2016 IAPP Global Privacy Summit: Key Themes And Takeaways

Article by Sam Castic and Aravind Swaminathan

Last month, privacy and security professionals from around the world gathered in Washington, D.C. for the International Association of Privacy Professionals' Global Privacy Summit 2016. The conference focused on the new perspectives in privacy that welcome (back) the human element, the increasing role of governmental regulators in establishing and enforcing security and privacy practices, and new EU-centered developments in privacy that will likely have long lasting impacts through the industry.

We were there to take it all in, and offer these five key areas of emphasis and takeaways.

The Role of the Regulator. Every year, the IAPP showcases regulators from the U.S. and abroad, to offer perspectives on privacy and security. This year there appeared to be even greater emphasis on the role of the regulator in shaping privacy and security through enforcement actions, examinations/audits, and their prominent role in establishing best practices in security. More than one-third of the approximately 80 full length panel presentations featured government agency representatives and regulators. Beyond the typical expected agencies (e.g., the Federal Trade Commission, Federal Communications Commission, various Attorneys General's Offices, Department of Commerce, and the Department of Health and Human Services), representatives from non-traditional government agencies made notable appearances, including the U.S. Department of Transportation, the Consumer Financial Protection Bureau, Department of Education, Commodity Futures Trading Commission, and the City of Seattle. In a possible signal from these agencies that they intend to get more involved in cybersecurity and data privacy in 2016, they discussed a wide variety of new topics, including the connected devices and the internet of things, financial institution examinations, and encryption. Organizations, especially those that are in highly regulated industries, are well-counseled to take this as a sign that enforcement investigations and proceedings have not yet reached their high point. GDPR and European Privacy. Unsurprisingly, a number of sessions explored the forthcoming implementation of Europe's GDPR - its General Data Protection Regulation. The GDPR will involve sweeping changes to Europe's regulation of privacy and data protection, including extraterritorial applicability to any company that provides services to European residents, and...