Securiti Named a 2022 Cool Vendor in Data Security by Gartner
Download NowBlogs
Published on May 29, 2020 AUTHOR - Mike Sloan
In 2009 fewer than 46% of all medical providers in the United States used electronic records, with the majority still using paper patient records, faxes, and handwritten charts. The Patient Protection and Affordable Care Act (PPACA) went into effect in 2014 mandating healthcare organizations to convert paper records into electronic medical records (EMR or EHR) and while now, nearly all health care organizations have made the conversion, most have not controlled which systems and employees have access to the data.
In 1996, the Health Insurance Portability and Accountability Act (HIPAA) created an electronic data interchange that health plans, health-care clearinghouses, and certain health-care providers, including pharmacists, are required to use for electronic transactions. The HIPAA Privacy regulations require health care providers and organizations, as well as their business associates, to develop and follow procedures that ensure the confidentiality and security of protected health information (PHI) when it is transferred, received, handled, or shared. This applies to all forms of PHI, including paper, oral, and electronic, etc. Furthermore, only the minimum health information necessary to conduct business is to be used or shared.
However, with the transition to electronic records and a data exchange for healthcare providers, a patient’s data was likely to be entered and maintained on a number and disparate set of systems, scanned and databased on other systems and handled by a variety of medical professionals.
New to the digital market and lagging financial, consumer products, and tech sectors, health care providers are still struggling to obtain the technology or the information technology expertise to handle the massive compliance challenge. As an example, as late as last year in the annual Thales Data Threat Report, the organization revealed that 70% of U.S. healthcare organizations surveyed experienced a data breach, with a third reporting one in the last year alone. This is the greatest rate of any industry studied by Thales.
Security incidents and breaches where PHI falls into the wrong hands is a clear indication that healthcare organizations do not have control of their patient’s data. In this blog post, we’ll discuss the obstacles to complying with HIPAA and other privacy regulations as well as the comprehensive solutions that are empowering healthcare providers to manage and secure patient data simply and cost effectively.
HIPAA-protected health information (PHI) is any piece of information in an individual’s medical record that was created, used, or disclosed during the course of diagnosis or treatment that can be used to personally identify them. Just like PII or personally identifiable information, PHI is any data that could potentially be used to identify a person. Examples include a full name, Social Security number, driver's license number, bank account number, passport number, and email address. However, PHI typically includes additional pieces of data.
The meaning of PHI includes a wide variety of identifiers and different information recorded throughout the course of routine treatment and billing. The Department of Health and Human Services (HHS) and Office for Civil Rights (OCR) include 18 types of information that qualify as HIPAA-protected health information (PHI) identifiers.
Electronic protected health information (ePHI) is any PHI that is created, stored, transmitted, or received electronically. The HIPAA “Security Rule” has specific guidelines in place that dictate the means involved in assessing ePHI.
PHI or ePHI needs to be accessed by doctor’s, nurses, administrators and other health care professionals over the course of the health care provider's relationship with a patient. Thus, patient data is likely to be found on a variety of servers, databases, laptops and other technology. Understanding where this data is stored in the organization and how to manage and secure it is difficult.
Organizations should start preparing for an Office for Civil Rights (OCR) HIPAA audit long before they are notified that they have been chosen for a random audit. Further, for organizations that are not chosen for a random HIPAA audit, they may still face penalties for noncompliance if they have a patient complaint or experience a breach.
To be clear, the Department of Health and Human Services (HHS) oversees the OCR, which uses the HIPAA audit program to assess the compliance of covered entities. As stated by the HHS, “The audits present an opportunity to examine mechanisms for compliance, identify best practices, discover risks and vulnerabilities that may not have come to light through OCR’s ongoing complaint investigations and compliance reviews, and enable us to get out in front of problems before they result in breaches.”
Since 2003, the OCR has discovered 55 Privacy Rule violations and handed out close to $80 million in fines. And as of 2018, the OCR has received more than 184,000 HIPAA complaints and initiated more than 902 compliance reviews.
