Page Comparison

Date

29 Mar 2021

Agenda

• Welcome/Introductions

• Antitrust

• Introductions to Information Privacy Ad-Hoc Committee Chairs

• Define Charter

• Committee Goals

  • Steps to take to achieve those Goals

• Antitrust & Approval of Minutes

• CIECA Position on Information Privacy

Meeting Minutes

• The Antitrust statement was read and agreed upon.

• Paul kicked off the meeting by thanking the co-chairs, Lance Vannalom, Caliber, and Steve Betley, Car-Part.com.

• Lance Vannalom, committee co-chair, introduced himself as the information privacy manager at Caliber.

• Paul shared that the Executive Committee asked to create an ad-hoc committee to discuss CIECA’s role as it relates to the topic of Information Privacy.

• The objectives are to:

  • Identify what role CIECA can realistically play in the area of information privacy, and

  • Develop recommendations for CIECA’s position on the topic.

• The deliverables:

  • Initial recommendations for review by the Executive Committee

  • Final recommendations for review by the Board of Trustees

• Paul shared a slide with the three elements of an Information Privacy Program:

  • Data Security-the physical and logical protection against authorization access,

  • Data Privacy-Internal policies and procedures to protect how data is used and shared (SOX / SOC 2), and

  • Data Segregation / Segmentation-Limiting what information is contained in data exports and shared outside the organization.

• A discussion was held about CIECA’s role in all three of the above and it was suggested that Data Segregation is an area where CIECA has the potential to provide input to the industry. All agreed.

• There has been some confusion in the industry about CIECA’s role in these areas. Information included on CIECA’s website that might have been confusing or misleading to some, has since been taken down. The committee said that it might be helpful to have a statement on the website about CIECA’s position in these areas and 1) recommend a company contact its IT department, and 2) provide a link to resources for more information. Phil and Lance were going to look into this.

• The committee’s charter was discussed next and the following was noted:

  • Mission

    • Identify what role CIECA can realistically play in the area of Information Privacy

      • Develop recommendations for CIECA’s position on the topics of

        • Data Security

        • Data Privacy

        • Data Segregation / Segmentation

  • Problem Statement

    • There are misunderstandings within the industry on what role CIECA plays as it relates to Data Security, Privacy and Segregation.

      Information Privacy has evolved greatly in the last 20 years. We need to be more precise and clear in our terminology and definitions as it relates to the topics of data security, privacy and segregation.

  • Scope:

    • Must have:

      • The scope is CIECA’s position / role as it relates to Data Segregation.

      • Keep the scope narrow to what CIECA can do and not take on the broader role of education.

    • Not in scope:

      • Any security or information privacy related topics that go beyond those areas that CIECA can directly influence.

  • Operating Guidelines

    • This committee is an ad-hoc committee formed for the single purpose of addressing the issue of data segmentation.

    • This is not intended to be a permanent committee.