Compliance Perspectives

By Adam Turteltaub

Joseph Agins, Compliance Officer for Sam Houston State University in Texas isn’t a big fan of sitting behind the desk.  Instead he believes in what he calls “compliance by wandering around.”  As he explains in the podcast, that doesn’t mean roaming the halls endlessly.  It’s much more strategic than that.

It includes meeting with employees, compliance partners and management so that the compliance team has a better idea of what people are doing, while at the same time providing an opportunity to demonstrate the value proposition of compliance.

It is also an opportunity to break down barriers and truly listen to people, understand what they do, provide assistance and get better results, including making the workforce more comfortable about bringing issues to compliance.   Likewise, it’s easier to hear about problems when you are out and about.

Listen in to learn more about how to wander purposefully.

By Adam Turteltaub

The European General Data Protection Regulation (GDPR) has kept compliance officers busy for the last few years, and has kept consumers clicking “I Accept” more than they ever imagined.

For those thinking the wave of work is over, it’s time to think again.  The California Consumer Privacy Act (CCPA) is due to go into effect on January 1, 2020 with enforcement beginning July 1.  As Teresa Troester-Falk, Chief Global Privacy Strategist for Nymity explains, the law applies to more than businesses based in California.  It affects any business that processes data of California residents and has either $25 million or more revenues, shares or sells data for commercial purposes on 50,000 or more California residents or gains 50% or more of its revenues from selling consumer information.  That’s a low enough threshold to affect a sizable portion of the business community.

The good news is that any business that has already worked to meet the GDPR’s mandates has gone a long way to matching the requirements of the CCPA.  The law focuses, she explains, on the obligations to protect consumer rights.  But, it breaks new ground by giving consumers the right not to have their data sold to third parties.  In addition, if a consumer requests an organization deletes information it has on him or her, that organization must also pass that request down to third parties that it has provided data to.

More, California is not alone.  Several other states have laws in various stages of the legislative process.  As a result, business must be prepared for future regulations that will affect how they handle consumer data.

Listen in to learn more about the CCPA’s requirements, and what organizations need to do to meet them.

By Adam Turteltaub

The European General Data Protection Regulation (GDPR) has kept compliance officers busy for the last few years, and has kept consumers clicking “I Accept” more than they ever imagined.

For those thinking the wave of work is over, it’s time to think again.  The California Consumer Privacy Act (CCPA) is due to go into effect on January 1, 2020 with enforcement beginning July 1.  As Teresa Troester-Falk, Chief Global Privacy Strategist for Nymity explains, the law applies to more than businesses based in California.  It affects any business that processes data of California residents and has either $25 million or more revenues, shares or sells data for commercial purposes on 50,000 or more California residents or gains 50% or more of its revenues from selling consumer information.  That’s a low enough threshold to affect a sizable portion of the business community.

The good news is that any business that has already worked to meet the GDPR’s mandates has gone a long way to matching the requirements of the CCPA.  The law focuses, she explains, on the obligations to protect consumer rights.  But, it breaks new ground by giving consumers the right not to have their data sold to third parties.  In addition, if a consumer requests an organization deletes information it has on him or her, that organization must also pass that request down to third parties that it has provided data to.

More, California is not alone.  Several other states have laws in various stages of the legislative process.  As a result, business must be prepared for future regulations that will affect how they handle consumer data.

Listen in to learn more about the CCPA’s requirements, and what organizations need to do to meet them.

By Adam Turteltaub

The French Commission Nationale de l’Informatique et des Libertés, better known as CNIL, is one of the foremost authorities in Europe and globally when it comes to the protection of individual data.  With the implementation of GDPR, the stakes have been raised and more companies will find themselves under the microscope of CNIL and other data regulators.

Noémie Lichon, the Head of Sanctions and Litigation at CNIL, sat down for a podcast in which she discussed CNIL’s mission, activities, expectations and common problems that affect organizations that hold consumer data.

As she explains, the mission of CNIL is to ensure that data privacy law is applied to the collection, use, and storage of personal data.  CNIL informs individuals of their rights under the laws of France and GDPR.  In addition, it provides guidance to businesses and other organizations on how to ensure that they comply with data laws.  It can also levy penalties, including in January 2019 a €50 million fine of Google.

Take the time to listen in as she shares:

* Data on complaints, investigations, and sanctions

* Common problems that lead to security breaches

* The importance of compliance to security practices

* GDPR expectations for response times from data controllers

* The Google case

* CNIL’s key priorities for the immediate future

Also, be sure to take advantage of the resources she refers to in her podcast, all available on the CNIL website:

Guide:  Security of Personal Data

Guidelines on Transparency

Guidelines on Consent

Presentation of the 2018 Activity Report and 2019 Issues of the French Data Protection Authority

By Adam Turteltaub

The French Commission Nationale de l’Informatique et des Libertés, better known as CNIL, is one of the foremost authorities in Europe and globally when it comes to the protection of individual data.  With the implementation of GDPR, the stakes have been raised and more companies will find themselves under the microscope of CNIL and other data regulators.

Noémie Lichon, the Head of Sanctions and Litigation at CNIL, sat down for a podcast in which she discussed CNIL’s mission, activities, expectations and common problems that affect organizations that hold consumer data.

As she explains, the mission of CNIL is to ensure that data privacy law is applied to the collection, use, and storage of personal data.  CNIL informs individuals of their rights under the laws of France and GDPR.  In addition, it provides guidance to businesses and other organizations on how to ensure that they comply with data laws.  It can also levy penalties, including in January 2019 a €50 million fine of Google.

