Schedule 2016

Pre-Conference Day: Monday, October 24, 2016
Day 1: Tuesday, October 25, 2016
Day 2: Wednesday, October 26, 2016

Oct 24

7:30am-9:00am	Breakfast
9:00am-10:15am	Session 1
10:15am-10:45am	Break
10:45am-12:00pm	Session 2
12:00pm-1:30pm	Lunch
1:30pm-2:45pm	Session 3
2:45pm 3:15pm	Break
3:15pm-4:30pm	Session 4

Oct 25-26

7:30am-8:50am	Breakfast
8:50am-10:00am	Session 1
10:00am-10:20am	Break
10:20am-11:30am	Session 2
11:30am-12:50pm	Lunch
12:50pm-2:00pm	Session 3
2:00pm-2:10pm	Break
2:10pm-3:20pm	Session 4
3:20pm-3:50pm	Break
3:50pm-5:00pm	Session 5
5:00pm-6:00pm	Reception on Oct. 25 only

Level 1

Rigorous session not requiring a lot of background knowledge.

Level 2

Advanced session requiring background knowledge.

Level 3

Advanced and highly-focused session requiring deep background knowledge.

Workshops

Workshops provide a broad overview or a more intensive background on a topic. Workshops are 2.5 hours long. Workshops will be held on Monday, Oct. 24, 2016. There are two workshop time slots, one in the morning and one in the afternoon, so participants can take up to two workshops. Workshops require the payment of an additional fee.

Intensive Days

Intensive Days are all-day events on Monday, Oct. 24, 2016, that feature primarily small discussion groups among seasoned professionals. Intensive Days differ from workshops in that workshops are shorter and more introductory in nature. Intensive Days are for seasoned professionals, and the discussion will be focused and advanced. Intensive Days are for deep dives into topics. Intensive Days require the payment of an additional fee.

Main Event Sessions

Main event sessions are held on Tuesday, Oct. 25 and Wednesday, Oct. 26, 2016. They are 1 hour and 10 minutes long. All main event sessions are included in the main event registration fee.

Intensive Day:

Health Privacy + Security

The Health Privacy and Security Intensive Day is a way to join your peers in a sophisticated series of discussions about cutting-edge issues involving privacy and security. There will be unparalleled interactivity. Most of the day will be spent in seminar-style discussion groups. This day-long event is chaired by:

Jennifer Archie, Partner, Latham & Watkins
Heather Egan Sussman, Partner, Ropes & Gray
Adam Greene, Partner, Davis Wright Tremaine

Health Privacy + Security

Intensive Day:

EU Privacy

The EU Privacy Intensive Day is a way to join your peers in a sophisticated series of discussions about cutting-edge issues involving EU privacy. There will be unparalleled interactivity. Most of the day will be spent in seminar-style discussion groups. This day-long event is chaired by:

John Bowman, Senior Principal, Promontory
Jan Dhont, Partner, Alston & Bird
Francoise Gilbert, Shareholder, Greenberg Traurig

EU Privacy

Intensive Day:

Data Security

The Data Security Intensive Day is a way to join fellow privacy and security lawyers in a series of discussions about cutting-edge issues involving data security. There will be unparalleled interactivity. Most of the day will be spent in seminar-style discussion groups exploring new threats, new laws, and new challenges. This is a discussion for experienced professionals in either privacy or security. A technical background isn’t required. Lawyers, CPOs, CISOs, and others are welcome. This day-long event is chaired by:

James Aquilina, Stroz Friedberg
Scott Weber, Stroz Friedberg
Tony Kim, Orrick

Data Security

Workshops

Expand all

+ Privacy Compliance in the Cloud

Privacy Compliance in the Cloud

Learn from a case study about how to move a company into the Cloud in compliance with privacy laws. This workshop will provide a deep dive into cloud technologies and services; regulation of cloud data, and the pluses and minuses of different clauses taken from actual cloud contracts.

Christopher Millard, Professor, Queen Mary University of London
Mark Watts, Partner, Bristows (UK)
Tom Bell, Partner, Perkins Coie, Seattle

Room 307

(more…)

+ Digital Advertising Regulation in a Changing World

Digital Advertising Regulation in a Changing World

This workshop examines the law and self-regulation that governs digital advertising. Today, people use the Internet with many different devices, and the number of points at which people connect online will likely increase with the burgeoning Internet of Things. Increasing pressure is being put on the opt-out system. What does the digital advertising system look like? How does it work? What new challenges are emerging? How do companies comply with global regulation?

Reed Freeman, Partner, WilmerHale
Heather Zachary, Partner, WilmerHale
Noga Rosenthal, Chief Privacy Officer, Epsilon
Lorrie Cranor, Professor of Computer Science & Engineering, Carnegie Mellon University
Jurgen Van Staden, VP for Policy and Technology, Network Advertising Initiative

Room 301 (more…)

+ Assessing Risks and Cyber Insurance Needs

Assessing Risks and Cyber Insurance Needs

This workshop will involve a “hands on” exercise involving assessing privacy and security risks and then assessing cyber insurance needs. Participants will learn the types of terms that should be focused on for an organization’s needs, and how to understand those terms.. Participants will also learn how cyber insurance would likely respond to various breach scenarios and how to maximize coverage through the choice of different terms and/or insurance limits.

Keith Fricke, Principal Consultant, tw-Security
Kimberly Holmes, Senior Vice President and Counsel, Cyber Insurance, Liability and
Emerging Risks, ID Experts
Sean Hoar, Partner, Davis Wright Tremaine LLP

Room 301

(more…)

+ Understanding the FTC on Privacy and Data Security

Understanding the FTC on Privacy and Data Security

This workshop will provide an in depth introduction to the FTC, examining how the FTC works, its various areas of jurisdiction, and its extensive body of consent decrees.

Timothy Tobin, Partner, Hogan Lovells
Jennifer Couture, Director, Privacy Risk Management and Compliance Leader, Legal Compliance, Royal Philips
Jamie Hine, Senior Attorney, Division of Privacy and Identity Protection, Federal Trade Commission

Room 307
(more…)

+ Information Privacy Law: Foundations

Information Privacy Law: Foundations

This workshop will provide a short overview of information privacy law, demonstrating how various areas such as health privacy, consumer privacy, communications privacy, financial privacy, and data security are related. For privacy professionals, this is a great way to understand the whole field and fill gaps in your knowledge. For security professionals, this is a great introduction to information privacy law.

Daniel Solove, Professor at George Washington University Law School and President/CEO of TeachPrivacy

Room 308 (more…)

+ Data Security Law: Foundations

Data Security Law: Foundations

An overview of data security law – from HIPAA to GLBA to the FTC to Massachusetts to data breach notification. Learn about the different approaches that laws and regulations take to data security and the similarities and differences in each approach.

Domenic DiLullo, ISSO, Policy, Security, Privacy and Governance, U.S. Department of State
Tom Smedinghoff, Of Counsel, Locke Lord LLP
Pedro Allende, Associate, Boies, Schiller & Flexner LLP

Room 308
(more…)

Sessions

Advertising & Marketing Privacy & Security (2016)

Expand all

+ Native Advertising

Native Advertising

Session Level: 201 (2016)

Privacy lawyers increasingly advise on the regulation of Native Advertising, a growing segment of marketing. There are overlaps between privacy and native advertising. There are also important differences. This session will discuss what regulators expect of advertisers and publishers in the native advertising space, examine the role of the FTC and other regulators, and identify areas of native advertising regulation where clients must be especially careful.

Meredith Halama, Senior Counsel, Perkins Coie
Mary Engle, Associate Director, FTC, Division of Advertising Practices
Shane Wiley, VP, Privacy & Data Governance, Yahoo!

Room 309 (more…)

+ The Internet’s Digital Advertising Architecture: From Cookies to Addressable TV and the privacy issues in between

The Internet’s Digital Advertising Architecture: From Cookies to Addressable TV and the privacy issues in between

Session Level: 201 (2016)

As digital marketing has grown–with over $40 Billion annually spent in the US–the invisible plumbing which powers digital advertising has grown increasingly complex. This session will break down this architecture into an easy to understand, non-technical overview and will also discuss how it may change in the coming years, and what opportunities and risks that evolution entails.

Todd Ruback, Chief Privacy & Security Officer and V.P. Legal Affairs, Ghostery
Justine Gottshall, Partner, InfoLawGroup
Andy Dale, Senior Counsel & Data Protection Officer, DataXu, Inc.

Room 309 (more…)

+ Privacy Implications of Retail Tracking

Privacy Implications of Retail Tracking

Session Level: 201 (2016)

This session will examine current and emerging technologies for tracking consumers physically at or near retail and the privacy implications and best practices related thereto. The session will focus on stereo video, thermal imaging, wif-fi tracking, beacons, infrared beams, spatial imaging, mobile app geolocation tracking and targeting, facial recognition and other biometric technology, heat mapping, and other tools and techniques, their potential value to retailers and customers and the privacy and security impacts and considerations.

Alan Friel, Partner, BakerHostetler
Kevin Moriarty, Attorney, Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission

Room 310 (more…)

+ Trust and Transparency in the Online Advertising Ecosystem

Trust and Transparency in the Online Advertising Ecosystem

Session Level: 101 (2016)

Most discussions of privacy and the online advertising ecosystem focus on legal and self-regulatory compliance. This session will be different. We’re going to focus on trust — what it means and how advertising practices affect it. We’ll consider trust from the perspectives of the full range of ecosystem participants: publishers, advertisers, ad tech providers, and, of course, consumers. We’ll share research, anecdotes, and examples of the ways in which businesses have built — and lost — trust. And we’ll show that compliance is just the first step in participating effectively in the ecosystem.

Steve Satterfield, Manager, Privacy & Public Policy, Facebook
Liza Boles, Facebook
Genie Barton, Vice President and Director, Online Interest-Based Advertising Accountability Program & Mobile Marketing Initiatives, Council of Better Business Bureaus, Inc.

Room 404-404

(more…)

+ Digital Advertising Self-Regulation: A Comparison of Approaches

Digital Advertising Self-Regulation: A Comparison of Approaches

Session Level: 201 (2016)

This session will focus on how various self-regulatory and trade associations handle emerging and evolving technologies in the ad tech space. New technologies such as addressable TV or wearables are revolutionizing the way consumers interact with products, and significantly changing, and expanding, data collected through their use. The session would bring together trade associations and self-regulatory organizations in the digital advertising space, to explain and contrast their differing approaches to emerging technology, and to explain how the trade associations collaborate on tackling the hottest issues in privacy and compliance (e.g., how technical standards can be announced by one organization, but be adopted in the code of conduct for another, or how the associations join forces to address challenges to the industry, like ad blocking).

Leigh Freund, President & Chief Executive Officer, Network Advertising Initiative
Gary Kibel, Partner, Davis & Gilbert LLP
Rachel Glasser, Partner, Director of Privacy and Partner Activation, GroupM

Room 309

(more…)

+ Tracking and Targeting: Online, on Mobile Devices, and in Social Media

Tracking and Targeting: Online, on Mobile Devices, and in Social Media

Session Level: 301 (2016)

This session will focus on legal and self-regulatory compliance challenges faced by companies whose business models focus on tracking and targeting advertisements and content to consumers. It will explore different tracking and targeting business models and the thorny legal issues that they sometimes raise.

