Rich Young

CIMS, or Centralized Information Management System, seems to be a significant initiative aiming to streamline regulatory and supervisory return submissions. By centralizing these processes, it likely enhances efficiency, data integrity, and regulatory compliance. Replacing the existing XBRL system suggests a shift towards a more integrated and possibly standardized approach to managing regulatory data. This could potentially simplify reporting for institutions while providing regulators with better oversight and analysis capabilities. Overall, such systems often signify a modernization and improvement in regulatory frameworks within financial or other regulated sectors. #Companysecretary #charteredaccountant #practicingcompanysecretary #corporatelawyer #RBI #RBIconsultants

17

What to expect from the California Privacy Protection Agency meeting today? Some highlights: Objection to preemptive Federal privacy law: The CPPA will discuss its position on this law, which objects to preemption - this is is also in a letter from Executive Director Soltani and a number of State AGs (https://lnkd.in/erQvhJuX) Discuss California Privacy/AI bills including: (https://lnkd.in/eHRpEzHQ) 🔹 Requiring browsers to honor opt out preference signals (OOPS) (AB 3048) 🔹 Removing the M&A carve out and making data sharing during an asset purchase - a potential sale (AB 1824) 🔹 Adding neural data to the definition of sensitive information (similar to Colorado) (SB 1223). 🔹 Prohibiting a developer from using personal information of an under 16 to train AI without authorization (AB 2877) 🔹 Requiring registration of data digesters (aka "providers" under EU AI Act) and giving AI enforcement authority to the CPPA (AB 3204) 🔹 Imposing requirements re: algorithmic discrimination on developers and deployers (AB 2930) 🔹 Requiring consent for selling or sharing of information of under 18s (AB 1949) [Staff recommended that the agency supports this subject to amendment] (https://lnkd.in/ePDm2uma) 🔹 Data Broker registry regulations (https://lnkd.in/eVqenp-J) (recommend to move to formal rulemaking: https://lnkd.in/eR_hzxJS) 🔹 Amendments to existing regs (https://lnkd.in/ejMng6Jn) #dataprivacy #dataprotection #privacyFOMO #AIFOMO

29

Next phase of cyber and telecom national security regulatory enforcement is ramping.

3

Investigations into cyber incidents represent a critical facet of modern digital security, encompassing a multifaceted process aimed at understanding, mitigating, and preventing cyber threats. The journey begins with detection, where sophisticated monitoring systems, user alerts, or anomalous activity reports flag potential incidents. Swift and precise detection is vital to minimizing damage and thwarting further compromise of systems or data. Following detection, containment becomes the immediate priority. This involves isolating affected systems or networks to prevent the spread of the incident and mitigate its impact. Containment strategies may vary depending on the nature and severity of the incident but are essential to buying time for investigators to assess the situation thoroughly. Digital forensics constitutes a cornerstone of cyber incident investigations. Forensic analysts meticulously examine digital evidence to unravel the scope of the breach, uncover vulnerabilities exploited by attackers, and gather crucial data for legal proceedings or disciplinary actions. Maintaining the integrity of digital evidence through proper documentation and chain of custody procedures is paramount at this stage. Analysis delves deeper into the incident, seeking to understand the motives driving the attack, the techniques employed by perpetrators, and the potential ramifications for the organization. This phase often involves collaboration between cybersecurity experts, forensic analysts, and threat intelligence professionals to glean insights and develop effective countermeasures. Remediation efforts follow, focusing on addressing the vulnerabilities exploited in the incident to fortify defenses against future attacks. This may involve patching software, enhancing security protocols, or implementing robust employee training programs to bolster awareness and resilience. Finally, comprehensive reporting encapsulates the findings, actions taken, and recommendations arising from the investigation. Such reports serve as invaluable resources for stakeholders, regulators, or law enforcement agencies, aiding in understanding the incident, assessing its impact, and devising strategies for preemptive measures and incident response enhancements. Throughout the entire investigative process, adherence to legal and regulatory frameworks, transparent communication among stakeholders, and a commitment to continuous improvement are essential principles guiding cyber incident response efforts.

26

The recently unveiled American Privacy Rights Act (APRA) would regulate the collection, processing, retention, and transfer of “covered data” by certain entities, setting significant data privacy and security standards across the US. APRA also includes several impactful provisions that would affect organizations and entities developing and utilizing artificial intelligence (AI). Our alert provides key considerations for these proposals from the perspective of AI. #dataprivacy #AI #APRA

2

So Verified Data has this really useful tool, that provides all sorts of automated analytics audits & analysis for important business use cases. I've been a fan ever since Brian launched the first iteration of it back in 2018. When ConstruKtion was initially launched in 2020 as a Google Analytics (GA) repair shop, this was one of the core tools identified to help pinpoint tough-to-spot data quality issues at scale. The thing to remember is that every GA implementation is unique... partly because your data is unique and also because your implementation is likely unique. Did you know that there are 50+ common points of differentiation with every out-of-the-box implementation... before even diving into the custom attribute, dataLayer, event and tag taxonomies?!?! With everyone producing activity data for your org (customers, internal teams, partners, prospects, vendors, etc.) there is a fair amount of work to ensure the data is prepped to enable the right, actionable insight. It's so easy to act on data that drives your resources in circles and opposite directions, without even realizing it!