In 2018, OCR settled 10 cases totaling $28.7 million from enforcement actions. This total surpassed the previous record of $23.5 million from 2016 by 22 percent. In addition, OCR also achieved the single largest individual HIPAA settlement in history of $16 million with Anthem, Inc., representing a nearly three-fold increase over the previous record settlement of $5.5 million in 2016. Last year, OCR reached an all-time record year in HIPAA enforcement activity suggesting that their standards will continue to rise.
Further, the majority of the complaints and fines were because of the health care provider’s inability to protect patient data. Lastly, once the OCR has made up its mind to audit a health care provider, they have just 10 days to respond.
In the wake of scrambling to comply with HIPAA and the increasing enforcement activity and compliance requirements health care providers have been hit with a rash of breaches and ransomware attacks. To make things even more complicated, over the past 3 years new privacy legislation, GDPR and CCPA have been introduced to protect a “citizen’s” rights. We add the term “citizen” because for healthcare providers it expands their privacy responsibilities beyond just patients to anyone from whom they have collected and currently store PII.
A difficult provision of GDPR for health care organizations to deal with for example is the “right to forget.” This means that patients could ask a clinic or hospital to erase all the data it has collected on them. This obviously goes against the practice of healthcare organizations to retain medical records to provide a patient history for continuity of care.
The CCPA is modeled around the GDPR and similar in that it applies any data on California residents, even if it is stored in another state. The “Do Not Sell” provision of CCPA will force health care providers to have processes and procedures in place to respond to requests from both patients and consumers.
HIPAA regulations treat data storage companies as Business Associates (BAs). Thus, as an example, the regulation accounts for the storage of physical and digital data, meaning that cloud storage services qualify as BAs even if the organization rarely, randomly, or never accesses or views the ePHI that they store.
When dealing with data and cloud storage services, BAs must have Business Associate Agreements (BAAs) in place. A good BAA should include provisions that clearly delineate liability in the event of a data breach, in addition to the technical, administrative, and physical safeguards that will be put in place to maintain the integrity of PHI.
For any vendors handling PHI, a business associate agreement (BAA) is essential. This helps ensure that both parties are held accountable for creating, receiving or transmitting PHI in a secure and intended manner. If either party violates the BAA, they may face penalties from Health and Human Services. Cloud providers and other organizations that handle PHI sign BAA’s unfortunately they don’t have the protocols in place to responsibly handle PHI.
As we suggested previously, one factor linked to the rise in healthcare cyber-attacks is the digitization of health records. These digital records are a treasure trove of information for attackers. They not only contain insurance information, which is used for fraudulent billing and prescriptions, but also social security numbers, driver’s licenses and credit card numbers.
Many medical providers had operated with paper, faxes, and handwritten charts until Obamacare mandated electronic records; healthcare providers have struggled ever since to secure their new digital records. In 2009, prior to the Affordable Care Act, only 12% of hospitals had transitioned to electronic health records. The ACA’s HITECH provisions provided tens of billions of dollars in incentives for healthcare providers to implement electronic health records; these digital records now are in use by 96% of hospitals across the country.
However, medical records are now the top selling personal record on the dark web and black market. Research firm Cynerio found that malicious attackers are using these records for delivery of prescription drugs, fraudulent claims to online provider websites, and tax fraud. Researcher James Scott, in a report prepared for the U.S. Senate, found that electronic health records with complete long-form documentation on all the intricacies of a person’s health history, known by hackers as “fullz,” are often combined with fake passports, drivers’ licenses, and social security numbers as an identity kit which often sell for $1,500 to $2,000.
Cybercriminals use these records to buy medical equipment or drugs and file fictional claims with insurers. Health records also contain addresses and employer details, meaning hackers can use them to file fake tax returns. While a stolen credit card number can be easily cancelled and reported to a bank, there is no easy solution for stolen medical records.
Data management, privacy and security have become a primary concern for healthcare facilities as it is one of the most pressing requirements from HIPAA. It is also connected directly to the secure adoption of electronic health records. As we stated earlier, the HIPAA rules imply that any company that deals with protected health information (PHI) must have in place physical, network, and process security measures and follow them in order to ensure HIPAA compliance.
Healthcare organizations and providers must have access to patient data in order to deliver quality care, but complying with regulations and requirements for protecting patient health information requires a combination of robust data management strategies as well as the appropriate solutions and sufficient IT resources to implement them.
