INFORMATION RISK MANAGEMENT

Businesses and organizations handle information every day to conduct business, process transactions, and deliver goods and services. They do so in the context of legal, regulatory, and contractual obligations relating to their possession and use of this information. In the age of "Big Data" and "Advanced Persistent Threats," these entities can no longer focus solely on developing and implementing procedures to govern information processing. Instead, they must implement governance that allows for the optimization of risk while facilitating core management decision making in order to create real value. This is the new world of "knowledge governance." Legal counsel must ensure compliance with the legal and core requirements for security, privacy and data breach prevention, in a way that aligns with the strategic objectives of their firm. Designing a robust compliance program is a critical part of this task, but the big-data environment requires skills that go beyond devising a formal compliance program. In particular, lawyers operating in this environment must consider the value of data and information, understand the nature of their organization's collection, use, and disclosure of that data, and appreciate the relationship between risk optimization and their organization's strategic objectives. This course will explore the lawyer's role in devising and implementing a policy and culture of knowledge governance within a firm. It will focus on information, especially personal information. It will introduce students to the core principles of information risk management -- the privacy attributes of collection, use, and disclosure married with the security concepts of confidentiality, integrity, and availability -- while providing a framework for governance around information risk management. This course will also serve in part as preparation for the International Association of Privacy Professionals (IAPP). UPPER-CLASS WRITING REQUIREMENT: A limited number of students may use this class to satisfy the requirement. **A student who fails to attend the initial meeting of a seminar, or to obtain permission to be absent from either the instructor or the Registrar, may be administratively dropped from the seminar. Students who are on a wait list for a seminar are required to attend the first seminar meeting to be considered for enrollment.