D. Reed Freeman, Partner, WilmerHale
Heather Zachary, Partner, WilmerHale
Will DeVries, Privacy Counsel, Google Inc.

Room 309

(more…)

Big Data (2016)

Expand all

+ Data Monetization

Data Monetization

Session Level: 201 (2016)

Data monetization initiatives can provide businesses with the potential to generate new revenue streams from existing assets and infrastructure. These efforts bring significant opportunities as well as risks. This session examines practical approaches from the perspective of the privacy professional advising the business, with a focus on data ownership and rights, consumer relations, data security, and privacy compliance.

David Keating, Partner, Alston & Bird LLP
Anwesa Paul, Vice President & Senior Counsel, Privacy, American Express
Aaron Burstein, Partner, Wilkinson Barker Knauer; former Senior Legal Advisor to Commissioner Julie Brill, Federal Trade Commission
Anthony Martin, Legal, Compliance and Ethics Lead, Walmart Technology, Analytics & Sourcing

Room 301 (more…)

+ Big Data and Discrimination

Big Data and Discrimination

Session Level: 101 (2016)

This session will explore the ways in which Big Data can have discriminatory or exclusionary effects. Even without discriminatory intent, Big Data can affect different groups of people in ways that have a significant impact on how they are treated, how decisions are made about them, opportunities available to them, or the kinds of messages they are exposed to. The session will focus on areas identified by researchers as problematic as a launching point to defining the problem and engaging in a discussion of the appropriate policy responses.

Tiffany George, Senior Attorney, Division of Privacy & Identity Protection, Federal Trade Commission
Andrea Arias, Attorney, Division of Privacy & Identity Protection, Federal Trade Commission
Heather West, Senior Policy Manager, Americas Principal, Mozilla

Room 307 (more…)

Communications Privacy & Security (2016)

Expand all

+ The FCC’s Privacy and Data Security NPRM and the Internet Ecosystem

The FCC’s Privacy and Data Security NPRM and the Internet Ecosystem

Session Level: 201 (2016)

The FCC’s privacy and data security NPRM includes proposals that would fundamentally alter the use and disclosure of certain information for potentially all entities subject to the FCC’s jurisdiction. Indeed, many have argued that should the FCC adopt all of its proposals, the agency will have single-handedly changed the entire Internet ecosystem. This session examines the content of the NPRM and considers the potential impact of the FCC’s proposals on both the main stakeholders and edge providers, particularly those with telecom parents or affiliates.

Ronald Del Sesto, Jr., Partner, Morgan Lewis
Christopher Yoo, John H. Chestnut Professor of Law, University of Pennsylvania Law School

Room 413-414 (more…)

+ The FCC’s Impact on Consumer Privacy Issues – A Case Study for Organizations and Regulators

The FCC’s Impact on Consumer Privacy Issues – A Case Study for Organizations and Regulators

Session Level: 201 (2016)

This session will explore the long-term implications of the FCC’s privacy rulemaking and enforcement approaches for companies across industry sectors, including those not traditionally regulated by the FCC. What are the pros and cons for future regulators of the FCC’s use of bright-line rules, case-by-case reviews, and ad hoc enforcement approaches? Will elements of the FCC’s efforts be repeated by other sector and state regulators?

Mark Brennan, Partner, Hogan Lovells
Karen Zacharia, Vice President & Deputy General Counsel, Chief Privacy Officer, Verizon

Room 301 (more…)

Consumer Privacy & Security (2016)

Expand all

+ The Fair Credit Reporting Act; 45 Years of Lessons from the World’s First Fair Information Practice Statute

The Fair Credit Reporting Act; 45 Years of Lessons from the World’s First Fair Information Practice Statute

Session Level: 201 (2016)

“The Fair Credit Reporting Act (FCRA) was enacted in 1971. The FCRA impacts not only the three national credit bureaus and a host of specialty consumer reporting agencies, but also every bank and credit grantor, every large employer, tens of thousands of businesses and tens of millions of consumers. The FCRA is the world’s first fair information practice statute and includes provisions for consumer notice and consent; data quality protections; confidentiality protections and accountability protections. This session looks at what works and what doesn’t work based upon 45 years of FCRA experience.”

Bob Belair, Partner, Arnall Golden Gregory LLP
Bob Schoshinski, Assistant Director for Division of Privacy and Identity Protection, Federal Trade Commission
Tom Pahl, Partner, Arnall Golden Gregory LLP

Room 407 (more…)

+ Keeping Up with the FTC’s Common Law of Privacy: Hitting a Moving Target

Keeping Up with the FTC’s Common Law of Privacy: Hitting a Moving Target

Session Level: 201 (2016)

The session will consider the FTC’s developing common law of privacy. The issue for companies is how to address what seems to be a moving target for industry standards. How can companies best comply with FTC standards and develop a legal and technical company structure to promote data security? This session will examine some of the FTC’s latest cases to provide guidance about where the FTC is heading.

Jon Mills, Counsel, Boies, Schiller & Flexner LLP
Michael Gottlieb, Partner, Boies, Schiller & Flexner LLP
Yael Weinman, Assistant General Counsel – Privacy, Verizon

Room 309 (more…)

+ Moral Humans and Amoral Algorithms: How Machine Learning Creates Privacy and Ethics Exposures and What You Need to Know About It

Moral Humans and Amoral Algorithms: How Machine Learning Creates Privacy and Ethics Exposures and What You Need to Know About It

Session Level: 101 (2016)

Machine Learning enables computing devices to draw powerful inferences about behaviors, traits, and propensities from seemingly trivial data through engineered algorithms. It promises the most advanced and ubiquitous use cases within the broad area of artificial intelligence. It is the future and the future is here. This session will distinguishes Machine Learning from other technologies and explore some use cases and everyday scenarios that apply most broadly to the consumer market.

Magnolia Mansourkia Mobley, General Counsel and Chief Privacy Officer, Carrier IQ, Inc.
Steven Roosa, Partner, Holland & Knight LLP

Room 307 (more…)

+ Data Assets in Commercial Transactions

Data Assets in Commercial Transactions

Session Level: 201 (2016)

Data privacy and security issues require careful scrutiny in the context of commercial transactions. Whether a company is obtaining financing or embarking on a purchase or sale transaction, all parties involved need to understand the issues at stake. Lenders, buyers, sellers and directors need to ensure that data assets are properly identified, documented, and protected to ensure a successful deal. This session will explore the laws and best practices involved with the transfer or use of data assets in such transactions.

John Loughnane, Partner, Nutter McClennen Fish
David Sun, CEO, SunBlock Systems

Room 311 (more…)

+ Class Action Litigation: Privacy, Data Breach, and the TCPA

Class Action Litigation: Privacy, Data Breach, and the TCPA

Session Level: 201 (2016)

This session will focus on the latest cases, trends and strategy in data privacy, security breach and Telephone Consumer Protection Act (TCPA) litigation and what companies can do to successfully defend these cases.

Ian Ballon, Shareholder, Greenberg Traurig, LLP
Ray Sardo, Lead Privacy Counsel, Pandora
Eulonda Skyles, Associate General Counsel – IP Litigation, Capital One

Room 413-414

(more…)

+ State Attorneys General Privacy Enforcement: Present and Future

State Attorneys General Privacy Enforcement: Present and Future

Session Level: 201 (2016)

State attorneys general have been nimble privacy enforcement pioneers, helping set privacy policy and expand the frontiers of privacy law. The session will explore the areas in which attorneys general have made privacy and data security policy and areas of increasing enforcement interest to career staff. Where have state AGs had the greatest impact in privacy policymaking? What should organizations understand about state AG enforcement? What are the best ways for organizations to deal with state AGs?

Danielle Citron, Professor, University of Maryland Francis King Carey School of Law
Justin Erlich, Special Assistant Attorney General, California Department of Justice, Office of Attorney General Kamala D. Harris
Divonne Smoyer, Partner, Reed Smith
Erik Jones, Partner, Venable LLP

Room 309 (more…)

+ Privacy and Security Lessons from the FTC’s 100-Year History and Activities in Other Areas

Privacy and Security Lessons from the FTC’s 100-Year History and Activities in Other Areas

Session Level: 201 (2016)

This session, by Professor Chris Hoofnagle, will discuss key lessons from his recent book on the FTC’s 100-year history and how it relates to the FTC’s privacy and security activities. For example, what do the FTC’s activities in advertising law teach us about the FTC’s privacy and security cases? Understanding the FTC’s history, culture, and internal tensions are key to better interacting with the FTC on privacy and security matters. This session will deeply explore the dynamics of the FTC’s privacy and security division, with insights into strategy and how to anticipate the FTC’s next privacy and security moves.

Chris Hoofnagle, Professor, UC Berkeley Law
Dana Rosenfeld, Partner, Kelley Drye & Warren LLP

Room 309 (more…)

+ Privacy and Data Security Harms and Standing

Privacy and Data Security Harms and Standing

Session Level: 201 (2016)

This session will discuss the various approaches for defining privacy harms and how courts are reacting to them. The issue of standing will be covered extensively. What is the future of privacy and data security litigation for incidents? Is there a way to recognize harm, provide appropriate remedies to individuals who are harmed significantly, and avoid out-of-control costs?

Daniel Solove, Professor at George Washington University Law School and President/CEO of TeachPrivacy
Danielle Citron, Professor at University of Maryland Law School

Room 405

(more…)

+ Privacy and Security Enforcement Overlap and Coordination

Privacy and Security Enforcement Overlap and Coordination

Session Level: 201 (2016)

Various federal enforcement agencies have overlapping jurisdiction for privacy and security matters. Where do agencies such as the FTC, FCC, and HHS overlap? How do they coordinate enforcement efforts? How do federal agencies coordinate with state and international agencies?

Sherrese Smith, Partner, Paul Hastings
Laura VanDruff, Assistant Director, Division of Privacy and Identity Protection, Federal Trade Commission
Phillip Rosario, Deputy Bureau Chief, Consumer Protection, Federal Communications Commission

Room 309 (more…)

+ The FTC CID Demystified

The FTC CID Demystified

Session Level: 201 (2016)

This session will involve a discussion of how to handle an FTD CID and what to expect and to do during the investigatory process.

Maneesha Mithal, Bureau of Consumer Protection, Federal Trade Commission
Janis Kestenbaum, Partner, Perkins Coie LLP
Jim Halpert, Partner, DLA Piper

Room 307 (more…)

Culture & Media (2016)

Expand all

+ Dramatizing Privacy and Security

Dramatizing Privacy and Security

Session Level: 101 (2016)

This session will involve a discussion of how privacy and security are depicted in drama (books, TV, film). How realistically are they generally portrayed? How and why are certain choices made? The session will involve a law firm privacy practice chair who is a noted author of thriller novels about privacy and security and a data security expert who consults for a popular TV show on cybersecurity.