2

1件のコメント

The advanced search functionality of The Legal Accountability Project’s Centralized Clerkships Database is a feature that truly sets our #legaltech and #transparency platform apart from other #clerkship resources. 👨‍💻Database users logging in right now can search for judges not just by name, state, and court, but also by: race, gender, law school, and appointing president/governor.  ⚖️Whether you want to clerk for a judge of your race or gender, or who generally aligns with your ideology, or from your law school (or some combination!), we’ve got you covered. LAP’s Database is a one-stop shop for comprehensive #clerkship info. We offer the most candid picture of #clerking to date. ⚙️WHY did we design the platform this way? 💡This resource is heavily influenced by what students want to know before clerking, and what clerks wish they’d known before clerking. It’s user-friendly to facilitate a seamless, and informed, #clerkship search. 💡It’s nice to have tons of info about #clerkship experiences. But that’s of limited value when it’s difficult to sift through, especially under time constraints. We’ve solved for inefficiencies in information-sorting and information-sharing. 💡Some #clerkship applicants will apply broadly. Others have a much more narrow interest. Centralizing and #democratizing info increases the likelihood you’ll find what you’re looking for in LAP's Database. ✨LAP’s Database is the ONLY resource that offers this type of advanced search functionality. That’s a choice. ✨Some schools have conveyed that they’ve struggled to collect information about law clerk alumni's experiences and make it #accessible in a usable format for students. ✨ For the well-resourced schools that have heavily invested in their #clerkship resources, it’s a decision, what information you present to students (and what you don’t), how it’s presented, and how easy it is to find. 🔊So, wherever you are in your #clerkship search, register *today* for the *real deal* on clerking. 🔊And if you clerked, share your experience with LAP and contribute to LAP’s clerkship #transparency movement. We’ve democratized judicial #clerkships and empowered 1,000+ #clerkship applicants this year to be informed and discerning consumers of opportunities. #clerkships #courts #transparency #legaltech

22

1件のコメント

Our latest practical article on navigating PRC cross-border data flow regulations, particularly with the latest CAC regulations issued in March. https://lnkd.in/g6Hm8rx5

22

1件のコメント

This export controls and trade compliance system, designed using the GRC Capability Model (from OCEG.org), helps organizations navigate the complex world of international trade. Walk through the following with your Team and your advisors, to flesh it out for your organization. Don't simply settle for a memo from those advisors. Ask them to help you build a management system. If they can't, find another advisor that can help you. LEARN: External: Analyze relevant export regulations, monitor geopolitical risks and benchmark best practices. Internal: Identify export control touch-points in products, services and supply chains. Assess existing processes and IT systems. Culture: Evaluate employee awareness of export regulations and the organization's compliance culture. Stakeholders: Identify key internal and external stakeholders and understand their export compliance needs. ALIGN: Direction: Establish a clear mission and values for export compliance, emphasizing ethical conduct and adherence to regulations. Objectives: Set measurable objectives, like reducing violations and improving training. Use KPIs to track progress. Identification & Analysis: Pinpoint potential export control risks and analyze their likelihood and impact. Design: Develop a comprehensive program framework with risk-based controls, policies, training and technology solutions. PERFORM: Controls: Implement proactive, detective and responsive controls to manage export risks. Policies & Procedures: Create clear policies and procedures for all export-related activities. Communication: Establish clear communication channels and provide regular updates on regulations. Education: Deliver targeted training on export control regulations and internal procedures. Incentives: Reward employees for demonstrating strong export compliance. Notification & Inquiry: Set up reporting mechanisms for potential violations and conduct regular audits. Response: Develop procedures for investigating violations and taking corrective actions. REVIEW: Monitoring: Track KPIs, review policies and ensure technology remains effective. Assurance: Conduct internal audits and consider external assessments. Improvement: Use monitoring and assurance data to identify and implement improvements. This GRC-driven approach helps organizations mitigate risks, achieve compliance and promote a culture of responsible global trade. See also: A Crash Course in Trade Compliance, at https://lnkd.in/gncWCui7 Baker McKenzie’s Annual Compliance Conference, at https://lnkd.in/giUyHDry You can then supplement this information with jargon-powered research on Perplexity & Google AI Search.  For the latter, go to Google Labs, toggle it on.

2

I had the pleasure of participating with Lily Li on an AI privacy panel at Western State College of Law. Her content on LinkedIn is excellent. I know you'll find this helpful: "An overview of the twelve (and counting!) US state comprehensive privacy laws."

