CCPA Data Discovery: The First Step Towards Personal Data Compliance

The consistent increase in frequency and severity of data breach incidents, coupled with the introduction of data privacy regulations such as GDPR and CCPA (recently amended by the CPRA), is encouraging organizations to revisit their privacy operations and how they handle their consumers’ personal information.

Data discovery is the process of reviewing databases to identify personal information (PI) and determine whether it falls within California Consumer Privacy Act (CCPA) governance or is a permitted business exemption. PI can exist in any number of places within an organization.

The quest for better handling, management, and protection of consumers’ personal information begins with fully understanding the concept of “CCPA Data Discovery” and following the step-wise process to ensure CCPA compliance.

How Data Discovery Contributes to Data Protection

Organizations are churning out 44 zettabytes of data on an average daily basis, and the number just keeps increasing every year. However, the mass production of data isn't the primary concern here. Rather, a significant volume of data is in an unstructured format, scattered across emails, spreadsheets, invoices, IoT, or rich media. IDC forecasts that 85% of data will be in an unstructured format by 2025.

Helps Design Security Controls

A robust data discovery mechanism can help organizations gain high visibility into where the data resides in structured and unstructured systems, classify that data, catalog it under a single repository and tag it according to its regulatory status and its sensitivity and confidentiality. With this classification, organizations determine the security posture of the residing data in their hyper-scale environments and set security measures accordingly.

Eliminates False Positives

Moreover, there's a lot of ambiguity involved when it is about PI or sensitive information. Just about anything can be deemed PI, such as name, email address, social security number, credit card number, consumers' location, biometrics information, etc. With traditional discovery practices, IT teams tend to get lost in the ambiguity that the definition of PI carries under the CCPA regulation, which ultimately gives rise to false positives.

Consequently, IT teams spend 25% of their time and effort wading through false positive or false negative alerts, which drastically affect their productivity and the ability to take timely measures.

Smart data discovery systems help organizations save time by efficiently reducing ambiguity and resolving false positives using contextual analysis, artificial intelligence, and machine learning.

Higher accuracy in data discovery further enables organizations to ensure optimal security posture and practices and compliance with CCPA regulations.

The Role of Data Discovery in CCPA Compliance

Data discovery is how businesses collect data from different sources, analyze it, and link it to a consumer. This process allows the data to be properly discovered, cataloged, and protected to stay compliant with privacy regulations. Following are some of the ways data discovery helps organizations remain compliant with the CCPA.

Data Linking for CCPA Compliance

As per CCPA Section 1798.140(o)(1), the term personal information is defined as information that identifies, relates to, describes, or is reasonably capable of being associated with, directly or indirectly, a particular consumer or household. Examples provided by the CCPA include:

• Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
• Any categories of personal information described in subdivision (e) of Section 1798.80 of California Civil Code (the California Breach law).
• Characteristics of protected classifications under California or federal law.
• Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Biometric information.
• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.
• Geolocation data.
• Audio, electronic, visual, thermal, olfactory, or similar information.
• Professional or employment-related information.
• Education information, is defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act.
• Inferences that are drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Thus one of the most crucial parts of CCPA compliance is finding and linking the personal information of consumers within your systems to its owners. Data discovery can help an organization in this process by identifying data, classifying it, and then linking it to the owner of the data through effective data mapping. It can also help visualize the data sprawl by identity and identify compliance risks based on a subject’s residency, as per the CCPA.

DSR Fulfillment for CCPA Compliance

The CCPA grants several data privacy rights to consumers. Consumers (i.e., data subjects) can submit a simple Data Subject Request (DSR) via a form, such as available, on the organization’s website. As per the CCPA, consumers have the right to access their personal information from the organization or to have it deleted. Consumers may also request to opt-out of the sale of their personal information. CCPA DSR requests must be honored by organizations within a period of 45 days or risk non-compliance. In order to honor a DSR, organizations can incorporate data discovery to not only detect all the data but also link it to the owner.

Data Protection for CCPA Compliance

As per Section 1798.150, a consumer who had his unencrypted or unredacted personal information breached may sue the business for the violation of their duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information.

Therefore, organizations need to have a sound grasp on all their data and know where the data resides in their plethora of systems and servers so that they may determine risk severity and apply appropriate and reasonable security controls. Data discovery thus helps simplify this process and makes it more cost-effective and less error-prone while reducing legal risks for the business.

Data Monitoring for CCPA Compliance

With data in a constant flow, in and out of the organization, there needs to be a system that constantly tracks and monitors all of this data due to modern processing activities. It further helps discover new types, categories, and data flow risks on an ongoing basis - which can then be used to update the privacy notice as per transparency requirements imposed by CCPA Section 1798.100 and 1798.115 read with Section 1798.130(a)(5).

Data Discovery Objectives

The goals of successful data discovery include:

1. Creating a Personal Information Process Inventory.
2. Linking Personal Information to overarching categories.
3. Tracking all collected data.
4. Using data only for its intended purpose.
5. Maintaining visibility, transparency, and accountability on collected data.

How can Securiti help?

Securiti is the complete 360-degree solution that allows organizations to comply with global privacy regulations such as the CCPA and GDPR. The Securiti data discovery solution offers organizations the following functionalities to help them with compliance:

1. Discover & catalog shadow and sanctioned assets.
2. Extract and catalog asset metadata.
3. Detect sensitive and personal data.
4. Catalog, classify & tag sensitive data.
5. Assess overall data risk posture.
6. Build a graph between data and its owners.
7. Discover data at a petabyte scale with high accuracy.
8. Map data for compliance.

To learn more about the solution and how Securiti can help, request a free demo today!