Reece Hirsch, Partner, Morgan, Lewis & Bockius LLP
James Aquilina, Executive Managing Director, Stroz Friedberg

Room 311 (more…)

+ Privacy and Security Film and TV Club

Privacy and Security Film and TV Club

Session Level: 101 (2016)

This session features top experts discussing films and TV series with privacy and security themes. Are privacy and security portrayed realistically? What is the best privacy or security movie of all time?

TBD, TBD

Room TBD (more…)

Education Privacy and Security (2016)

Expand all

+ Beyond FERPA: What California and New York Require of EdTech Providers

Beyond FERPA: What California and New York Require of EdTech Providers

Session Level: 201 (2016)

This session digs deeper into the state student data privacy laws, with a focus on California’s SOPIPA and AB 1584 and New York’s NY Educ. Law 2d. We will discuss the myriad of privacy and technical security requirements under these state laws, explore the ways in which EdTech providers are permitted or not permitted to use student data, and provide practical tips for vendor contracts.

Brenda Leong, Senior Counsel and Director of Operations, Future of Privacy Forum
Emily Tabatabai, Of Counsel, Orrick, Herrington & Sutcliffe
Linnette Attai, President, PlayWell, LLC
Tina Sciocchetti, Partner, Nixon Peabody LLP

Room 310 (more…)

Employment Privacy and Security (2016)

Expand all

+ Privacy and Security in the Employment Relationship

Privacy and Security in the Employment Relationship

Session Level: 101 (2016)

The employment relationship is where the “rubber hits the road” for both cyber security and its close cousin, privacy; after all, an employee’s keyboard presents the largest risk to both. This panel will discuss what you need to know now about the law, policies and culture of “Privacy + Cybersecurity” — and will work with attendees to imagine what we need to do to stay ahead of the emerging tech curve.

Steve Sheinberg, General Counsel and SVP, Privacy and Security, Anti-Defamation League
Bret Cohen, Senior Associate, Hogan Lovells

Room 410 (more…)

General Privacy & Security (2016)

Expand all

+ Privacy Impact Assessment Scenario Exercise

Privacy Impact Assessment Scenario Exercise

Session Level: 201 (2016)

The privacy impact assessment is the heart of the privacy professional’s job. Conducting a PIA well is critical in managing privacy risks and ensuring successful outcomes. In this audience participatory session, you will be given an initial set of facts and help guide an interview of an engineer. Through the exercise, you will learn how to build positive working relationships, elicit key information, and develop solutions that satisfy the business, engineering, and legal teams.

Scott Goss, Senior Privacy Counsel, Qualcomm
Kam Golpariani, CIPT, Qualcomm

Room 307 (more…)

+ Privacy Impact Assessments: An Agile Methodology

Privacy Impact Assessments: An Agile Methodology

Session Level: 201 (2016)

Producing traditional comprehensive Privacy Impact Assessments (PIAs) is tremendously challenging in a fast-paced software development environment in which work products constantly change. Before the ink dries on the PIA, the product has already changed. Are there ways to do PIAs so that they better keep pace with product evolution? This session will examine the use of modular approaches to PIAs and other ways to build privacy into software development in more agile and practical ways.

Marc Wasserman, Associate Director, KPMG LLP
Andrew Clearwater, Director, Privacy, OneTrust, Inc.

Room 407 (more…)

+ Data Privacy, De-Identification and PII: Using De-Identification Best Practices to Preserve Data Quality While Preventing Re-Identification

Data Privacy, De-Identification and PII: Using De-Identification Best Practices to Preserve Data Quality While Preventing Re-Identification

Session Level: 201 (2016)

The ongoing data privacy debate over personal data identifiability and de-identification has recently evolved to recognize a broad spectrum of data identifiability, and that technical solutions alone will not provide a “silver bullet” capable of both perfectly protecting personal privacy and preserving data quality for societally important uses. Instead, a multi-dimensional approach, combining technical solutions from the statistical disclosure limitation and privacy-preserving computer science disciplines with associated administrative/legal data governance, is needed. The session will discuss the recent evolution of the “de-identification” debate, and how multi-dimensional best practices and standards could lead to more robust public policy and regulatory approaches for protecting data privacy while maintaining important public benefits and uses for de-identified data.

Daniel Barth-Jones, Assistant Professor of Clinical Epidemiology, Columbia University
Simson Garfinkel, Senior Advisor, Information Access Division, National Institute of Standards and Technology
Jules Polonetsky, Chief Executive Officer, Future of Privacy Forum

Room 310 (more…)

+ Data Use in a Complex Organization

Data Use in a Complex Organization

Session Level: 201 (2016)

This session will explore how to manage the use of data in a complex organization. A complex organization has many different types of personal data, engages in a myriad of different uses of that data, and is often regulated by many different laws and regulatory agencies. The diversity of rules and definitions of personal data create greater challenges for access and data analysis. This session will explore the strategies and tools that can help address these challenges.

Lisa Martinelli, Vice President and Chief Privacy Officer, Highmark Health
Stacey Halota, Vice President, Information Security and Privacy at Graham Holdings

Room 307 (more…)

+ Transforming Privacy in the Federal Government

Transforming Privacy in the Federal Government

Session Level: 101 (2016)

This session will explore the Obama Administration’s fundamental transformation of how privacy is addressed across the government. We are seeing a paradigm shift from a compliance or “check-the-box” approach to privacy to implementing privacy as part of a comprehensive, strategic, continuous, and risk-based program. The Administration’s groundbreaking initiative has two core components: (1) streamline government-wide policies and ensure that they take into account new technologies, big data and analytics, and today’s evolving threat landscape- with the recently issued OMB Circular A-130 at the center of this effort and (2) strengthen and “professionalize” the Federal Privacy Community through the new Federal Privacy Council established by President Obama in February 2016. If you are not paying attention to this shift you are missing one of the key privacy initiatives of the year.

Marc Groman, Senior Advisor for Privacy at White House Office of Management and Budget, Chair, Federal Privacy Council

Room 311 (more…)

+ Improving Data Security: How to Get the GC, CISO, and Privacy Teams to Better Interact

Improving Data Security: How to Get the GC, CISO, and Privacy Teams to Better Interact

Session Level: 101 (2016)

This session will discuss how counsel and privacy professionals can better engage with security professionals and IT.

Emilio Cividanes, Partner, Venable LLP
John Kropf, Corporate Privacy Executive, Northrop Grumman Corporation
Christine Sublett, President and Principal Consultant, Sublett Consulting

Room 403 (more…)

+ Ethics in an Automated and Trackable World

Ethics in an Automated and Trackable World

Session Level: 101 (2016)

Industry is grappling, arguably unsuccessfully, with core sociotechnical tensions between individual and collective rights and interests in privacy, security, innovation, and autonomy. This is manifest in issues associated with Smart-X (homes, wearables, vehicles), automated algorithms, and behavioral advertising, for example. We need collective thinking and action to avoid negative impacts, and contend that we should turn to ethics as an enabler in addressing these challenges.

Erin Kenneally, Program Manager, Data Trust & Innovation, U.S Department of Homeland Security, Science & Technology Directorate, Cyber Security Division
Hilary Wandall, General Counsel & Chief Data Governance Officer, TRUSTe
Robin Wilton, Technical Outreach Director, Internet Society

Room 302 (more…)

+ The Effect of Privacy and Security on Business Valuation

The Effect of Privacy and Security on Business Valuation

Session Level: 101 (2016)

Privacy and data security considerations are increasingly affecting mergers, acquisitions, and strategic investments in businesses. Investors and those receiving investment now often turn to experts familiar with privacy, security, and deal considerations to advise them on assessing and valuing risk in these areas. Participants will hear from experts whose work in mergers, acquisitions, and other investment transactions, provides them with a direct and unique view on how privacy and security affect these transactions.

Sharon Anolik, Esq., CIPP, President, Privacy Panacea
Gerry Stegmaier, Partner, Goodwin Procter LLP

Room 309

(more…)

+ The Relationship Between Privacy and Security

The Relationship Between Privacy and Security

Session Level: 101 (2016)

Privacy and security often exist in separate silos, but they are interrelated. Although professionals in both fields will often say that privacy and security go hand in hand, they are often not as well integrated in practice. Often the ways that they work in tandem are not fleshed out in a concrete way. This session will explore the relationship between privacy and security concretely, as well as discuss strategies for better bridging the two.

Jenn Behrens, Partner and Executive VP of Privacy, Kimble & Associates
Scott Shorter, VP Security, Kimble & Associates
Kendall Tyree, Executive Director, Virginia Soil and Water Conservation Districts

Room 310

(more…)

+ Data Classification: The Information Governance Must-Have

Data Classification: The Information Governance Must-Have

Session Level: 301 (2016)

This session will describe how data classification is foundational to any information management initiative. It will feature a hands-on exercise to develop a data classification standard for a hypothetical company and a role-playing vignette that highlights the challenges of building a data classification standard. The challenges of socializing and operationalizing a data classification standard will also be discussed.

Deborah Butler, Principal, 21st Century Advisors
Dale Skivington, Executive Director, Global Compliance & Privacy, Dell Inc.

Room 311 (more…)

+ Privacy and Security at the Board Level: How to Interact with the Board of Directors

Privacy and Security at the Board Level: How to Interact with the Board of Directors

Session Level: 201 (2016)

A company’s board of directors has a unique and vital role to play in security and privacy. These issues will need to be on the board’s agenda on a recurring basis. Boards operate in ways that may be foreign to the CISO or CPO who is asked for the first time to present at the board level. This session will focus on the essential elements of the Board’s responsibilities for cybersecurity and data privacy. What keeps board members up at night? What do they expect from CISOs and CPOs? What is the most effective way to communicate with the board about privacy and security issues?

Rachael Falk, Cyber Security Advisor, Pace and Scale
Adam Golodner, Partner, Kaye Scholer LLP

Room 302 (more…)

+ Privacy, Security, and Organizational Structure

Privacy, Security, and Organizational Structure

Session Level: 201 (2016)

How should organizations structure the privacy and security roles and teams to maximize the goals of each? In most organizations, privacy and security sit in different departments. Should they be unified? If so, how? Whether separate or unified, what approaches should be taken to ensure that privacy and security work together smoothly and productively?

Tom Widgery, Sr. Director Privacy & Information Governance, Silicon Valley Bank Financial Group
Michael McCullough, CPO & V.P., Enterprise Information Management, Macy’s
Faith Myers, Global Privacy Leader & VP, McKesson

Room 302 (more…)

+ Breaking Glass Ceilings: Executive Women in Privacy and Security

Breaking Glass Ceilings: Executive Women in Privacy and Security

Session Level: 101 (2016)

In this panel, seasoned CPOs and CISOs will share their experiences as women in the privacy, security, technology, and legal fields. Which field was easiest and hardest for them to enter? How was it different 15, 10, 5 years ago compared to how it is today? What were their most difficult challenges as women in these fields? How did they handle those challenges? Is privacy really an equal playing for women? If so, why do they think this is the case? What do they wish they did differently in their careers? What have they had to do differently today to keep up with the evolving intersection of privacy, security, law, and technology? Where do they see this field going and do they see a place for women there?