HIPAA privacy management software and solutions help organizations comply with HIPAA policies, including security regulations by automating processes. Automating policies by locating, protecting, and managing PHI reduces risks of human error and non-compliance, brings efficiencies, and reduces the costs of compliance.
Further, privacy management software not only aids in the identification and management of PHI, but also, privilege escalation, cross-system visibility to identify insider threats, and is able to determine the severity of a data breach by identifying which systems and data were breached.
Finally, while privacy and security are core benefits of privacy management software, automation including PHI inventory tracking, HIPAA compliance reporting, BAA management, and monitor and track changes to HIPAA and other privacy and compliance laws.
Implementing manual compliance processes and combining systems and databases for PHI has been more costly than expected for most healthcare providers focused on the needs of their patients. Automating manual tasks and processes is the only cure for organizations whose mission is life or death.
June 28, 2022
A data subject access request (DSAR) is a formal request by a user (data subject) to an organization collecting their data asking for details related to how their data is being collected, used, stored, and possibly shared. Furthermore,...
June 24, 2022
Under the GDPR, personal data that directly or indirectly identifies an individual must not be collected, stored, or processed unless there is an appropriate legal basis to do so. Article 6 of the GDPR defines the six lawful...
June 21, 2022
When the California Privacy Rights Act (CPRA) comes into effect, replacing the existing California Consumer Privacy Act (CCPA), organizations will have to change their current business practices around personal information handling. One significant change will be Regular Risk...
[email protected]
PO Box 13039,
Coyote CA 95013
Break Silos of Sensitive Data & Risk Understanding across Multicloud and self managed systems. Common grammar, policies and reporting
Key Features
Find data assets, and discover personal and sensitive data in structured and unstructured data systems, across on-premises and multi-cloud.
Key Features
Classify & label data to ensure appropriate security controls are enabled on most sensitive data in your organization
Key Features
Collect, organize, enrich and build a data catalog to address privacy, security and governance solutions
Key Features
Connect to structured and unstructured data sources and automatically discover and build a relationship map between personal data and its owner.
Key Features
Assess risk scores for every data asset, asset location, or personal data category
Key Features
Auto discover personal data in Snowflake and enforce access governance
Key Features
Auto discover personal data in Snowflake and enforce access governance
Key Features
Discover, classify, manage and protect sensitive data in Workday. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Box. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Slack. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more
Key Features
Discover, classify, manage and protect sensitive data in Github. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Jira. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Dropbox. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in SAP Successfactors. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Servicenow. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Zendesk. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Apache Hive. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Apache Spark SQL. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Cassandra. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Couchbase. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Enable privacy by design through the AI driven PrivacyOps platform
Key Features
Maintain your Data Catalog with continuous automated updates
Key Features
Automate data subject rights request fulfillment and maintain proof of compliance
Key Features
Connect to structured and unstructured data sources and automatically discover and build a relationship map between personal data and its owner.
Key Features
Audit once and comply with many regulations. Collaborate and track all internal assessments in one place.
Key Features
Automation of privacy assessment collection from third parties, collaboration among stakeholders, follow-ups and compliance analytics.
Key Features
Automate global cookie consent compliance.
Key Features
Simplify and automate universal consent management.
Key Features
Automate the incident response process by gathering incident details, identifying the scope and optimizing notifications to comply with global privacy regulations.
Key Features
Keeping privacy notices up-to-date made easy
Key Features
Operationalize GDPR compliance with the most comprehensive PrivacyOps platform
Key Features
Operationalize CCPA compliance with the most comprehensive PrivacyOps platform
Key Features
Revolutionize LGPD compliance through PrivacyOps
Key Features
Identify data risk & enable protection and control
Key Features
Discover data assets, detect & catalog sensitive data in it
Key Features
Classify and label data to ensure appropriate security controls
Key Features
Monitor data security posture and identify external and internals risks to data security
Key Features
Policy based alerts and remediations to protect data from external and internal threats
Key Features
Investigate data security issues and take remediation actions
Key Features
Snowflake is a cloud based data warehouse that allows organizations to run large scale data analytics projects to uncover business insights, run or train machine learning models, and modernize their data infrastructure.
Key Features
Microsoft O365 is the ubiquitous productivity suite for every business worker. Users rely on Office products such as OneDrive and SharePoint to collaborate with their co-workers.
