIntellegence #MSS #ManagedSecuritySerivce #DataLeak #CloudService

5

"OSCs must retain artifacts used as evidence for the assessment for the duration of the validity period of the certificate of assessment, and at minimum, for six years from the date of certification assessment as addressed in 32 CFR 170.17(c)(4). The OSC is responsible for compiling relevant artifacts as evidence and having knowledgeable personnel available during the assessment. The organizational artifacts are proprietary to the OSC and will not be retained by the assessment team unless expressly permitted by the OSC. To preserve the integrity of the artifacts reviewed, the OSC creates a hash of assessment evidence (to include a list of the artifact names, the return values of the hashing algorithm, and the hashing algorithm used) and retains the artifact information for six years. The information obtained from the artifacts is an information collection and is provided to the C3PAO for uploading into the CMMC instantiation of eMASS." The above text is from the DoD's June 21, 2024 submission to the Federal Register. It describes the expected information collection level-of-effort for a CMMC Level 2 assessment. Some more information: The DoD expects evidence collection and archival, assessment planning and results, C3PAO records about their assessment staff, and submission of data into CMMC eMASS to take 525 hours on average, per assessed company. This is just the effort related to paperwork. It doesn't cover the time spent interviewing or demonstrating the system. It doesn't cover the time preparing. Bottom line? The DoD seems 𝒅𝒆𝒕𝒆𝒓𝒎𝒊𝒏𝒆𝒅 to get their defense contractors cyber-secure, no matter the cost. They are treating this as seriously as the defenses for our key military and government installations, and looking at a timeline of just a few years to get our manufacturing and military support base resilient to cyber-attack. If you're ready to start working seriously on NIST SP 800-171 and #CMMC compliance, or want to get scheduled for your certification assessment, give my team at Kieri Solutions - Authorized C3PAO a call. We specialize in helping companies become compliant without outsourcing their control of IT to a third party. Read more about the DoD's submission below: https://lnkd.in/eTFi9dVK

51

47 Comments

Chapter 14 of the DrewTech Series on vulnerability disclosure programs is out! VDPs are a tool which organizations can use to combat the scourge of vulnerability exploitation by threat actors. But have you considered the legal issues? Many thanks to Ang Wei Shuen for his invaluable assistance with this article. #Drewtech #DrewNapier #techlawyers #disputes

23

Top 12 Activities in Case of a #CyberAttack At Alliance Pro we understand that a cyber attack can have devastating consequences for an organization, both financially and reputationally. Therefore, it is critical to have a well-defined incident response plan in place to mitigate the damage and recover quickly. Here are 12 essential activities to undertake in the event of a cyber attack, recommended by our Risk Officer BVJ : 1. Disconnect the compromised system from the network to prevent further damage. 2. Implement measures to contain the spread of the attack, such as disabling user accounts or blocking malicious traffic. 3. Inform key personnel, including executives, legal counsel, and IT staff, about the #incident. 4. Collect as much evidence as possible to aid in the #investigation and potential legal proceedings. 5. If necessary, bring in external experts to assist with the response and recovery efforts. 6. Notify customers, partners, and other stakeholders about the incident and the steps being taken to address it. 7. Develop and implement a #recovery plan to restore affected systems and data to their pre-incident state. 8. Assess the effectiveness of existing #security measures and identify areas for improvement. 9. Take steps to address the root cause of the attack and prevent future incidents. 10. Analyze the incident to identify lessons learned and improve the organization's security posture. 11. Revise the incident response plan based on the insights gained from the incident. 12. Consult with legal counsel to understand the #legal implications of the cyber attack and to protect the organization's interests.

16

Clause 4 of ISO 42001 is fundamental for organizations aiming to establish an effective AI management system. For a better understanding of why, please see below. Understanding the Organization and Its Context (Clause 4.1): ✅Intent: Emphasizes the need for organizations to identify both internal and external issues that could impact their AI management system, which forms the foundation for aligning AI strategies with business objectives and mitigating potential risks. ✅Importance: You must recognize these factors to ensure that AI initiatives are relevant and effective, considering the specific environment in which the organization operates. Understanding the Needs and Expectations of Interested Parties (Clause 4.2): ✅Intent: Organizations must identify stakeholders (e.g., customers, regulators, employees) and understand their requirements and expectations. ✅Importance: You should address stakeholder concerns to enhance trust and ensure that AI systems meet legal, ethical, and societal expectations, fostering better relationships and compliance. Determining the Scope of the AI Management System (Clause 4.3): ✅Intent: This involves defining the boundaries and applicability of the AI management system within the organization. ✅Importance: You must clearly define the scope to ensure focused efforts on relevant AI applications, improving efficiency and effectiveness in managing AI-related activities. Establishing the AI Management System (Clause 4.4): ✅Intent: Organizations are required to develop, implement, maintain, and continuously improve an AI management system tailored to their context and needs. ✅Importance: You should establish a robust management system to ensure consistent performance, continual improvement, and alignment with strategic goals, enhancing the organization’s ability to leverage AI responsibly and effectively. How to Comply 1. Conduct a Comprehensive Context Analysis: ✅Identify and document external factors such as market trends, regulatory requirements, and technological advancements. ✅Assess internal factors like organizational culture, structure, and existing processes. 2. Engage with Stakeholders: ✅Conduct regular consultations with stakeholders to gather insights into their needs and expectations. ✅Incorporate stakeholder feedback into the AI management system to ensure it addresses relevant concerns and requirements. 3. Define the Scope Clearly: ✅Outline which parts of the organization and which AI applications are included within the AI management system. ✅Ensure the scope is well-documented and communicated across the organization. 4. Develop a Tailored AI Management System: ✅Establish policies, procedures, and controls that align with the identified context and stakeholder needs. ✅Regularly review and update the AI management system to adapt to changing conditions and new insights. For help getting started, please reach out! #AI #ISO42001 #TheBusinessofCompliance #ComplianceAlignedtoYou A-LIGN