Lourdes Turrecha, Consultant on Law and Policy, TeachPrivacy
Elena Elkina, Senior Manager, McKesson
Tanya Forsheit, Partner, Frankfurt Kurnit Klein & Selz
Elaine Call, Counsel, Technology and Privacy, Cengage Learning

Room 407 (more…)

+ Future Trends in Privacy and Security

Future Trends in Privacy and Security

Session Level: 101 (2016)

Our invited experts will bring along their crystal balls and peer into the future. What will be the top five privacy and security trends of the near future? What steps should organizations take now to prepare themselves?

Mike Hintze, Partner, Hintze Law PLLC (moderator)
Amie Stepanovich, U.S. Policy Manager, Access Now
Sabrina Ross, Senior Counsel – Privacy, Uber

Room 301

(more…)

+ Are Good Security Measures Always Good for Privacy? A Discussion of NIST Frameworks

Are Good Security Measures Always Good for Privacy? A Discussion of NIST Frameworks

Session Level: 301 (2015)

While implementing security measures is important for privacy, they can also create risks which can undermine individuals’ privacy. Panelists will discuss the Framework for Improving Critical Infrastructure Cybersecurity and how it balances the potential conflict. Session attendees will also hear about the latest NIST privacy risk management tools that can be used in concert with cybersecurity risk management processes.

Adam Sedgewick, Senior Information Technology Policy Advisor at NIST
Naomi Lefkovitz, Senior Privacy Policy Advisor at NIST
Jeff Brueggeman, Vice President – Global Public Policy, AT&T

Room 308

(more…)

Health Privacy & Security (2016)

Expand all

+ Connected Healthcare Devices: Proactively Addressing the Privacy and Security Risks

Connected Healthcare Devices: Proactively Addressing the Privacy and Security Risks

Session Level: 201 (2016)

As the interconnections between health devices increase, (via the Internet, hospital networks, other medical equipment, smartphones, and tablets), there is an increased risk of cybersecurity breaches that may affect medical operations and its interactions with protected health data. This session will explore the challenges faced by technology developers and government regulators in the IoT space, and how they address privacy and security risks in the design and development of IoT connected devices and technologies.

Lucia Savage, Chief Privacy Officer, Office of the National Coordinator for Health IT, U.S. Department of Health & Human Services
Nyla Beth Gawel, Principal, Booz Allen Hamilton
Sumit Sehgal, CTO Healthcare, Intel Security

Room 307 (more…)

+ Operationalizing Genetic Privacy: Industry Perspectives

Operationalizing Genetic Privacy: Industry Perspectives

Session Level: 201 (2016)

This panel will address privacy approaches in the emerging field of genomic and genetic health, both within and beyond the scope of HIPAA. Some of the discussion topics – ripped from the headlines – will include: international data transfers, consent for processing genetic and genomic data, patient data access requests, conflicting laws and competing obligations specific to genetics/genomics.

Jill Green, Senior Legal Counsel and Global Data Protection Officer, Genomic Health
Kate Black, Privacy Officer & Corporate Counsel, 23andMe, Inc.
Irina Ridley, Privacy Officer and Senior Corporate Counsel, Counsyl

Room 301 (more…)

+ HIPAA Risk Assessments for Compromised PHI

HIPAA Risk Assessments for Compromised PHI

Session Level: 201 (2016)

Join us for an interactive learning workshop, focused on integrating HIPAA/HITECH-required risk assessment (CFR § 164.402) into health care privacy investigations. Practical exercises will challenge attendees with assessing risk in various privacy incident scenarios. Participants will gain knowledge about risk assessment requirements and learn compliance techniques that can be tailored to meet the needs of covered entities looking to integrate risk assessment into their privacy investigations.

Cheryl Canfield, Privacy Officer, Roswell Park Cancer Institute
Doris Patrick, Director – Cybersecurity and Privacy, PricewaterhouseCoopers LLP
Keith Cheresko, Principal, Privacy Associates International LLC

Room 402-404 (more…)

+ Agreements Involving PHI

Agreements Involving PHI

Session Level: 201 (2016)

There are a variety of agreements involving PHI – business associate agreements, data use agreements, and non-disclosure agreements. What are the best strategies for contracting with various types of vendors? Beyond HIPAA, what issues and considerations should be given to various arrangements with vendors? What are the best approaches to manage the agreements from both parties’ points of view?

Missi Hart-Kothari, HIPAA Compliance Manager, Cardinal Health
Morris Landau, Privacy Officer and Counsel, Premise Health
Hemant Pathak, Assistant General Counsel, Microsoft
Scot Ganow, Attorney, Faruki Ireland & Cox P.L.L.

Room 402-404 (more…)

+ Responding to Healthcare Data Breaches: The Need for Special Response Measures

Responding to Healthcare Data Breaches: The Need for Special Response Measures

Session Level: 201 (2016)

Not all data breaches are the same, and not all data breach response should be the same. Healthcare data breaches present unique challenges that are different from other data breaches. Healthcare organizations often miss the mark when offering identity protection services to their patients, employees, and other affected individuals. Credit monitoring, for example, has long been a panacea for healthcare breach victims. There is a time and place for credit monitoring. But offering credit monitoring when medical information has been exposed is like treating a broken leg with a heart transplant. This session will explore how healthcare data breaches differ from other data breaches and provide advice about the types of special measures that ought to be taken in this context.

Rick Kam, President and co-founder, ID Experts
Sean Hoar, Partner, Davis Wright Tremaine LLP

Room 402-404 (more…)

+ HIPAA Business Associates: Advanced Challenges and Compliance Strategies

HIPAA Business Associates: Advanced Challenges and Compliance Strategies

Session Level: 201 (2016)

This session will focus on the privacy/security challenges and opportunities for business associates (BAs) under HIPAA. What are the most challenging issues of HIPAA compliance for BAs? What myths about HIPAA compliance persist even among experienced BAs? What issues pertaining to BAs could use greater clarity and guidance under HIPAA? What types of compliance strategies are the most effective?

Adam Stone, Director of Privacy, Secure Digital Solutions, LLC
Rebecca Fayed, Associate General Counsel and Privacy Officer, The Advisory Board Company

Room 301 (more…)

+ A Deep Dive into Hot Topics in Healthcare Privacy

A Deep Dive into Hot Topics in Healthcare Privacy

Session Level: 201 (2016)

New mandatory consent for research involving anonymous biospecimens? A nascent movement to break through the legislative and political logjam blocking a national patient identifier? House legislation changing HIPAA to accelerate research vs. Senate legislation aimed at banning information blocking and expediting interoperability vs. none of the above? Data donation through Precision Medicine or the Cancer Moonshot? This session led by an industry expert and DC insiders will take a deep dive into these and other rapidly evolving policy, legislative, and regulatory health privacy initiatives.

Ann Waldo, Principal, Waldo Law Offices, PLLC
Tina Grande, Sr. Vice President, Policy & Chair, Confidentiality Coalition, Healthcare Leadership Council
Hilary Wandall, General Counsel & Chief Data Governance Officer, TRUSTe

Room 407 (more…)

+ Health Information Research and New Technologies: Privacy and Security Challenges

Health Information Research and New Technologies: Privacy and Security Challenges

Session Level: 201 (2016)

The development of new technology for use in the health care arena is opening up revolutionary avenues for both treatment and research. Technological and scientific innovations for collecting, storing, analyzing and sharing personal health data, including as “Big Data,” promise to advance cures for a wide variety of conditions. But these advances require working with personal data and raise significant privacy and data security risks. This session will explore the range of risks involved and recent proposals and potential means for mitigating them, including a discussion of governmental and self-regulatory initiatives.

Nancy Perkins, Counsel, Arnold & Porter
Deven McGraw, Deputy Director, Office for Civil Rights (OCR), U.S. Department of Health and Human Services
Cora Tung Han, Senior Attorney, Division of Privacy and Identity Protection, Federal Trade Commission
David Bloch, Principal Legal Counsel, Corporate Legal Regulatory, Medtronic

Room 308 (more…)

+ Current and Future HHS Initiatives in Health Privacy

Current and Future HHS Initiatives in Health Privacy

Session Level: 201 (2016)

This session will focus on current and future initiatives at HHS: the status of the audit program, HIPAA and health information exchange, the current state of enforcement, and upcoming regulations on accounting of disclosures and sharing penalties with harmed individuals.

Adam Greene, Partner, Davis Wright Tremaine LLP
Deven McGraw, Deputy Director for Health Information Privacy at HHS Office for Civil Rights

Room 403 (more…)

+ Non-HIPAA Health Data

Non-HIPAA Health Data

Session Level: 201 (2016)

There is a vast and growing amount of health data that clearly falls outside of HIPAA, or where HIPAA may apply only at the margins. This growing gap in the law affects a broad variety of new health technologies and a large set of critical healthcare policy issues. We will address how the law applies in these settings today, where the key gaps are, and how best to address these gaps in the future, in the law and for healthcare companies.

Kirk Nahra, Partner, Wiley Rein LLP
Joy Pritts, Health Information Privacy Consultant

Room 307 (more…)

International Privacy & Security (2016)

Expand all

+ Preparing for the GDPR: Attaining and Demonstrating Compliance

Preparing for the GDPR: Attaining and Demonstrating Compliance

Session Level: 201 (2016)

How will you comply with the EU GDPR? What approach will you take? What resources will you need and where will they come from? This session outlines an accountability approach to attaining and maintaining GDPR compliance through the “appropriate technical and organizational measures” required by Article 24. Allow your organization to take a running start by first understanding what accountability infrastructure is in place; identifying the gaps needing remediation; strategies for prioritizing; and the resourcing of activities that will enable and maintain GDPR compliance. The session will also show how existing technical and organizational measures can be mapped to GDPR articles to help achieve another obligation found in Article 24, “the ability to demonstrate that processing is performed in accordance with the Regulation.”

Constantine Karbaliotis, Vice President, Privacy Office Solutions, Nymity
Antonis Patrikios, Partner, Fieldfisher

Room 302 (more…)

+ Managing Personal Data in a Changing EU Privacy Regime

Managing Personal Data in a Changing EU Privacy Regime

Session Level: 201 (2016)

Safe Harbor has been struck down and there remain great uncertainties about the new Privacy Shield, and questions about other methods to transfer personal data outside of the EU. Given this uneasy state of affairs, more companies are looking to BCRs, model contracts, or even registering their own program as a means of facilitating transborder data flow. This session will explore the various options for moving personal data across borders with practical “how to” advice as well as insights into how the GDPR and changing regulatory terrain will impact data flows.

Debbie Bromson, Head of Global Privacy & Senior Compliance Counsel, Jazz Pharmaceuticals
K Royal, Vice President, AGC Privacy & Compliance, CellTrust Corporation
Maggie Gloeckle, Senior Privacy Officer at HSBC
Ashley Slavik, Senior Counsel and Data Protection Officer, Veeva Systems, Inc.

Room 403-404 (more…)

+ The Role of Data Protection Officers under the GDPR

The Role of Data Protection Officers under the GDPR

Session Level: 201 (2016)

This session provides an overview of the job, the responsibilities, and real-life challenges of DPO’s. It will explore what the GDPR changes for these professionals and for the businesses.

