Privacy Compliance: Privacy Breach
Organizations that experience a privacy breach are expected to follow the federal and/or the provincial Commissioners' offices guidelines for breach response. These guidelines help organizations assess the privacy breach and take remedial actions. A privacy breach is a violation of all of the 23 privacy laws in Canada, which mandate organizations to:
- have adequate safeguards in place to avoid a breach and
- ensure no unauthorized access and disclosures of personal information without consent.
Breach guidelines include reporting the breach to the Commissioners' offices and providing notification to the potentially affected individuals, under certain circumstances.
Privacy Commissioners' offices are required to investigate known privacy breaches whether they are reported by the organization, discovered through a media report, by an affected individual or they are informed by an employee at the organization. The Commissioners' investigation assesses the organization's response to the breach against the published guidelines and industry best-practices, including those established by organizations that provide breach insurance.
Privacy laws are changing
It is expected that many of the federal and provincial private-sector privacy laws will be amended in 2009 to include breach notification provisions for notifying affected individuals plus requirements for reporting the breach to the privacy Commissioners office, in certain circumstances. These new requirements are being driven by consumer protection concerns to help eliminate the possibility of identity theft. Once amendments are made to these privacy laws, the guidelines will be of increased importance to help organizations respond to a breach.
The most recent privacy law in Canada, Ontario's Personal Health Information Protection Act, 2004 (PHIPA) already has mandatory breach notification requirements.
Canadian organizations with operations in the USA will likely be quite familiar with the challenges of breach notification as there are now 45 state breach notification laws. In the USA there is now a second wave of legislative requirements as states are now creating security laws to compliment the breach notification laws. |
|
Privacy Breach
A privacy breach is the result of an unauthorized access to, or collection, use or disclosure of personal information.
Privacy Breach Guidelines
Federal Privacy Commissioners Office:
Privacy and Your Business
Privacy Breach Handbook
British Columbia Privacy Commissioners Office:
Key Steps in Responding to Privacy breaches
Ontario Privacy Commissioners Office:
What to do When Faced With a Privacy Breach: Guidelines for the Health Sector
|
Privacy Review: ERIS Privacy Breach Insurance
Executive Risk Insurance Services (ERIS) provides privacy breach insurance to help organizations cover the liabilities and direct costs of a privacy breach thus ensuring the organization can afford to take all the necessary steps to respond to a breach. Responding to a breach, as dictated by Privacy Commissioners' guidelines can be costly; a cost that many organizations could struggle to meet without breach insurance.
ERIS Privacy Breach Insurance helps ensure organizations respond appropriately and are onside with the Commissioners' offices expectations and with the legal requirements in privacy laws.
ERIS Privacy Breach Insurance covers:
- Crisis management and notification expenses
The policy covers expenses incurred in attempting to mitigate reputational damage as a result of a privacy breach, including retention of public relation firms and crisis management costs such as: - call centre and Web site expenses to handle inquiries from employees or customers
- credit monitoring and
- costs involved in notifying customers or employees whose data has been compromised.
- Privacy liability
The policy covers third-party damages and claim expenses that arise out of a breach of a right to privacy, or unauthorized access to, collection of, and use or disclosure of personal information and that results in harm to employees or third parties. This would include losses arising from intentional hacking by rogue employees or third parties, or by negligence. The personal information may be in any format, including paper. The coverage usually includes amounts the insured is legally obligated to pay as a result of the breach, including defense expenses as a result of a regulatory or criminal investigation or prosecution.
- Network security liability
The policy will provide coverage for third-party damages and defense expenses that arise from a failure of an insured’s computer system. Such losses typically referred to as contingent business interruption losses, which are caused downstream by network outages or the transmission of malicious codes or viruses from the insured to a third party (such as a service provider).
ERIS Privacy Breach Insurance gives organizations the insurance protection to ensure privacy breaches are managed in compliance with privacy laws and that they effectively implement best-practices for breach response. With this insurance, handling the breach is not a matter of managing costs, as costs are covered. Breach insurance enables the organization to respond appropriately to best protect the individuals affected and the organization's reputation.
