In a flurry of activity last week, the European Data Protection Board (EDPB) and the European Commission made major announcements affecting cross-border data transfers out of the EEA. First, the EDPB announced the adoption of draft recommendations on measures that supplement cross-border data transfer tools as well as recommendations on the European Essential Guarantees for surveillance measures. The below post will examine the EDPB’s draft recommendations on supplementary measures. The draft new standard contractual clauses will be discussed in a separate post.

Authentic8 released the results of its 2020 Global Financial Crimes Survey, conducted in partnership with the Association of Certified Financial Crime Specialists (ACFCS).

 Telos Corporation, provider of cyber, cloud and enterprise security solutions, unveiled new findings from a survey conducted by independent research firm Vanson Bourne that highlights organizations’ ongoing struggle to keep up with IT security and privacy compliance regulations.

Senior risk and compliance professionals within financial services company’s lack confidence in the security data they are providing to regulators, according to Panaseer's 2020 GRC Peer Report. Results from a global external survey of over 200+ GRC leaders* reveal concerns on data accuracy, request overload, resource-heavy processes and lack of end-to-end automation.

To understand current cloud infrastructure (IaaS) utilization and management practices, SailPoint, in partnership with dimensional research, surveyed executives and governance professionals who are directly involved with IaaS compliance and governance. The report reviews the global research survey which investigates current issues, risks, and challenges with IaaS environments as well as the tools used to manage access and governance of those environments.  In addition, the report found that a large majority (74%) of companies use more than one IaaS provider, with some companies reporting using as many as seven and eight – which can lead to significant security issues.

In fact, HIPAA penalties do distinguish degrees of “not knowing,” yet that doesn’t mean - like the traffic violation above - that a hefty fine still won’t land in your lap. Can your company deal with even a $50,000 (per violation) hit to the pocket book? Here’s the breakdown of potential penalties per OCR (Office of Civil Rights) discretion, as noted in the HIPAA Journal.

Shujinko announced the results of a survey of North American CISOs documenting the challenges facing security and compliance professionals preparing for a wave of upcoming audits. The survey, a joint effort between Shujinko and Pulse, found that calendars for security and compliance audits are largely unchanged despite COVID-19, yet the pandemic is straining teams as they work remotely.

Compliance regulators don’t take days off – not even in a pandemic. Faced with steep penalties for non-compliance and potential reputational damage, organizations are being forced to rethink their compliance strategies to account for new and emerging risks. For digital businesses today, the best place to start is by assessing how systems should be good enough, understand how data integrity is currently being managed, identifying any compliance hazards or gaps, and considering how automation can help address them.

The vast majority (80 percent) of internal auditors are facing barriers to being involved in managing fraud risk, despite almost two thirds (62 percent) saying they had seen an increase in fraud incidents over the past five years, according to a new report by Kroll, The Institute of Internal Auditors (IIA) and Internal Audit Foundation.

Oyster Consulting announced that Ed Wegener has joined the firm as a Managing Director with the Governance, Risk and Compliance team. Ed brings a deep knowledge of compliance, risk management and supervisory controls requirements and best practices for broker-dealers and alternative trading systems.