Gonca G. Dhont, Managing Director, DPO Network Europe
Joanne Furtsch, Director, Policy & Data Governance, TRUSTe

Room 307 (more…)

+ The GDPR’s Data Protection Officer (DPO)

The GDPR’s Data Protection Officer (DPO)

Session Level: 201 (2016)

In certain circumstances, the GDPR requires data controllers and processors to designate a Data Protection Officer (the DPO) as part of their accountability program. This obligation is new to the data protection law of may EU countries. This session will discuss when and why a company should appoint a DPO, conditions under which an external employee can efficiently be used, and other practical steps regarding the designation of a DPO.

Cornelia Maria Schmitt, Compliance Consultant, intersoft consulting services AG
Richard Stiennon, Chief Strategy Officer, Blancco Technology Group

Room 302 (more…)

+ Data Sovereignty

Data Sovereignty

Session Level: 201 (2016)

As more companies and individuals around the world use the cloud, many governments are working to increase control over their citizens’ data. These efforts respond, in part, to concerns regarding privacy and security in the cloud, and more broadly the ability of governments to control data. This session will examine why demands for data sovereignty are increasing, and what that means for the future of the cloud. Our experts will discuss the state of play across the world.

Speakers to be Announced

Room TBD (more…)

+ DPAs Around the World: EU, Latin America, and Asia

DPAs Around the World: EU, Latin America, and Asia

Session Level: 201 (2016)

Data Protection Authorities (DPAs) are a fact of regulatory life throughout the world. How do these entities differ in the EU, Latin America, and Asia? What are the best practices for dealing with them in an effective fashion?

Prof. Niko Härting, Partner, HÄRTING Rechtsanwälte
Jennifer Keh, Attorney, Kim & Chang
Pablo Palazzi, Partner, Allende & Brea

Room 301 (more…)

+ Comparative Global Privacy and Security Enforcement

Comparative Global Privacy and Security Enforcement

Session Level: 201 (2016)

This session will explore comparative global privacy and security enforcement. How has the EU been enforcing? How does EU enforcement compare to US enforcement? What are the enforcement trends globally? How do various countries compare? What are the biggest fines issued for privacy and security violations? How is enforcement evolving and how is it likely to be shaped by the new GDPR? What insights do past enforcement activity provide for how enforcement will be carried out under the GDPR?

Jay Cline, Principal, Cybersecurity & Privacy, PricewaterhouseCoopers
Colin Bennett, Professor, University of Victoria

Room 307 (more…)

+ The GDPR and Technology

The GDPR and Technology

Session Level: 201 (2016)

Will the GDPR be compatible with 21st Century technology? This session provides practical illustrations of how the GDPR will impact the Internet of Things, mobile apps, AI/machine learning, and the cloud. It will focus on specific issues affecting users and providers of tech products and services.

Christopher Millard, Professor, Queen Mary University of London
Mark Watts, Partner, Bristows (UK)

Room 403 (more…)

+ Incident Response and Data Breach Notification: The Global Landscape

Incident Response and Data Breach Notification: The Global Landscape

Session Level: 201 (2016)

Join this session to get an up-to-date view of the laws and legal issues to keep in mind when an organization investigates a cybersecurity incident that crosses borders. In what countries must you report a breach to government authorities and customers? How should you coordinate interactions with law enforcement internationally? What about privacy and international trade regulations that might affect your investigation? Variations of the data breach notifications law that originated in the United States have now been adopted in many countries around the world, and this session will orient you to the global landscape.

Harriet Pearson, Partner, Hogan Lovells
Maureen Cooney, Head of Privacy, Sprint
Allison Bender, Senior Associate, Hogan Lovells

Room 407

(more…)

+ The CPO’s Expanding International Portfolio

The CPO’s Expanding International Portfolio

Session Level: 201 (2016)

This session examines important laws from “outside” of privacy as well as geopolitical trends. The laws include the Foreign Corrupt Practices Act, Export Controls “Know Your Customer” diligence,” Committee on Foreign Investment in the United States/Exon-Florio, transatlantic anti-trust investigations, and the Uniform Trade Secrets Act. Additional privacy challenges are created by the national security and foreign policy initiatives of both the US government and the governments of its major commercial and geopolitical partners. These include responding to compulsory legal process relating to national security and law enforcement and assertions of data sovereignty and data geolocation.

Ronald D. Lee, Partner, Arnold & Porter
Jonathan Neiditz, Partner, Kilpatrick Townsend & Stockton
Jonathan Soll, CPO, Western Union

Room 302

(more…)

+ Global Data Security: A Comparison of Laws

Global Data Security: A Comparison of Laws

Session Level: 201 (2016)

Data protection regimes throughout the world require data controllers and recipients to put in place security measures to ensure protected data integrity and access control. Security requirements are becoming more numerous and strict. This session will compare data security requirements in Latin America, Europe, and Asia. The session will outline practical approaches to normalizing data security during intra-entity and third-party transfers.

Patrick Burke, Senior Counsel, Seyfarth Shaw LLP
David Shonka, Principal Deputy General Counsel at Federal Trade Commission
Lara Ballard, Special Advisor for Privacy and Technology, U.S. Department of State
Denise Backhouse, Shareholder, eDiscovery Counsel, Littler Mendelson

Room 403

(more…)

+ The GDPR: What Will Change? What Remains the Same?

The GDPR: What Will Change? What Remains the Same?

Session Level: 201 (2016)

The GDRP is a privacy game-changer. It will be directly binding once enacted and appears headed to make important changes to the substantive and procedural law of EU privacy. This up-to-date session will explore how the EU Data Protection alters the status quo and identifies practical steps companies can take now for compliance success under the new EU status quo for privacy.

Shaundra Watson, Senior Advisor to Chairwoman Edith Ramirez, FTC
Andrea Glorioso, Counsellor for the Digital Economy, Delegation of the EU to the US
Sharon Williamson, Director, Privacy and Security, Netflix
Paul Schwartz, Jefferson E. Peyser Professor, University of California Berkeley School of Law

Room 403

(more…)

+ Obtaining Consent and Complying with Age Requirements in the GDPR and COPPA

Obtaining Consent and Complying with Age Requirements in the GDPR and COPPA

Session Level: 201 (2016)

The session will focus on the challenges in meeting age of consent requirements established under the GDPR. With the ability for member states to interpret the age of consent from 13-16, organizations will need to understand the risks, challenges and solutions for meeting this challenge. By taking a look at COPPA and how companies have met or are meeting this requirement, we can explore how an organization can build a compliant yet effective global campaign. We will discuss ideas along with the advantages & disadvantages associated with these.

Wills Catling, Principal, Promontory Financial Group, LLC
Dona Fraser, VP, ESRB Privacy Certified
John Bowman, Senior Principal, Promontory Financial Group (UK) Ltd

Room 308 (more…)

+ Canadian Privacy Law for US Lawyers

Canadian Privacy Law for US Lawyers

Session Level: 201 (2016)

Canada is the individual largest trading partner of the U.S. Its privacy law is therefore of paramount importance, but frequently not well understood in the U.S. This session discusses the most relevant aspects of Canadian privacy law for US companies, including the impact of Canadian federalism, the role of federal and state privacy commissioners, and the Canada Anti-Spam Law (CASL).

Karen Eltis, Professor, University of Ottawa Law School
Alex Cameron, Partner, Fasken Martineau DuMoulin LLP
Aggie Zander, Senior Director, Privacy, CIBC

Room 413-414 (more…)

+ The Privacy Shield: a Bright or Dismal Future?

The Privacy Shield: a Bright or Dismal Future?

Session Level: 201 (2016)

This session will examine the current state-of-play involving the U.S.-EU Privacy Shield, the controversial successor to the Safe Harbor. From the start, this agreement’s destiny has seemed uncertain, with future litigation likely headed to the ECJ. What are the most important terms of the Privacy Shield? Is it worth for companies to make use of this mechanism for transborder-data flows?

Justin Antonipillai, Counselor, Delegated Duties of Under Secretary for Economic Affairs, U.S. Department of Commerce
Chris Zoladz, Founder, Navigate LLC
Jim Koenig, Leader, PH Privacy, Cyber and Data Implementation Solutions, Paul Hastings LLP
Josh Harris, Director, International Regulatory Affairs, TRUSTe

Room 309 (more…)

+ Will Member State DPA’s Still Matter? National Law after the GDPR

Will Member State DPA’s Still Matter? National Law after the GDPR

Session Level: 201 (2016)

Even after the GDPR, national data protection will play a critically important role in the EU. Using examples from a number of Member States, this session explores the significance of national data protection law under the GDPR.

Jan Dhont, Partner, Alston & Bird
Karl-Nikolaus Peifer, Professor, University of Cologne Law School, Germany
Paul M. Schwartz, Professor, Berkeley Law School

Room 407 (more…)

+ Japanese Privacy and Data Protection Law

Japanese Privacy and Data Protection Law

Session Level: 101 (2016)

Japan’s privacy and data protection regime is unique. While it in some ways resembles the EU model, it also incorporates several aspects of the layered approach of the United States. Japan recently amended its data protection laws, but it is not yet clear exactly what this new regime will look like. Japan’s unique culture has also shaped its notion of privacy (Pu-rai-ba-shi / プライバシー), which is which is similar to and overlaps with data protection. This panel will feature experts on Japan and US privacy and data protection law. It will provide a basic introduction into privacy and data protection law in Japan as well as compare Japan’s regime with the US and EU models. As one of the largest and most important economies in the world, Japan Data Protection law is a critical component of the world’s data ecosystem. Understanding both its laws and culture of privacy will be key for interacting with Japanese people and organizations and the international flow of data.

Hideyuki Matsumi, Independent Researcher
Woodrow Hartzog, Professor, Samford University Cumberland School of Law
Takashi Nakazaki, Special Counsel, Anderson Mori & Tomotsune
James Miller, Adjunct Professor of Law, American University Washington College of Law

Room 311 (more…)

+ Data Protection and Privacy in Latin America

Data Protection and Privacy in Latin America

Session Level: 201 (2016)

This session will analyze the latest regulatory and statutory developments in Latin America with respect to data protection and privacy regulations.

Pablo A. Palazzi, Partner, Allende & Brea
Guillermo E. Larrea, Of Counsel, Jones Day Mexico
Mauricio F. Paez, Partner, Jones Day

Room 301 (more…)

Privacy & Security Engineering & Design (2016)

Expand all

+ Scoping Privacy Engineering Requirement: A Workshop on Turning Policy into Design

Scoping Privacy Engineering Requirement: A Workshop on Turning Policy into Design

Session Level: 201 (2016)

This interactive session will explore privacy engineering and demonstrate how to scope privacy and security requirements for any product, process, application, or system. It will teach how principles and standards should be leveraged as a common methodology to identify and address privacy and security requirements in the scoping phase of development. Intended for both technologists as well as non-technologists, this session will include hands-on design exercises that will help participants put this information to immediate use.

Participants should have a good foundation in privacy and basic security knowledge; however, the session will be accessible to professionals in both privacy and security.

