ISSA-LA May 17, 2023 In Person Dinner Meeting

Privacy Law Compliance and IT – The Critical Role of the Tech Staff and the Disconnects that Undermine Their Utility

Register: https://www.eventbrite.com/e/issa-la-may-17-dinner-meeting-tickets-607819794367

Speaker: Michael A. Gold, | Partner. Chair, Cybersecurity & Privacy Group
Jeffer Mangels Butler & Mitchell LLP

Michael A. Gold is a partner and Chair of the Cybersecurity & Privacy Group at Jeffer Mangels Butler & Mitchell LLP. He counsels clients in a wide variety of matters, including information security and privacy compliance, supply chain and outsourcing security issues, data breach responses and investigations, regulatory matters, crisis management, and technology contracts.

He has assisted clients in developing policies and processes to comply with information security and privacy laws throughout the world (including the E.U.’s General Data Protection Regulation, the California Consumer Privacy Act of 2018, and other national, state and industry-sectoral laws in the U.S.). He negotiates technology agreements relating to information security and privacy, and has particular experience with advanced digital advertising and marketing and emerging information security technologies. He represents clients in a range of industries, including healthcare, defense, major league sports, accounting and business management, and financial services.

Michael was named one of California’s “Top 20 Cyber – Artificial Intelligence Lawyers” by the Daily Journal (2018), one of the Daily Journal’s 20 “Top Cyber Lawyers” again in 2020, one of the “Most Influential Lawyers: Digital Media and E-Commerce Law” by the Los Angeles Business Journal, and has been designated a “Top Rated Lawyer in Technology Law” by Martindale Hubbell.

Topic: One of the major challenges in privacy law compliance is the lack of communication and integration between those in charge of compliance and the technical staffs tasked with managing networks and systems. All too often, privacy compliance leadership will conceive and develop the legal framework for compliance but overlook the need to make sure that the organization’s technology and technology staff can support the compliance framework.

This disconnect takes a variety of forms. For example – The privacy compliance team fails to consider that a high level of visibility is required for managing the privacy compliance program but has an incomplete understanding, if any, of what that means in the context of a complex and dynamic network. The privacy compliance framework imposes a significant and ongoing management and monitoring burden on the IT staff without considering the financial and human resources required to sustain the ongoing work. The privacy compliance team fails to engage with the IT staff in order to communicate both the scope of the ongoing compliance effort and the legal elements of the framework that require technical counterparts in order to operationalize the compliance program. The compliance team forgets that the IT staff are not lawyers and fails to communicate key privacy compliance plan elements in a way that allows the IT staff to play a proactive and reliable role in the compliance effort. The IT staff fails to tell the compliance team about changes to the network or systems that will impact the operation of the compliance framework.

Last, but not least, the compliance team and the IT staff speak different languages and neither group takes the time to understand the other in a way that will promote a cohesive compliance effort. Any one of these disconnects can undermine what might otherwise be an effective privacy law compliance framework. Taken as a whole, they virtually insure that an organization’s privacy compliance will not work optimally.

This program will discuss how these disconnects can be mitigated and examine approaches for effectively integrating the tech team into the privacy law compliance effort.