Take the time to listen in as she shares:

* Data on complaints, investigations, and sanctions

* Common problems that lead to security breaches

* The importance of compliance to security practices

* GDPR expectations for response times from data controllers

* The Google case

* CNIL’s key priorities for the immediate future

Also, be sure to take advantage of the resources she refers to in her podcast, all available on the CNIL website:

Guide:  Security of Personal Data

Guidelines on Transparency

Guidelines on Consent

Presentation of the 2018 Activity Report and 2019 Issues of the French Data Protection Authority

By Adam Turteltaub

May 2, 2019 saw the release by the US Department of the Treasury’s Office of Foreign Asset Control (OFAC) of a watershed document:  A Framework for OFAC Compliance Commitments.  As Gibson & Dunn partner Judith Alison Lee explains in this podcast, this is the first time that OFAC has issued guidance for compliance programs.  With its publication, organizations with OFAC compliance programs will find a valuable new resource, and those without a program will have a harder time explaining to the treasury why they should still receive a reduction in their fines.

The contents of the new OFAC guidance should not be surprising to anyone familiar with sanctions compliance, Ms. Lee explains.  OFAC expects companies to be able to demonstrate senior management commitment to compliance, a risk assessment, risk-based approach, internal controls and training of employees.

The real challenge will be, as with other compliance efforts, having the controls integrated into business processes.  One business process that OFAC will be paying particular attention to:  the onboarding of new customers.  Businesses are expected to do what it takes to identify the customers’ owners and see if they are listed as a designated party or entity.  That’s much more granular than the typical FCPA-third party screening.

Listen in to this podcast to learn more about what OFAC has to say about compliance programs.

By Adam Turteltaub

May 2, 2019 saw the release by the US Department of the Treasury’s Office of Foreign Asset Control (OFAC) of a watershed document:  A Framework for OFAC Compliance Commitments.  As Gibson & Dunn partner Judith Alison Lee explains in this podcast, this is the first time that OFAC has issued guidance for compliance programs.  With its publication, organizations with OFAC compliance programs will find a valuable new resource, and those without a program will have a harder time explaining to the treasury why they should still receive a reduction in their fines.

The contents of the new OFAC guidance should not be surprising to anyone familiar with sanctions compliance, Ms. Lee explains.  OFAC expects companies to be able to demonstrate senior management commitment to compliance, a risk assessment, risk-based approach, internal controls and training of employees.

The real challenge will be, as with other compliance efforts, having the controls integrated into business processes.  One business process that OFAC will be paying particular attention to:  the onboarding of new customers.  Businesses are expected to do what it takes to identify the customers’ owners and see if they are listed as a designated party or entity.  That’s much more granular than the typical FCPA-third party screening.

Listen in to this podcast to learn more about what OFAC has to say about compliance programs.

By Adam Turteltaub

Few corporate scandals begin in isolation with one person perpetrating a crime that absolutely no one else in the entire organization knew anything about.  More often, people saw something and feared speaking up.

For Josh Toas, Vice President of Compliance and Chief Compliance Officer for the Research Foundation for the State University of New York (SUNY), compliance is about more than the compliance team being willing to say “no” when it sees something wrong.  It’s about the entire organization feeling just as empowered.

The challenge, he reports, is that it is too easy for people to hold their tongue.  Employees either don’t know how to frame the conversation, fear retribution, wait until a decision has already been made, or until they are angry.  Many also feel it just isn’t worth it.  They want to just get along or believe that they are not paid enough to take the risks inherent in saying no to people in power.

To meet this challenge Josh offers several pieces of advice for the compliance team and the workforce as a whole.  These include avoiding confrontations when already angry, not sweating the small stuff, and helping people realize that everyone makes mistakes.

Listen in to learn more about how to handle confrontations professionally, and how to teach your workforce to do so as well.

By Adam Turteltaub

Few corporate scandals begin in isolation with one person perpetrating a crime that absolutely no one else in the entire organization knew anything about.  More often, people saw something and feared speaking up.

For Josh Toas, Vice President of Compliance and Chief Compliance Officer for the Research Foundation for the State University of New York (SUNY), compliance is about more than the compliance team being willing to say “no” when it sees something wrong.  It’s about the entire organization feeling just as empowered.

The challenge, he reports, is that it is too easy for people to hold their tongue.  Employees either don’t know how to frame the conversation, fear retribution, wait until a decision has already been made, or until they are angry.  Many also feel it just isn’t worth it.  They want to just get along or believe that they are not paid enough to take the risks inherent in saying no to people in power.

To meet this challenge Josh offers several pieces of advice for the compliance team and the workforce as a whole.  These include avoiding confrontations when already angry, not sweating the small stuff, and helping people realize that everyone makes mistakes.

Listen in to learn more about how to handle confrontations professionally, and how to teach your workforce to do so as well.

By Adam Turteltaub

Helplines are ubiquitous these days, but do they help?  Recent research co-authored by Kyle Welch, an Assistant Professor of Accountancy at George Washington University’s business school, is very promising.  As he explains in this podcast, his research, which used data helpline provider NAVEX Global, found that firm that have active helplines generally have higher quality corporate governance and earning reports.

Some may find this counterintuitive, thinking that more calls are a sign of trouble.  Instead, his research revealed, it is more probably a sign of a healthy work environment and business.

Listen in to hear more of his data, and to help make the business case for investing in compliance and ethics.  Also, be sure to download a copy of his research.