Michelle Dennedy, VP and Chief Privacy Officer, Cisco
Thomas Finneran, Principal Consultant for the IDennedy Project
Jonathan Fox, Director, Strategy and Planning, Chief Privacy Office, Cisco
Lisa Bobbitt, Senior Manager, Privacy Office, Cisco

Room 307

(more…)

+ Designing Notice and Consent into the Internet of Things: A Hands-on Workshop

Designing Notice and Consent into the Internet of Things: A Hands-on Workshop

Session Level: 201 (2016)

Privacy notices are often long, difficult to understand, and don’t appear at opportune times. Constrained interfaces on mobile devices, wearables, and smart home devices exacerbate the issue. In this workshop Professor Lorrie Cranor and privacy researcher Dr. Florian Schaub offer concrete guidelines on how to select the most effective notice and consent mechanisms for a given system or device. They will present a taxonomy of notice options, based on their research, and guide participants through hands-on design exercises.

Lorrie Cranor, Professor of Computer Science and Engineering & Public Policy, Carnegie Mellon University

Room 413-414 (more…)

+ Notice, Choice, and Design

Notice, Choice, and Design

Session Level: 101 (2016)

Privacy policies must provide as much notice and choice as possible. Although privacy policies are difficult to read, verbose, and often ignored, lawyers and regulators have paid little attention to what the policy looks like to users on a front-facing interface. Based on the manipulative effects of art and design, this interactive session will allow participants to experiment to different designs in an effort to enhance user notice and choice.

Ari Ezra Waldman, J.D., Ph.D., Associate Professor of Law, Director, Innovation Center for Law and Technology, New York Law School
Joel Reidenberg, Stanley D. and Nikki Waxberg Chair and Professor of Law Founding Academic Director, Center on Law and Information Policy, Fordham University, School of Law
Emily Schlesinger, Privacy Attorney, Microsoft

Room 402-404 (more…)

+ The Use of Privacy Enhancing Technologies (PETs)

The Use of Privacy Enhancing Technologies (PETs)

Session Level: 201 (2016)

Privacy Enhancing Technologies (PETs) are an effective and largely underutilized tool that can significantly strengthen privacy and data security. A rift exists between the technical academic community who created many of these tools and the privacy and security professionals community who may be unaware of their existence. This session will focused on awareness of basic PETs, use cases, cost and benefits and potential legal implications that may arise from their use.

Jason Cronk, Privacy and Trust Consultant, Enterprivacy Consulting Group
Erin Kenneally, Program Manager, Data Trust & Innovation, Department of Homeland Security
Kelly Caine, Associate Professor, Human Centered Computing, Clemson University; Director, Humans And Technology Lab

Room 302

(more…)

+ Designing User Interfaces for Privacy

Designing User Interfaces for Privacy

Session Level: 201 (2016)

Designing User Interfaces for Privacy

In this interactive workshop, we’ll explore how to design user interfaces with privacy in mind. Participants will work through a scenario to design a real-life product experience that educates people on privacy and controls and provides important privacy information in context.

Rob Sherman, Deputy Chief Privacy Officer, Facebook
Moira Burke, Data Scientist, Facebook

Room 407 (more…)

+ Privacy’s Blueprint: How Should the Law Regulate Privacy by Design?

Privacy’s Blueprint: How Should the Law Regulate Privacy by Design?

Session Level: 201 (2016)

Technological design that affects our privacy is now so pervasive, we barely even notice it. Increasingly, privacy law must grapple with design issues, and several FTC cases have involved design. This session, which is based on Professor Woodrow Hartzog’s forthcoming book, Privacy’s Blueprint: The Battle to Control New Technologies, will discuss how privacy law does and should regulate technological design. What does the law currently do to regulate design? Should the law curtail regulation of design because the law shouldn’t be meddling with technology that it barely understands? Or should the law regulate more because design is central to the protection of privacy and security? What is appropriate versus ill-advised when it comes to regulating design?

Woodrow Hartzog, Professor, Samford University Cumberland School of Law
Chris Olsen, Partner, Wilson Sonsini Goodrich & Rosati

Room 302 (more…)

Risk Mitigation & Incident Response (2016)

Expand all

+ Assessing Cyberinsurance Policies: The Good, the Bad and the Ugly

Assessing Cyberinsurance Policies: The Good, the Bad and the Ugly

Session Level: 201 (2016)

This session will evaluate typical cyber-insurance policies to point out classic pitfalls and coverage gaps about which lawyers should be aware. What are the best kinds of terms for parties seeking strong coverage? What are the kinds of policies to avoid? How can clients get the best protection at the most efficient cost?

Richard Bortnick, Senior Counsel, Traub Lieberman Straus & Shrewsberry
Thomas Katona, Partner, Agentic Insurance
Scott Godes, Partner, Barnes & Thornburg LLP

Room 413-414 (more…)

+ Special Handling of Cybersecurity Incidents: Anticipating Regulator Interest

Special Handling of Cybersecurity Incidents: Anticipating Regulator Interest

Session Level: 201 (2016)

Some data incidents attract the attention of applicable regulators. The attention can be due to the incident’s size or circumstance, or the identity of the victimized company. During the initial response to a security incident that you think may attract regulator attention, a special type of response is advisable. This session focuses on practical tips when handing cyber incidents that are likely to bring regulator involvements, designed to minimize harm and liability.

Kristen Mathews, Partner, Proskauer
Robert Forbes, Assistant General Counsel, Washington Redskins
Brendon Tavelli, Executive Director & Assistant General Counsel, JPMorgan Chase & Co.

Room 311 (more…)

+ Privacy and Security Risk: Theory vs. Practice

Privacy and Security Risk: Theory vs. Practice

Session Level: 201 (2016)

Privacy and security risk management would benefit from taking a closer look at the methods on offer in both the theoretical sphere and in other fields’ practices. As the complexity as well as the scale and scope of socio-technical systems steadily expands, the methods used to analyze and control privacy and security risk in practice are largely stagnant. What once was barely adequate is now increasingly untenable. This session will discuss methods arising out of the ways other fields manage risk and out of research on privacy and security risk, and consider how these methods might be adapted and adopted for privacy and security in practice.

Stuart Shapiro, Principal Cyber Security and Privacy Engineer, MITRE Corporation
Sherry Burs-Howard, Consultant – Security and Privacy

Room 308 (more…)

+ The Science of Measuring Risk: Using Insights from Cyber Insurance Underwriting to Improve Risk Management

The Science of Measuring Risk: Using Insights from Cyber Insurance Underwriting to Improve Risk Management

Session Level: 101 (2016)

This session will use insights learned in the cyber insurance industry to develop more effective risk management strategies. The session will explore basic theories of the science of risk management to answer such questions as: (1) What is our costs of risk and how do we measure it? (2) How do we decide which loss prevention technology to invest in? (i.e. do we invest in a better intrusion detection system or encryption of databases?); and, (3) Where will the funds come from to recover from a loss? (i.e. should we purchase cyber insurance? What are the alternatives to cyber insurance?).

Nicholas Economidis, Underwriter, Beazley
Thomas Reagan, Managing Director – Cyber Practice Leader, Marsh USA, Inc.
Andy Obuchowski, Jr., Practice Leader, Digital Forensics & Incident Response Services, Director, Security & Privacy Consultant, RSM US LLP

Room 308 (more…)

+ Conducting a Privacy Investigation

Conducting a Privacy Investigation

Session Level: 201 (2016)

This session examines both general investigations of possible misconduct as well as the investigations of privacy violations, including data breaches. In general investigations of misconduct, how can a company investigate potential misconduct without running afoul of data protection laws? How does a cross-border investigation affect that calculus? How does one deal with US governmental agencies demanding information that another jurisdiction’s data protection laws might prohibit supplying? Regarding the privacy or data breach investigation, if someone is suspected of a privacy or data security violation, how and when should the suspect be approached?

Behnam Dayanim, Partner, Paul Hastings LLP
Andrew Valentine, Associate Managing Director, Kroll
Erika Lee Brown, Chief Privacy and Civil Liberties Officer, United States Department of Justice
Daniel Guggenheim, Chief Compliance Officer, Theranos, Inc.

Room 308

(more…)

+ Preparing for Critical Infrastructure Cyber Attacks

Preparing for Critical Infrastructure Cyber Attacks

Session Level: 201 (2016)

A cyber attack on electric utilities could affect all industries. What do organizations need to know about the possibility of such an attack? Is the U.S. government’s sufficient to protect your organization? Will the Cybersecurity Act of 2015 help? What steps should organizations take to manage the risk of such an attack? What steps will your insurer expect you to have taken as a condition of obtaining cyber liability insurance?

Gamelah Palagonia, Senior Vice President, Willis FINEX North America
John Coletti, Chief Underwriting Officer, XL Catlin
Brian Huntley, CISO, IDT911
Judy Selby, Managing Director, Technology Advisory, BDO

Room 403

(more…)

+ Cyber Insurance: How It Works, How to Select a Policy, and Emerging Trends and Practices

Cyber Insurance: How It Works, How to Select a Policy, and Emerging Trends and Practices

Session Level: 201 (2016)

This session will discuss the history of cyber insurance, including the evolution of cyber insurance products and judicial interpretations of cyber insurance policies. It will also review information system risks, measures that can mitigate those risks, the role of cyber insurance in transferring any remaining risks, and the types of cyber insurance coverage currently available.

Christina Terplan, Partner, Clyde & Co US LLP
Marcus Breese, Professions Line Underwriter, Hiscox London Mkt
Scott Godes, Partner, Barnes & Thornburg LLP
Erica Dominitz, Partner, Kilpatrick Townsend & Stockton LLP

Room 302 (more…)

+ Forensics: A Weapon and Shield in Data Breach Litigation

Forensics: A Weapon and Shield in Data Breach Litigation

Session Level: 201 (2016)

Digital forensics can make or break a data breach case. This session will explore how digital forensics can affect litigation from the perspective of plaintiff and defense lawyers.

Donna Wilson, Partner, Manatt
James Aquilina, Senior Executive Managing Director, Stroz Friedberg
Linda Kornfeld, Partner, Kasowitz Benson Torres & Friedman LLP

Room 308 (more…)

Security (2016)

Expand all

+ Combatting the Insider Threat: Background Screening and Monitoring

Combatting the Insider Threat: Background Screening and Monitoring

Session Level: 101 (2016)

Screening job applicants and independent contractors through pre-employment background checks and ferreting out employees who have “turned” post-hire are fundamental elements of an insider threat reduction program. However, the “ban-the-box movement” and hundreds of recently filed class action lawsuits alleging violations of the federal Fair Credit Reporting Act have ratcheted up the risk for employers who engage in these activities. This session will provide practical advice on how to eliminate the insider threat through an effective pre- and post-hire background check program without being sued.

Philip Gordon, Shareholder, Littler Mendelson
David Drossman, Vice President, Deputy Information Security Officer, Federal Reserve Bank of New York
Raj Ananthanpillai, Chairman, CEO, IDentrix

Room 308 (more…)

+ Understanding the Regulators: A Data Breach Enforcement Exercise to Improve Risk Management

Understanding the Regulators: A Data Breach Enforcement Exercise to Improve Risk Management

Session Level: 101 (2016)

This session is a “regulatory” tabletop exercise with participants in the roles of various regulators. It explores how their goals and approaches differ, and how this inform corporate expectations at different parts of the incident preparation, discovery and remediation process. We will walk through the data breach from the regulatory perspective with the corporate side in the room, and hope to gain some insight into which regulatory approaches are most effective in enhancing cybersecurity.