2

2件のコメント

INTERNET, IT & E-DISCOVERY BLOG:  Kaspersky Executives were Sanctioned, but old news going back to at least 2018! https://lnkd.in/gZnSp4Pr https://lnkd.in/g8_Vi_pu My January 2018 blog was titled “Cybersecurity Software: Kaspersky Lab filed a lawsuit against US government to enjoin federal ban!”  (https://lnkd.in/g32YYQiZ)  and now GovInfoSecurity.com is reporting that “Senior executives of Russian cybersecurity firm Kaspersky face new restrictions against doing business in Western countries following an announcement Friday morning by the U.S. Department of the Treasury that it sanctioned 12 of them.” The June 21, 2024 article entitled “US Sanctions 12 Kaspersky Executives” (https://lnkd.in/gCSQQhAq) included these comments: The sanctions do not include company CEO Eugene Kaspersky or the company itself - which the Biden administration on Thursday banned from doing business inside the United States and effectively from obtaining U.S.-made technology (see: Biden Administration Bans Kaspersky Antivirus Software). Today's sanctions encompass the Kaspersky Lab board of directors, the company's head of research and development, the heads of consumer and corporate businesses and other members of the executive team. The sanctions prevent blacklisted individuals from conducting business transactions with U.S. financial institutions or individuals. Treasury has ramped up sanctions pressure on Russia and Russian corporations as the Kremlin war of conquest against European neighbor Ukraine continues well into its second year. Earlier this month, the department prohibited American companies from offering IT support or cloud services for enterprise management software or applications used in design or manufacturing. No surprise about these sanctions! https://lnkd.in/gZnSp4Pr https://lnkd.in/g8_Vi_pu #kaspersky #cyber

4

US intelligence agencies, under a privacy framework issued by the Director of National Intelligence, will set privacy restrictions on the agencies' use of US consumer data provided by third-party data brokers. That type of data, referred to as "commercially available data" has been used in the past to aid intelligence efforts against terrorists, traffickers and cyberattacks. The framework is intended to exceed current rules and laws that govern the agencies' ability to surveil potential threats that may implicate Americans' personal data. From the article: '"The framework sets out rules for how to collect and analyze commercially available data on foreigners and Americans, but grants each agency “flexibility to experiment” in how they approach using the data. “This is information that can be purchased by pretty much anyone, including, frankly, individuals overseas,” said Jason Barrett, a senior U.S. official for open-source intelligence. U.S. spy agencies, he said, are trying to ensure that they are lawfully using the data with ample privacy protections in place while still relying on it to “help us more quickly identify threats.”'  "The 12-page framework affords greater protections to what is described as sensitive information, defined as data sources that are known or expected to contain a large volume of material about Americans or U.S. companies or could be used to identify specific American individuals—even if that data is anonymized. The framework also limits capturing data that could contain sensitive activities of Americans, such as information that could reveal personal affiliations or the exercising of rights such as speech and worship. Limits include restrictions on personnel accessing data, identifying mission needs to use the data, and filtering or anonymizing data whenever possible to reduce privacy risks." #privacy #privacymatters #privacypros #databrokers #dni  

8

🚨 China's New State Secrets Law: A Wake-Up Call for Businesses 🚨 Attention all companies operating in China: the game has changed. 🇨🇳 The revised state secrets law, with its expanded scope and tightened regulations, is set to reshape the business landscape. It's time to adapt and fortify your compliance strategies. 🔒 Under the new law, internet firms are now required to monitor user-generated content for sensitive information, remove such posts, preserve records, and report to authorities. This reflects President Xi Jinping's heightened focus on national security and the government's intensified crackdown on China's technology sector. For businesses, this means: 1) Increased scrutiny: The ambiguity surrounding "work secrets" and the expanded scope of sensitive information could lead to inadvertent violations and legal risks. 2) Data management challenges: Robust data management and compliance practices are no longer optional; they're a necessity to navigate this new landscape. 3) Proactive compliance: Staying vigilant and proactive in your compliance strategies is key to mitigating risks and ensuring smooth operations. As a business leader, I understand the concerns and uncertainties this change brings. But I also see it as an opportunity to strengthen our resilience and adaptability. 💪 I want to hear from you: How is your company preparing for these regulatory changes? What strategies are you implementing to ensure compliance and mitigate risks? Share your thoughts, experiences, and best practices in the comments below. Let's navigate this new landscape together and emerge stronger! #Compliance #DataManagement #ChinaLaw #CorporateGovernance #NationalSecurity #StateSecretsLaw #RegulatoryLandscape #BusinessResilience #RiskMitigation

7

1件のコメント

I was negotiating with a tech vendor where the contract draft left us exposed to data loss liabilities due to failure on the vendor's part. They wont accept my mitigative corrections via email. We had been trying to close the contract since two months now but couldn't reach a conclusion. After a 15 minute call, everything was resolved. What worked? 1) Active listening and showing empathy When someone speaks with "legal" they expect outright disregard of their contentions. I told them 'I understand why you are uncomfortable with the proposed changes'. They didn't expect that. 2) Diagnostic questions I asked questions. "What is your biggest concern?" "How can we reach an amicable solution?" Their feeling of being heard was palpable. The tone quickly shifted to that of conflict resolution. 3) Effective communication It is at this point where I made my position clear by using simple, polite language. Having a risk exposure like that was not acceptable. They agreed. Although unwilling at first, they now accepted liability with a cap on it. A classic win-win middle ground. In hindsight, this could've been an email. But, people like to talk things out. Businesses are not built on paper but relationships. And that is why soft skills like clear communication, conflict resolution and empathy go a long way. What's your take?

20

1件のコメント