08.30-13.00 Registration in the Fisher Building

9.00 How Pitney Bowes fits data protection law into its global risk management program
Andy Harper, VP Risk Management, Pitney Bowes
Chair: Stewart Dresner, Chief Executive, Privacy Laws & Business

• brief introduction to Pitney Bowes to understand DP requirements
• Risk Governance Structure to meet both DP and other regulatory needs
• DP projects & activities undertaken and in progress
• communication requirements
• challenges & issues arising

9.45 Negotiating insurance to minimise your data breach risks and liabilities when outsourcing
Diego Rigatti, Partner, Orrick, Herrington & Sutcliffe, Italy
Chair: Stewart Dresner, Chief Executive, Privacy Laws & Business

• Outsourcing current trends:
  o Increase 40% in value from 2003 to 2008, IT being the major industry involved
  o Very high volumes of financial personal and sensitive personal data involved
  o Outsourcing is a major global business generating high revenues and attracting interest of international insurance companies
• Data protection issues in outsourcing: accidental or unlawful destruction or accidental loss, unauthorized disclosure of data, hacking and other data security breaches
• Data protection issues must be addressed during outsourcing negotiations
• Duties should be allocated properly between outsourcer and outsourcee bearing in mind that the outsourcer (data controller) is liable for breaches of the outsourcee (data processor) of relevant data protection laws
• Insurance policies are part of the outsourcing negotiations as they are a tool to cover risks connected to outsourcing
• Insurance policies should be negotiated to go beyond civil liability cover, extending to loss of reputation, loss of profits and, possibly, decrease in stock value
• Data protection insurance policies in France, Italy and the UK
• France
  o Specific coverage of French market
• Italy
  o Specific coverage of Italian market
• UK
  o Specific coverage of UK market

---

10.30 Coffee

---

Parallel 1

Chair: Laura Linkomies, Editor, Privacy Laws & Business UK Newsletter

10.50 How to conduct Privacy Impact Assessments
Jonathan Bamford, Assistant Commissioner, Information Commissioner’s Office, UK
Stephen McCartney, Head of Data Protection Promotion, Information Commissioner’s Office

• The ICO PIA handbook
• What is privacy in this context?
• Which level of PIA is appropriate?
• Who are your stakeholders?
• How do you mitigate privacy risks?

Has the experience of Privacy Impact Assessment matched its promise? – Lessons from Australasia
Nigel Waters, Principal, Pacific Privacy Pty, Australia

Parallel 2

Chair: Stuart Lynch, Consultant, Privacy Laws & Business

How to Win a European Privacy Seal

10.50 Introduction
Kirsten Bock, Project Manager, European Privacy Seal, Independent Centre for Privacy Protection, Schleswig-Holstein, Germany

11.35 How Microsoft prepared for its European Privacy Seal application
Part 1: Getting started

12.20 How Microsoft prepared for its European Privacy Seal application
Part 2: The expert evaluation phases
Sue Glueck, Senior Attorney, Microsoft, Redmond, Washington State, USA
Marcus Belke, European Privacy Seal Consultant and accredited expert, 2B Advice, Bonn, Germany. www.2b-advice.com

Click here for further information

Parallel 3 - Global privacy risk strategy

Chair: tbc

10.50 Global Privacy Prototype: Unifying Privacy, Information Security and Records Management
Jim Keese, Global Privacy Officer, VP, Records & Information Management, The Western Union Company, USA

11.50 Delivering a Data Privacy Solution in 60+ jurisdictions – How to maximise the value from your experts and minimise your risks
Julian Parkin, Group Privacy Programme Director, Barclays, UK
Simon McDougall, Director, Deloitte & Touche, UK

This session is targeted at privacy professionals or project staff who are setting up or operating a multi-jurisdictional privacy programme.  This presentation will cover:

• The project development cycle and where we targeted our use of lawyers and consultants
• Can you set a common standard across different legal requirements and jurisdictions
• The methodology developed to facilitate multiple jurisdiction analysis
• Implementation of the approach to manage risks
• What was successful and what could other programmes learn

---

13.00 Lunch

---

Parallel 1 (continued)

14.00 - see above

Parallel 2 (continued)

14.00 Transforming privacy legal criteria into product development
Professor Douwe Korff, Department of Law, Metropolitan University, London

14.30 The role of the Privacy Officer in the European Privacy Seal process

14.50 Microsoft’s assessment of the European Privacy Seal experience
Sue Glueck, Senior Attorney, Microsoft, Redmond, Washington State, USA

15.10 Some hypothetical examples of products from the participants to be discussed by the speakers

15.45 Next steps and further information
Kirsten Bock, Project Manager, European Privacy Seal, Independent Centre for Privacy Protection, Schleswig-Holstein, Germany

Click here for further information

Parallel 3 - Surveillance in the work place or necessary human resources management controls? Reducing risk of privacy violations in the workplace

14.00 Workshop with small group exercises
Ellis Parry, Global Privacy Officer, Astra Zeneca, UK

---

16.00 Close and tea

---

Day 1: Monday 7th July
Day 2: Tuesday 8th July
Annual Conference details