Ed McNicholas, Partner, Sidley Austin LLP
Maneesha Mithal, Bureau of Consumer Protection, Federal Trade Commission
Matthew Noyes, Cyber Policy Advisor, U.S. Secret Service
Clark Russell, Deputy Bureau Chief, New York State Attorney General Office

Room 407 (more…)

+ Cyberinsurance Policies in the Courts

Cyberinsurance Policies in the Courts

Session Level: 201 (2016)

What does the empirical record reveal about cases where cyberinsurance policies were litigated through to judgment? This session examines the growing caselaw regarding cybersecurity insurance, the influence of tort law concepts in this area (including negligence and causation), and the implications of this caselaw for the cyberinsurance market.

Jay P. Kesan, Professor, University of Illinois at Urbana-Champaign, College of Law
Catherine Sharkey, Professor of Law, New York University Law School

Room 407 (more…)

+ The Cybersecurity Challenges for In-House Attorneys

The Cybersecurity Challenges for In-House Attorneys

Session Level: 201 (2016)

This session will focus on key items in-house attorneys face when advising clients (c-suite, directors and business partners) on cybersecurity and data security matters. The speakers will provide an engaging discussion on legal issues around: incident response, with a view towards detection and remediation of attack on your environment and challenges beyond data breaches, as well as risk assessments, audits toward industry standards and certifications, working with suppliers, security by design, use of intrusive security monitoring technology coupled with usage implications around the world.

Doug Weiner, Senior Counsel, Cyber Security, Hewlett Packard Enterprise
Cristin Goodwin, Assistant General Counsel, Microsoft
Christine Ricci, Executive Counsel, GE

Room 402-404

(more…)

+ Active Cyber Response: Not Your Grandfathers Self-Defense

Active Cyber Response: Not Your Grandfathers Self-Defense

Session Level: 201 (2016)

The issue of active cyber defense or hacking back is often discussed in a yes/no binary way, but active cyber response is an amalgam of techniques. Such an approach cannot rely on either a pure technology assessment or a pure legal analysis. Instead, it must combine an understanding of what is technically possible with what is legally permissible. This session will use a blend of hypothetical use cases based on the above concepts and audience Q&A to define a continuum and assess the legality and risk of various active cyber response techniques. The panel will begin by identifying some TTPs, then assessing their legality under current laws, exploring the privacy implications, and finally considering legal and policy changes that can and should be made.

Randy Sabett, Special Counsel, Cooley
Davi Ottenheimer, President, flyingpenguin

Room 311

(more…)

+ Sharing Cyberintrusion Information with the Government: Dispelling Myths

Sharing Cyberintrusion Information with the Government: Dispelling Myths

Session Level: 101 (2016)

This session will discuss calls for public-private partnerships to share details about cyberintrusions for a coordinated effort to combat aggressive and overwhelming compromises of government and private companies’ data. Although sharing information may alleviate companies from “going it alone” and can give them the heads up about intrusions so they can adequately prepare and respond, private companies are understandably nervous about giving cyberintrusion information to the government and exposing vulnerabilities. Can they trust the government to keep business information strictly confidential? How does the government protect the information? Speakers will discuss both sides of the issue and provide examples of how private industry can gain valuable information and help from the government based upon real cases.

Linn Freedman, Partner, Robinson & Cole LLP
David Aaron, Department of Justice

Room 310

(more…)

+ Security Standards Across Sectors

Security Standards Across Sectors

Session Level: 201 (2016)

Comparative session focusing on the pros and cons of the US sectoral approach to regulating the security of personal information with an effort to tease out comparative learnings and experience from financial institutions (GLB), health (HIPAA and FDA), communications (FCC) and general consumer protection (FTC) as well as state breach notifications and laws. The aim of the session would be to distill out learnings from each of these regimes and their influence on security strategy and practices.

Gerry Stegmaier, Partner, Reed Smith LLP
Dawn-Marie Hutchinson, Executive Director, Office of the CISO, Optiv
Paul Luehr, Managing Director, Stroz Friedberg

Room 301 (more…)

+ Dealing with Risk

Dealing with Risk

Session Level: 201 (2016)

There is little certainty with data protection, and a key to success in this area is conducting risk assessments/analysis, developing action plans to address those findings, and executing the action plans. The gravity of the risk can be severe, as recent horror stories involving ransomware and data breaches demonstrate. The risk can also have a high likelihood, as we are seeing a rise in the frequency of incidents. And there are so many unknowns, as the threats are evolving so quickly. With these realities and in the face of so much uncertainty, how should we best handle risks that cannot be fully eliminated?

David Sheidlower, Global Head of Information Security (CISO), BBDO
Cliff Baker, Managing Partner, Meditology

Room 310 (more…)

+ The Arc of a Data Breach

The Arc of a Data Breach

Session Level: 101 (2016)

Cyber attacks have wreaked havoc on companies in every industry sector. This session will take you through each aspect of a breach event, from identification of the event, to the forensic investigation, global legal analysis, crafting of the communications documents, engagement with regulators and law enforcement, and fielding the inevitable litigation. Understanding the timeline associated with every cyber event will help you manage an incident from the moment of discovery.

Lisa Sotto, Partner, Hunton & Williams
Ryan Vinelli, Associate General Counsel – Deputy Privacy Officer & Data Governance, Starwood Hotels & Resorts Worldwide, Inc.
Mark Seifert, Partner, Brunswick Group LLC

Room 403 (more…)

+ Protecting Knowledge Assets

Protecting Knowledge Assets

Session Level: 201 (2016)

Organizations require a holistic and adaptive approach to protecting high-value knowledge assets from cradle to grave. The value of the assets and the threats they face should drive proven approaches to identification, protection, threat detection and response commensurate with value and risk. Instead, approaches are often siloed, with unrelated and disconnected processes and safeguards for, e.g., personal data, trade secrets, intellectual property, records and company-confidential information. This session first reports on a major survey of actual corporate practices and then offers instruction on best practices and innovative ways of keeping knowledge assets safe.

Jon Neiditz, Partner, Kilpatrick Townsend & Stockton LLP
Larry Ponemon, Ph.D., Chairman and Founder, Ponemon Institute

Room 402-404 (more…)

Surveillance (2016)

Expand all

+ Image Recognition Technology: Privacy and Security Issues

Image Recognition Technology: Privacy and Security Issues

Session Level: 201 (2016)

This session will examine image recognition as an example of Artificial Intelligence and Machine Learning. There are numerous privacy and security do’s and don’ts associated with this technology, which will be subject to greater adoption over the next 3-5 years. What are the key legal lessons in this area?

Caroline McCaffery, General Counsel, Clarifai, Inc.
Jessica Turko, General Counsel, Olapic, Inc.
John Verdi, Vice President of Policy, Future of Privacy Forum

Room 310 (more…)

+ Government Access to Personal Data

Government Access to Personal Data

Session Level: 201 (2016)

Companies are increasingly faced with government requests for access to personal information, usually for law enforcement or national security reasons. The Apple v. FBI case was just one of the latest rounds in the battle between private sector companies and US governmental bodies. What do companies need to know when faced with these government requests for access to personal information? When do they have to comply? When can they fight back? Which laws apply and how have the courts interpreted them so far? This session will cover the different laws and legal theories that have been applied in the area of government requests for personal information such as CALEA, the All Writs Act, ECPA, the Fourth Amendment and the Third Party Doctrine, and other laws and cases.

Marc Zwillinger, Founder, ZwillGen PLLC
Mark Rasch, Chief Security Evangelist, Verizon Enterprise Solutions
Carrie Cordero, Adjunct Professor, Georgetown Law
Nathan Judish, Senior Counsel, Computer Crime and Intellectual Property Section, U.S. DOJ

Room 311 (more…)

+ Security vs. Security: Encryption and Law Enforcement

Security vs. Security: Encryption and Law Enforcement

Session Level: 101 (2016)

The public debate over encryption is typically framed as a zero sum game between privacy and security. With the recognition that security is foundational to privacy, we will explore how and why different aspects of security are in tension. Data, devices, and information need to be effectively secured to protect public safety and economic growth. Achieving this goal may effectively thwart law enforcement’s ability to the public safety against crime and attacks. Is there a balance point? This session will discuss the tensions arising from law enforcement access to encrypted data.

Eric Wenger, Director, Cybersecurity and Privacy Policy, Global Government Affairs, Cisco Systems
Hon. Terrell McSweeny, Commissioner, Federal Trade Commission
David Bitkower, Principal Deputy Assistant Attorney General of the Criminal Division, U.S. Department of Justice

Room 310

(more…)

+ Eyes in the Skies – Drone Privacy

Eyes in the Skies – Drone Privacy

Session Level: 101 (2016)

Unmanned Aerial Vehicle (UAV) technology is developing at a rapid pace. Obstacles for adoption are being overcome as UAV sensors and controls improve. Data collection possibilities are growing with UAVs able to take more detailed photos and video and even see through walls. These developments are putting drones on a course for more omni-present use, wider application and more extensive data collection. This session will discuss the commercial and governmental privacy and civil liberties considerations, including the developing international laws, guidance and best practices around privacy and security.

Susan Lyon-Hintze, Founder, Hintze Law PLLC
Amie Stepanovich, U.S. Policy Manager, Access Now
Gerdo Kuiper, LL.M. (Master in law and legal philosophy); PhD candidate, University of Amsterdam

Room 302

(more…)

+ Surveillance Law in the US and EU

Surveillance Law in the US and EU

Session Level: 201 (2016)

The Schrems case made the issue of government surveillance one of great relevance for commercial activity for businesses, as the court’s view that the US lacked adequate legal control over government surveillance led to the invalidation of the Safe Harbor Arrangement. How does the law regulating US government surveillance differ from laws regulating surveillance in EU countries? Should government surveillance be a consideration for data transfer? Should the US restrict data transfer to countries that have poor regulation of government surveillance? What kinds of improvements can be made to US surveillance law that will satisfy the EU?

Rachel Brand, Member, U.S. Privacy and Civil Liberties Oversight Board
Karl-Nikolaus Peifer, Professor, University of Cologne Law School, Germany
Paul Schwartz, Jefferson E. Peyser Professor, University of California Berkeley School of Law

Room 402-404 (more…)

+ Computer Crime: New Developments

Computer Crime: New Developments

Session Level: 301 (2016)

This session will explore new developments in computer crime, including the 4th Amendment, Electronic Communications Privacy Act (ECPA), and the Computer Fraud and Abuse Act (CFAA).

