ONG Companies and the gotchas of data processing

In the United States, oil and gas (ONG) companies are required to disclose their use of third-party software services and the data exchanged with these services under several regulatory frameworks. These regulations primarily focus on data security, privacy, and financial reporting, though the specific requirements can vary depending on the nature of the data and the jurisdiction. Here are some relevant regulations:

1. Sarbanes-Oxley Act (SOX)

- Applicability: Publicly traded companies, including those in the oil and gas sector.

- Requirements: SOX requires companies to implement internal controls and disclose material aspects of their financial operations, which could include third-party software services if they impact financial reporting. This includes systems that manage financial data, compliance data, or any other sensitive information that could affect the integrity of financial statements.

2. Gramm-Leach-Bliley Act (GLBA)

- Applicability: Companies that provide financial services, including those in oil and gas if they offer financial products or services.

- Requirements: GLBA requires companies to protect the privacy of consumer information and mandates the disclosure of how data is shared with third parties. If third-party software services are involved in handling consumer financial data, disclosure might be necessary.

3. General Data Protection Regulation (GDPR)

- Applicability: U.S.-based companies that process the personal data of individuals in the European Union, including oil and gas companies.

- Requirements: GDPR mandates that companies disclose their data processing activities, including the use of third-party software services, and ensure that proper data protection measures are in place. While GDPR is an EU regulation, it can affect U.S. companies dealing with EU data subjects.

4. California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

- Applicability: Companies doing business in California that meet certain criteria, including those in the oil and gas sector.

- Requirements: CCPA/CPRA requires businesses to disclose the categories of personal information they collect, how it's used, and with whom it's shared, including third-party software providers. This disclosure must be provided to consumers upon request.

5. Energy Policy Act (EPAct) and Federal Energy Regulatory Commission (FERC) Regulations

- Applicability: Energy companies, including those in oil and gas.

- Requirements: FERC regulations might require disclosures related to cybersecurity and the use of third-party software, particularly in relation to the security of critical infrastructure and the handling of sensitive energy data.

6. Cybersecurity Information Sharing Act (CISA)

- Applicability: Companies involved in critical infrastructure sectors, including oil and gas.

- Requirements: While CISA primarily encourages information sharing between companies and the government, it also implies that companies need to be aware of and disclose potential cybersecurity risks, which could involve third-party software services.

7. State Data Protection Laws

- Applicability: Companies operating in specific states with their own data protection laws.

- Requirements: States like New York (NYDFS Cybersecurity Regulation) and Texas (Texas Business and Commerce Code) have specific regulations that may require companies to disclose their cybersecurity practices, including the use of third-party software.

8. Environmental, Social, and Governance (ESG) Reporting

- Applicability: Increasingly relevant for public companies, including those in oil and gas.

- Requirements: ESG reporting frameworks, while voluntary, often require companies to disclose their supply chain, which could include third-party software services if they impact environmental or social governance.

9. Contractual Obligations and Industry Standards

- Applicability: Any contracts or industry standards that the company adheres to.

- Requirements: Oil and gas companies may be contractually obligated to disclose third-party software use and data exchanges, particularly in joint ventures, partnerships, or when adhering to industry standards like ISO 27001.

These regulations collectively push companies towards transparency in their use of third-party services, especially where data security, financial reporting, or consumer privacy are concerned.

If you would like to talk to an expert in this area, please feel free to connect with our team at Riscosity - https://meetings.hubspot.com/anirban-banerjee/meeting-with-ceo