Novel Data UseYou Want To Do What With The Data?

Let’s talk.

May 7, 2020

2

Presenters

David Saunders is a partner and member of the firm’s Data Privacy and Cybersecurity Practice and its Complex Commercial Litigation Practice. Through the lens of a litigator, Mr. Saunders helps clients navigate their risks in the data privacy and cybersecurity arenas.

David Saunders

Heidi L. Wachs is a Vice President at Stroz Friedberg, where she helps clients solve complex data privacy and cybersecurity problems, including preparing for and responding to data breach and cybersecurity incidents and developing and implementing data privacy and information security programs.

Partner | Jenner & Block LLP

Heidi WachsVice President, Engagement Management | Stroz Friedberg

dsaunders@jenner.com | 312 923-8388

heidi.wachs@strozfriedberg.com | 202 464-5813

Scott Cowperthwait is a Vice President, Law – Privacy and Cybersecurity at Charter Communications. Mr. Cowperthwait leads the legal privacy and cybersecurity team, and advises the company on related legal and regulatory compliance matters, risk mitigation, and data incidents.

Scott CowperthwaitVice President, Law - Privacy and Cybersecurity | Charter Communications

Scott.Cowperthwait@charter.com | 203 705-0827

3

Overview

• Who are the stakeholders

• Legal and Ethical Considerations

• Operationalizing new uses

• Updating consumers

• Hypothetical: from online streaming to real world theme park

4

Stakeholders

ExecutivesEngineers/Product

Teams/ITBusiness/Sales Legal/Compliance

Buy-In and Understanding at All Levels

• Genesis• Informed• In agreement

• Design• Operationalize• Security

• Genesis• Communication

w/partners

• Can you do it• How must it

be done

5

Novel Data Use: Executives/Supervisors

• Identify new business pathways

• Evaluate how to monetize or use data differently

• Bring together all stakeholders

– Ensure that someone with sufficient authority can bring together all stakeholders

– Avoids confusion and potential issues down the line

• Referee disagreements

– Someone has to have final say

– Can be heated, know how to see the forest and not just the trees

But also

6

Novel Data Use: Engineers/IT

• Can it be done?

• Can it be done safely/securely?

– Critical to ask these questions up front

• Issue spot/identify risks

• Provide time frames

• Cost

– Internal v. external development

– How many hours?

– What else falls to the wayside?

7

Incident Response: Business/Sales

• Idea development– Often looking for ways to increase profits

• Communication with partners– Ensure honest and open communication. Engender trust.

• Be willing to understand why it is a bad idea

8

Incident Response: Legal/Compliance

• Three Key questions– Can we do it?

Is it legal?

– Should we do it?

What are the business risks

– What are the limitations on our doing it?

Consider compliance and security requirements

• Help find pathways to legality or shut it down– Be clear

– Communicate effectively

– Be prepared to be the hero or the villain

9

Legal and Ethical Considerations

• What does the law permit?

– Analyze all of your jurisdictions

– Do you need affirmative consent?

• Positions of regulators

– Do you need to be proactive?

• What did you say you were doing in your privacy policy?

– Evaluate whether you need to update your policy

– Do you need to do more than just post an updated policy on the web?

10

Legal and Ethical Considerations

• Should you do it?

– Is it legal?

– What will the PR response be?

– What is the value add to your business

– What is the social harm/good created by the use?

– What are others doing?

11

Legal and Ethical Considerations Cont.

Important to remain flexible – not all novel data use is bad

Illegal new use

Use within scope of existing privacy laws and disclosures

Not illegal, but would require new privacy disclosures

Not illegal, but potential negative PR

12

Operationalize a Process

• Flexibility and adaptability essential

– Not all novel use is bad

• Awareness of novel use approval process

– Develop process for obtaining approval

– Make sure stakeholders are involved

• Implement strong access controls over data

– Minimizes risk that someone acts outside of developed process

• Maintain good internal auditing/reporting trails

– Identify quickly if someone is doing something they should not be

13

Hypothetical 1

• You are an insurance company

• Insurers enroll in “safe driver” programs

– You collect, among other information, geolocation data

• Business personnel approach you and they say they want to start using geolocation data to see which insureds are visiting fast food restaurants and other locations

– Business says knowing where people are going could help adjust actuarial tables for life and health insurance

– Business also wants to deliver targeted advertising based on geolocation

What do you do?

14

Hypothetical 2

• You are multimedia company that owns both a theme park and a streaming service

• There are interactive features in your theme park, where visitors can scan their wristbands and receive content on screens

• Theme park business comes to you and says that they want viewing histories/records of visitors who also subscribe to streaming service

– Idea would be to provide personalized content to user while in theme park based on viewing habits on streaming platform

– Might want to take it a step farther that when the person scans into the theme park, they receive an audio greeting from a character on their most watched show/movie

– Currently, people enter the park using a finger scan.

What do you do?

15

Common Challenges & Issues

• Lack of engagement from all stakeholders

• Viewing legal as the “bad guy”

• Asking the hard “should we” questions.

• Reluctance to update privacy policies

• PR fallout

THANK YOU!