Orin Kerr, Professor, George Washington University Law School
Nathan Judish, Senior Counsel, Computer Crime and Intellectual Property Section, U.S.
DOJ

Room 308 (more…)

The Internet of Things (2016)

Expand all

+ Securing IoT: Think Outside the Wall

Securing IoT: Think Outside the Wall

Session Level: 201 (2016)

Most of the devices in the Internet of Things (IoT) reside outside of your security wall. Some, such as mobile point-of-sale terminals and other publicly accessible devices, are outside because they could be a gateway for malicious attacks. Others, such as sensors and remote monitors, may be too distant to include inside. And some, such as medical devices and other specialized tools, may be outside of IT’s sphere. However, all of these devices still need to be protected. With little or no local storage, IoT devices are heavily dependent on communications, so securing the communications path is as important as hardening the device. This session will explore how protecting the IoT is not like protecting a data center. Securing the IoT requires looking at the whole ecosystem, not just individual points and devices.

Alex Wall, Senior Counsel & Global Privacy Officer, RADAR, Inc.
Julie Brill, Partner, Hogan Lovells US LLP
Ned Miller, Chief Technology Strategist, Public Sector Division, Intel Security Group

Room 310 (more…)

+ Managing Security Vulnerabilities: The Communications Imperative

Managing Security Vulnerabilities: The Communications Imperative

Session Level: 101 (2016)

With the rise of the Internet of Things and the near ubiquity of mobile, companies in almost every sector are building software that is helping them innovate and redefine how they engage with customers. However, along with this innovation, comes the increased potential for security vulnerabilities that can cause significant business and reputational damage if not properly managed. While major software providers have learned the important nuances with communicating about and patching vulnerabilities, this is a new area for many organizations. This session will bring together communications, legal and technical experts to share best practices on dealing with this growing risk. From working with security researchers to addressing tough questions for business customers, you will leave with a better understanding of how to manage this important issue.

Leigh Nakanishi, Senior Data Security & Privacy Strategist, Technology Practice, Edelman
Lauren Koszarek, Communications Director, HackerOne
Antony Kim, Partner, Orrick, Herrington & Sutcliffe LLP

Room 310 (more…)

+ Privacy and Security in the Connected World

Privacy and Security in the Connected World

Session Level: 201 (2016)

Household consumer electronics raise a variety of complex privacy and data security concerns, including those that cross different sectoral regulatory lines. These devices have the ability to capture sensitive data including behavioral and health information and are often used by family members of all ages. This session will discuss these challenges and propose solutions for reducing risk through these devices.

Sarah Bruno, Partner, Arent Fox
Cassius Titus, Senior Counsel, LG
Evie Kyriakides, Chief Privacy Officer and Associate General Counsel, Global Digital, Privacy and Security, Mars, Inc.
Caroline Boulanger, Digital Attorney, Hasbro

Room 403 (more…)

+ The Law of Connected Devices: Privacy and Litigation Risks

The Law of Connected Devices: Privacy and Litigation Risks

Session Level: 201 (2016)

This session will highlight the risks that technology companies and manufacturers of connected devices face in light of the various technologies that comprise the “Internet of Things.” Certain types of manufacturers have different risk profiles because their connected devices could be deadly. Join two experienced trial lawyers and a transaction/privacy lawyer as they discuss the allocation of risks, and the real world litigation that arises from various incidents.

Beth Hill, General Counsel & Chief Compliance Officer, FordDirect
Tom Dupree, Partner, Gibson Dunn
Patrick Seyferth, Partner, Bush Seyferth & Paige PLLC
Jeff Brueggeman, VP, Global Public Policy, AT&T

Room 403 (more…)

+ Regulating the Internet of Things and Big Data: The Role of the FTC

Regulating the Internet of Things and Big Data: The Role of the FTC

Session Level: 201 (2016)

This session will explore the new challenges ahead for regulating the Internet of Things and Big Data. FTC Director Jessica Rich will discuss and analyze different dimensions of these issues with Kurt Wimmer.

Jessica Rich, Director, Bureau of Consumer Protection, FTC
Kurt Wimmer, Partner, Covington & Burling

Room 407 (more…)

Third Party Relationships (2016)

Expand all

+ Compliance and the Cloud

Compliance and the Cloud

Session Level: 201 (2016)

Managing regulatory compliance for IT systems is a complex task because different industries and regions can have their own standards and regulations. How do cloud vendors deal with different standards and regulatory requirements? Can we move to the cloud and still conform with myriad regulations? This session explores how customer and cloud vendor can work together to achieve compliance in the cloud.

Tracy Mitrano, Academic Dean of the Trust, Assurance & Cybersecurity Certificate Program, University of Massachusetts Amherst
Craig Dean, Chief Technology Officer, Orrick
William Martorelli, Principal Analyst serving Sourcing & Vendor Management Professionals, Forrester Research, Inc.
Doug Miller, Principal Consultant, Milltech Consulting

Room 301 (more…)

+ Addressing the Threat to Large Organizations from Data Protection in Small and Medium Enterprises (SMEs)

Addressing the Threat to Large Organizations from Data Protection in Small and Medium Enterprises (SMEs)

Session Level: 201 (2016)

Understanding the world of SME privacy and security should be a precursor to development of any vendor management program. Data protection awareness, preparation and response of SMEs differs from large enterprises and can have positive or negative downstream consequences for large entities from Government to Universities to Fortune 500 companies. This session will discuss real word examples of SME breaches impacting larger entities. More importantly we’ll outline how different approaches directly impact large organizations that routinely underestimate the role SMEs play in their organization when measuring risk relative to their much smaller vendors, resellers, franchisees, and clients.

Eduard Goodman, Chief Privacy Officer, IDT911
Linn Freedman, Partner, Robinson & Cole LLP
Ondrej Krehel, Digital Forensics Lead, CEO and Founder, LIFARS LLC

Room 311 (more…)

+ Privacy & Security for Federal Agencies & Government Contractors

Privacy & Security for Federal Agencies & Government Contractors

Session Level: 201 (2016)

This session will review privacy and security requirements for Federal government agencies and their contractors and highlight challenges from both their perspectives. The session will also discuss what agencies and contractors need to worry about in their contracts. Finally, the interplay of Federal, state and international privacy and security requirements in the government sector will be explored.

Amy Carlson, Of Counsel, Stoel Rives LLP
Logan O’Shaughnessy, Lead, Privacy Incident Management and Response, U.S. Department of Health and Human Services
Cheryl Tomlinson, Privacy Specialist, Corporate Legal – Privacy, Leidos

Room 311 (more…)

+ Vendor Management: Three Sides of the Coin

Vendor Management: Three Sides of the Coin

Session Level: 201 (2016)

What are the key parts of privacy and security vendor management? What role does a privacy office, a security office, a procurement office, and counsel play in the process? What level of vendor oversight is the government looking for, what level is best practice, and how does an organization focus limited resources to best reduce risk in this area? How important is a right to audit to obtain in contract? How important is it to actually audit vendors (especially with limited resources)? How much credence should be given to independent assessments, such as a SOC 2 report? Should vendors provide documents such as a risk analysis or internal policies to their customers, or does that actually raise more information security concerns than it addresses?

Rebecca Herold, CEO, The Privacy Professor® and CVO & Co-Founder, SIMBUS360
Andrew Ysasi, Executive Director, Kent Record Management, Inc.
Stacey Halota, Vice President, Information Security and Privacy at Graham Holdings

Room 301 (more…)

2019 | Washington, D.C.

Privacy + Security Forum

Save the Date

April 3-5, 2019 | Washington, DC

Schedule 2016

Pre-Conference Day: Monday, October 24, 2016 Day 1: Tuesday, October 25, 2016 Day 2: Wednesday, October 26, 2016

Oct 24

Oct 25-26

Level 1

Level 2

Level 3

Workshops

Intensive Days

Main Event Sessions

Intensive Day:

Health Privacy + Security

Intensive Day:

EU Privacy

Intensive Day:

Data Security

Workshops

+ Privacy Compliance in the Cloud

Privacy Compliance in the Cloud

+ Digital Advertising Regulation in a Changing World

Digital Advertising Regulation in a Changing World

+ Assessing Risks and Cyber Insurance Needs

Assessing Risks and Cyber Insurance Needs

+ Understanding the FTC on Privacy and Data Security

Understanding the FTC on Privacy and Data Security

+ Information Privacy Law: Foundations

Information Privacy Law: Foundations

+ Data Security Law: Foundations

Data Security Law: Foundations

Sessions

Advertising & Marketing Privacy & Security (2016)

+ Native Advertising

Native Advertising

+ The Internet’s Digital Advertising Architecture: From Cookies to Addressable TV and the privacy issues in between

The Internet’s Digital Advertising Architecture: From Cookies to Addressable TV and the privacy issues in between

+ Privacy Implications of Retail Tracking

Privacy Implications of Retail Tracking

+ Trust and Transparency in the Online Advertising Ecosystem

Trust and Transparency in the Online Advertising Ecosystem

+ Digital Advertising Self-Regulation: A Comparison of Approaches

Digital Advertising Self-Regulation: A Comparison of Approaches

+ Tracking and Targeting: Online, on Mobile Devices, and in Social Media

Tracking and Targeting: Online, on Mobile Devices, and in Social Media

Big Data (2016)

+ Data Monetization

Data Monetization

+ Big Data and Discrimination

Big Data and Discrimination

Communications Privacy & Security (2016)

+ The FCC’s Privacy and Data Security NPRM and the Internet Ecosystem

The FCC’s Privacy and Data Security NPRM and the Internet Ecosystem

+ The FCC’s Impact on Consumer Privacy Issues – A Case Study for Organizations and Regulators

The FCC’s Impact on Consumer Privacy Issues – A Case Study for Organizations and Regulators

Consumer Privacy & Security (2016)

+ The Fair Credit Reporting Act; 45 Years of Lessons from the World’s First Fair Information Practice Statute

The Fair Credit Reporting Act; 45 Years of Lessons from the World’s First Fair Information Practice Statute

+ Keeping Up with the FTC’s Common Law of Privacy: Hitting a Moving Target

Keeping Up with the FTC’s Common Law of Privacy: Hitting a Moving Target

+ Moral Humans and Amoral Algorithms: How Machine Learning Creates Privacy and Ethics Exposures and What You Need to Know About It

Moral Humans and Amoral Algorithms: How Machine Learning Creates Privacy and Ethics Exposures and What You Need to Know About It

+ Data Assets in Commercial Transactions

Data Assets in Commercial Transactions

+ Class Action Litigation: Privacy, Data Breach, and the TCPA

Class Action Litigation: Privacy, Data Breach, and the TCPA

+ State Attorneys General Privacy Enforcement: Present and Future

State Attorneys General Privacy Enforcement: Present and Future

+ Privacy and Security Lessons from the FTC’s 100-Year History and Activities in Other Areas

Privacy and Security Lessons from the FTC’s 100-Year History and Activities in Other Areas

+ Privacy and Data Security Harms and Standing

Privacy and Data Security Harms and Standing

+ Privacy and Security Enforcement Overlap and Coordination

Privacy and Security Enforcement Overlap and Coordination

+ The FTC CID Demystified

The FTC CID Demystified

Culture & Media (2016)

+ Dramatizing Privacy and Security

Pre-Conference Day: Monday, October 24, 2016
Day 1: Tuesday, October 25, 2016
Day 2: Wednesday, October 26, 2016