Having ERIS Privacy Breach Insurance demonstrates to the Privacy Commissioners and to business partners that the organization takes privacy breaches seriously having invested heavily in breach elimination and have taken precaution should a breach occur.
ERIS Privacy ROI
To calculate the privacy return on investment (Privacy ROI) an organization needs to consider costs and likelihood of a breach. The costs can be estimated by using 'Calculating the Cost of a Privacy Breach' section on this page or by using industry experts estimations. According to a Ponemon study the average cost of a breach is $237 per record.
The likelihood of a breach can be calculated by conducting a full privacy self-assessment or by making estimates based on the following factors: - number of employees
- locations of employees
- number of customers
- quantity of sensitive information collected
- quantity of data transfers
- location of the data (countries)
- quality of the safeguards in place to protect the personal information
- retention periods
- media in which the information is stored
- number of audits/self-assessments conducted
- quantity and quality of 3rd parties processing the data
- maturity of privacy management programs, including the quality of:
- data handling policies and procedures
- employee training
- privacy self-assessments and audits
- incident tracking and investigation programs
- breach response protocol
- data retention and destruction programs and
- data leakage protection programs.
Privacy ROI is only one component of the total ROI available from ERIS Privacy Breach Insurance. To calculate the total ROI it is best to contact an ERIS advisory.
Next Steps Download a detailed paper on Privacy Breach Insurance and visit www.execurisk.com. |
|
 Calculating the Cost of a Privacy Breach
This section helps organizations assess the costs of a privacy breach.
First-Party/Direct Damages to Business
Losses that a company may incur as a result of harm to itself sustained from a breach include those related to:
- A Response Plan
- Discovery/detection: costs associated with the detection or discovery of the breach
- Reporting: costs incurred in reporting the breach to all appropriate internal and regulatory personnel/bodies
- Notification: costs incurred by the company to notify affected individuals with a letter, telephone call, email, or general notice that personal information was lost or stolen.
- Mitigation/Crisis Management: costs to help victims of the breach obtain information as to how to respond to the breach and minimize harm, including:
- credit report monitoring
- reissuance of new cards or accounts
- call centre and Web site to register complaints, provide information, and monitor activity
- public relations.
- Restoration/Reconstruction:
- costs to restore lost or damaged information, including damaged IT systems;
- changes to internal processes.
- Decline in Revenue: lost business related to loss of trust and confidence by customers, negative reputational effects, and any interruption to business services.
Third-Party Liability
Losses that a company may incur as a result of harm to individuals or entities include the following:
- Compensation to clients or employees for general damages and out-of-pocket costs such as:
- loss from bank or credit card accounts
- general damages for inconvenience and violation of privacy rights
- economic loss arising from time off work spent dealing with the incident
- compensatory damages for emotional harm, humiliation, or embarrassment
- costs incurred in gathering information about breached data
- funds expended in protecting personal information such as changing credit and debit accounts
- cards and personal identifiers (such as Social Insurance Numbers), monitoring bank
accounts, and credit card statements.
- Contractual fines/penalties: payment of fines and penalties arising out of a breach of contractually imposed industry-specific privacy standards, such as the Payment Card Industry Data Security Standard.
- Subrogation: compensation to third parties such as downstream businesses or credit card companies that incur losses associated with a breach, including issuing new cards and paying fraud expenses associated with compromised cards, and then claiming reimbursement from the company sustaining the breach.
- Defense: any legal costs incurred in responding to complaints and litigation, including class actions.
Regulatory/Law Enforcement Costs
Companies can expect to sustain losses associated with Canadian regulatory and other law enforcement agencies in connection with an actual or potential privacy breach including: - Canadian Privacy Commissioner: costs associated with self-reporting breaches, responding to complaints, and defending investigations and proceedings before the commissioner, including:
- legal defense costs
- compliance with regulator’s recommendations—including improvement to safety practices and retention of a third-party auditor.
- Federal Court: costs of proceedings associated with appeal of privacy commissioner’s findings, including damage awards for humiliation (with no cap on damage amount), fines, and penalties.
- Criminal Code of Canada:13 costs of defending criminal prosecutions, including legal costs, penal sanctions, and restitution awards.
|