First Reference company logo

Inside Internal Controls

News and discussion on implementing risk management

machine cogs image

Cyberlaw, Internet Law

Learn from British Airways’ security breach reporting and notification

British Airways’ experience described in this article underscores that cybersecurity is important, and Canadian entities preparing for mandatory security breach reporting and notification coming into force soon can take lessons from British Airways’ response to a security breach.

 

, , , , , , , , , , ,

Is there an ROI for investing in cyber or information security?

IS ROI on cyber really as high as it may seem at first glance? At some point, it may be better to consider cyber risk as a “cost of doing business”. If you can’t actually reduce the likelihood of a breach, can you at least increase the likelihood of prompt detection and response?

 

, , , , , ,

Casinos, cards and counter-strike: A brief overview of skin gambling in Canada and abroad

In recent years, the gaming industry has seen the rise of so-called “skin gambling” websites. Critics have been quick to raise red flags, citing the need for profound regulation and protective measures shielding children from such platforms. This bulletin explores the practice of skin gambling, including regulatory responses in Quebec and the rest of the world.

 

, , , , , , , , , , , ,

Recent SEC settlement is cautionary tale for Canadian public issuers on disclosure of cyberincidents and related risks

The Securities and Exchange Commission’s (SEC) first enforcement action against a public issuer for failure to make timely disclosure of cyberincidents may be a wake-up call for Canadian public issuers and their directors and officers.

 

, , ,

Disclosure of forensic experts’ findings in data breach class action results in waiver of privilege

Given that maintaining privilege and confidentiality is a key objective in data breach incident response, organizations must structure their response teams and communications with a view to maintaining privilege.

 

, , ,

Online advisors: Stand-alone investment managers or tools for portfolio managers?

While the use of technology can lower the cost of investment advisory services, the introduction of algorithmic technology or other forms of artificial intelligence into the investment advice process introduces new risks to investors which raises questions.

 

, , , ,

Learning the basics on GDPR’s right to be forgotten

To manage the Europe Union’s new GDPR properly, ethics and compliance officers need to consider many parts within their organization, from IT capabilities, exception clauses, and customer service demands. And these parts must be managed and organized in such a way that they work together so that they do not fall apart.

 

, , , , , , , , , , ,

The SEC is changing the rules for SOX s302 certifications to include cyber risks

You may know that the SEC just published new guidance on the disclosures they are required to make related to cybersecurity. But did you realize that the SOX s302 certification now has to address whether disclosure controls are adequate in ensuring that the proper disclosures are made?

 

, , ,

It’s official: Mandatory data breach notification coming on November 1, 2018

The coming into force of mandatory breach notification and record-keeping requirements on November 1, 2018 should be viewed by organizations as an effort to align Canadian legal and regulatory requirements with those in the United States and Europe (especially with the General Data Protection Regulations – or GDPR – coming into force in May 2018).

 

, , , , , ,

Federal budget allocates significant funds towards cybersecurity

The Budget’s proposed investment in the area of cyber security is the largest single investment made in this area by the Canadian federal government. It also sends a strong signal that the government is focused on cyber threats that pose a real risk to the Canadian economy and national security.

 

, , , , , ,

Collaboration between the business risk and IT security teams

Take each of your business objectives and plans. Now, figure out what might result from a technology-related failure (noting that ‘technology’ extends beyond the IT function). Then, what are you going to do about it?

 

, , , , , ,

Technology law highlights: 2017 Year in Review

Here, in no particular order, are some of the year’s highlights as chronicled by McCarthy Tétrault’s bloggers:

 

, , , , , ,

Phishing losses exceed $224,000.00 after insurer denies coverage

In August 2010, someone called The Brick’s accounts payable (AP) department, pretending to be from Toshiba Canada. The caller said he was new to Toshiba and needed some payment details. The Brick employee faxed the payment information to the number which the caller provided.

 

, , , , , , , , , , ,

Québec Court of Appeal confirms application of French language requirements for websites

On December 20, 2017, in 156158 Canada inc. v. Attorney General of Québec, 2017 QCCA 2055, the Québec Court of Appeal confirmed the constitutional validity of the provisions of the Québec Charter of the French Language (the CFL) that require the joint or predominant use of French in commercial advertising, packaging and publications, including websites.

 

, , , ,

The state of information or cyber security today

Senior management must understand the state of information or cyber security today and how it affects enterprise objectives and the delivery of value to customers and other stakeholders. A number of recent publications talk to this topic.

 

, , , , , , , , , ,

Previous Posts