Services / Privacy Compliance / FAQ

Privacy Compliance FAQ

Securing personal data and preparing for a breach — how CSR Readiness Pro and the Breach Reporting Service work.

Readiness Pro

What is CSR Readiness Pro?

Readiness Pro comprises the patent-pending risk assessment program CSR Readiness and the award-winning CSR Breach Reporting Service™.

How does the CSR Readiness Program work?

CSR Readiness is an online self-assessment tool that helps you review, revise and revisit your business processes for handling the PII of your customers, employees and vendors, as required by a host of legislation and regulations.

Review — take a self-assessment evaluation. Detect every location of PII in your organization and determine how it is acquired, accessed, handled, transmitted, stored and destroyed.

Revise — implement Readiness policies and remediation instructions. Remediate weaknesses and train employees using system-generated policies and procedures.

Revisit — continually improve your risk score. Routinely monitor and audit performance to meet legal, regulatory and other compliance requirements. A dashboard shows progress and generates tasks; on completion you earn a Certificate of Completion and the ID Stay Safe Digital Seal for your website and advertising.

What does the Certificate of Completion signify?

Once you have completed the self-assessment and implemented the remediation tasks, you are awarded the Certificate of Completion. It can be placed on your website and is valid for one year. Revisit your self-assessment annually to maintain it.

What does CSR Breach Reporting Service do for me?

In the event of an actual or suspected breach of PII, the CSR Breach Reporting Service reports to authorities and notifies consumers, as required. Your call to CSR’s in-house privacy professionals starts a custom evaluation of the incident; CSR files the necessary reports on your behalf and prepares consumer notification with your input.

Why do businesses need Readiness Pro?

Many state, federal and international laws require businesses to protect the PII of employees, vendors and customers. Penalties for noncompliance can include fines, prosecution and even jail time. Massachusetts and Connecticut are two of many jurisdictions that require comprehensive risk assessment, remediation and monitoring programs.

If organizations don’t have this program, what could happen?

It’s impossible to avoid every breach, but 97% of breaches could have been prevented. Accidents, errors and theft compromise information, and smart devices and wireless services compound the problem. Proactive detection and correction prevent loss and the fallout of reputation damage, lost sales, fines, lawsuits and prosecution.

The Department of Homeland Security, the FTC, Visa and the BBB all encourage businesses to protect consumer data and plan ahead. For example, the civil penalty for violating Connecticut Act No. 08-167 is $500 per violation, up to $500,000 for a single event. According to Visa, businesses should “consider a breach likely and plan accordingly.”

Does Breach Reporting Service only cover items stored with IDSAutoshred?

No. It covers the location contracted with IDSAutoshred and handles reporting and notification for a breach of all PII your business holds — in your office, in a file an employee takes home, or on a laptop stolen while you’re on vacation.

Definitions

What is personally identifiable information (PII)?

Anything that can be used to identify you — and its loss leads to identity theft. It includes name, address, phone, email, birth date, Social Security number, driver’s license, bank account and credit card information.

It also includes health information, medical records, vehicle identification and license plate numbers, login credentials and passwords, school records, voice recognition files, fingerprints, retina scans and hand prints.

What is the difference between PCI and PII?

PCI data is one type of PII. The PCI Data Security Standard protects card holder data such as card number, expiration date and security code.

What is a breach of PII?

The unauthorized access, loss, use or disclosure — by accident or criminal intent — of information that can identify an individual.

What is data breach reporting?

When a breach occurs, the clock starts ticking to comply with federal, state and other laws. Reporting covers the where, when and how of the incident.

What is consumer notification?

Almost every state has a data breach notification statute requiring businesses holding residents’ personal information to notify them when that data is compromised.

Is this insurance?

No. The Breach Reporting Service reports to authorities and notifies consumers as required, which can reduce your liability, but it is not insurance against loss or legal costs.

What are some examples of a breach?

Lost laptops or smart phones, loss or improper disposal of paper records, hackers getting into your network or PC, and theft. The definition continues to expand.

Requirements to protect data

Who do I need to report a breach to?

It depends on where you are located, what kind of PII was involved and where the affected individuals live. Over 100 countries have data protection laws, plus 300+ federal, state, provincial and local authorities in the U.S. and Canada.

Does CSR determine whether a breach occurred?

No. Based on an interview with you, CSR’s Privacy Professionals determine whether reporting or consumer notification is necessary, report on your behalf, and work with you on notification.

What laws govern PII?

A few of the hundreds of laws and regulations that apply:

Gramm-Leach-Bliley Act (GLBA)

Fair Credit Reporting Act (FCRA)

Drivers Privacy Protection Act (DPPA)

HIPAA

HITECH Act

PCI-DSS

Family Educational Rights and Privacy Act (FERPA)

50 state data breach laws

Massachusetts’ 201 CMR 17.00

Who are the enforcement agencies involved after a breach?

Federal Trade Commission (FTC)

Consumer Financial Protection Bureau (CFPB)

Card brands like Visa and MasterCard

State Attorneys General

Federal Bureau of Investigation (FBI)

US Secret Service

Dept. of Health and Human Services / Office of Civil Rights

What if PII shared with or received from another organization is compromised?

If you hold PII of another business’s customers, employees or vendors, you are very likely required to protect it from a breach.

What if PII under my care is encrypted, redacted or masked?

Various regulations still require its protection — for example, encryption keys must be secured.

How can I limit the threat of a data breach?

Almost everyone can do more. CSR Readiness helps you assess your risk, remediate your processes, implement policies, train staff and keep monitoring and auditing as the law requires.

About CSR

Who is CSR?

CSR Privacy Solutions, Inc. is a leading provider of award-winning data life cycle management and expert services, including the patented CSR Breach Reporting Service™, for businesses in the US and around the globe.