10

1 Comment

📊 According to Taiwan's Administration for Cyber Security Ministry of Digital Affairs August 2024 cybersecurity report, information collection constitutes 38% of identifiable threats faced by government agencies. This figure underscores the critical need for organizations to implement robust defenses against social engineering attacks, which are becoming increasingly sophisticated in their methods of extracting sensitive data. As cybercriminals evolve, adopting a proactive approach to cybersecurity is essential for safeguarding sensitive information and maintaining public trust. Read the full report: https://lnkd.in/g7RgX3CN And subscribe (for FREE) to CyberSec Taiwan's Substack newsletter for updates on all the latest Taiwan cybersecurity news and topics: https://lnkd.in/gdA5G6g9 #Taiwan #cybersecurity #infosec #cyberdefense #cyberthreats #cyberattacks #cyber

4

Cybersecurity is a team sport with expertise and experience sharing coming from multiple sides. My co-author Mae Chow and I explore how Japan and ASEAN can strengthen their collective #digitaldefence by adopting a two-way (as opposed to one-way) and inclusive approach to #cybersecurity. Industry reports and performance indices indicate that levels of cyber competence and capabilities vary across individual AMS. Certain AMS, for example, outperform their neighbours (including Singapore) and Japan in cyber incident response capabilities, including specialised national-level cyber incident detection and response units as well as in protecting essential services against cyber threats. By facilitating a united front on cybersecurity issues and leveraging each other's strengths, a cohesive response to cyberattacks can be fostered, thereby promoting a safer, rules-based international order in the Indo-Pacific.

19

After reading the “Network Data Security Management Measures,” here are my personal reflections on China’s Data Protection Authority and future regulatory directions. Just Personal Thought！ Throughout this regulation, it is clear that the Cyberspace Administration of China (CAC) is no longer the primary regulatory body but has instead become a coordinating body, while the responsibility now lies with the industrial competent department. Since the enactment of the PIPL - China Privacy Law，the issue of fragmented regulation in China has not been resolved. However, the CAC has played a leading role in many areas, such as the one we are most familiar with—cross-border data transfers. But over the past two years, the CAC has realized that with its current resources, it is not feasible for them to assume the role of the primary data protection regulatory body. The international community’s lack of trust in China regarding data security and privacy protection stems, in part, from a lack of confidence in China’s data protection regulatory environment. This includes the fact that China’s DPA is not independent from the government. Previously, the “DPA” was the CAC. Because it wasn’t independent and had to handle many other tasks beyond data protection, there was a shortage of resources, and it has now taken a step down. Moving forward, the DPA will be the competent department in each industry. However, this still does not resolve the issue of independence or the lack of resources. It could also lead to problems in cross-sectoral coordination and collaboration. The core issue of independence doesn’t need further elaboration. It is true that industry regulators understand their respective fields better than the CAC, but does this mean every industry regulator will now have to establish its own data protection office? How will the coordination and consultation mechanisms between the data protection offices of different regulators be established? How will they recruit talent that both understands the industry and knows data protection? Resource shortages remain an inevitable issue. On the positive side, the authorities have recognized that large internet platforms are highly prone to infringing and abusing citizens’ personal privacy. They have developed management rules for large platforms, which are said to be a regulatory focus in the coming years. From my personal perspective, this is a good development. Chinese citizens are deeply intertwined with large internet platforms, but frequent permission requests, data selling and leaks, and the inability to opt-out of ads and personalized settings are issues that still haven’t been resolved, even nearly three years after the enactment of the PIPL. Large internet platforms only keep updating their overly complex and redundant privacy policies, but in practice, they don’t care about the rights of individuals or about privacy by design. #Privacy #China #cybersecurity Luis Alberto Montezuma

30

2 Comments