Key Features
Organizations want to migrate their on-premises data to cloud data stores to take advantage of scale and flexibility while reducing operational cost of managing on-premises infrastructure. However, due to privacy regulations such as GDPR, CCPA administrators have to ensure that data is migrated in compliance with these laws.
Key Features
Protecting sensitive content is a priority for all organizations, however, due to volume of sensitive content and
Key Features
While data aids in business decision making, global privacy regulations such as GDPR, CPRA require organization to identify personal & sensitive data & use only for its intended purpose and implement adequate protection.
Key Features
The CDMC Framework sets up controls that companies should put in place, and establishes clear guidelines around data accountability, governance, classification, usage, protection and privacy.
CDMC Framework
Securiti enables organizations to meet multiple regulations around the world and helps with compliance requirements through AI-driven PI data discovery, DSR automation, documented accountability, enhanced visibility into data processing activities and AI-driven process automation.
Securiti is a complete PrivacyOps Solution.
View all solutionsThe California Consumer Privacy Act (CCPA) was signed into law on June 28, 2018 and is scheduled to come into effect on January 01, 2020. Often compared to GDPR, CCPA protects consumers from mismanagement of their personal data and gives the consumer control over what data is collected, processed, shared or sold.
Key Features
The California Privacy Rights Act (CPRA) will take effect from January 1, 2023, and will apply to personal information collected on or after January 1, 2022. Enforcement of the CPRA will start six months later (July 1, 2023). The CPRA builds upon the CCPA, strengthening user privacy for California residents.
Key Features
The EU General Data Protection Regulation (GDPR) came into effect on May 25, 2018 and changed the global privacy landscape. It has broadened the definition of processing activities and personal data, impacting companies worldwide, and has tightened the rules to obtain consent before processing information.
Key Features
The Lei Geral de Proteção de Dados (LGPD) is modeled with similarities to the General European Data Protection Regulation (GDPR) and contains sixty-five articles. It was approved on August 14, 2018 and its validity has undergone several changes, the last relevant fact being MPV 959. LGPD is in effect since September 18, 2020. The sanctions by the ANPD (Brazilian Data Protection Authority) were postponed to August 2021. The LGPD allows people have more rights over their data and expects organizations to comply with their regulations or face heavy penalties or fines.
Key Features
China has complex data protection and data security regime, however, the following are three main laws that primarily cover China’s data protection and data security regulatory framework. These laws are:
Frameworks
UAE have number of laws in place that govern privacy as well as data security in the UAE. Some of those includes:
Frameworks
The government of New Zealand has recently replaced its long-existing Privacy Act of 1993 with a modernized version, the Privacy Act 2020. The New Zealand Privacy Act 2020 (NZPA) will take effect from December 1, 2020.
Key Features
The Personal Data Protection Act, B.E. 2562 (2019) ('PDPA') is Thailand's first consolidated data protection law, which was published in the Thai Government Gazette on 27 May 2019. This law was said to go into effect on 27 May 2020. However, in May 2020, the Thai Cabinet through a Royal Decree has deferred the enforcement of certain data protection provisions of the PDPA until 31 May 2021.
Key Features
In order to protect the data of individuals in South Africa, Parliament assented to the Protection of Personal Information Act (POPIA) on 19th November 2013. The commencement date of section 1, Part A of Chapter 5, section 112 and section 113 was 11 April 2014. The commencement date of the remaining sections (excluding section 110 and 114(4)) was 1st July 2020. As per the Regulator’s Operational Readiness Plan the Regulator will be able to take enforcement actions for the violation of POPIA by July 1st 2021.
Key Features
Singapore’s Personal Data Protection Act (PDPA) comprises various provisions governing the collection, disclosure, use, and care of personal data. It recognizes the rights of individuals to have more control over their personal data and the needs of organizations to collect, use, or disclose personal data for legitimate and reasonable purposes.
Key Features
The Canadian data laws aim to give consumers control over their data and promote greater transparency about how organizations use data containing personal identifiers.
Frameworks
The Australian data laws aim to give consumers control over their data and promote greater transparency about how organizations use data containing personal identifiers.
Frameworks
After the invalidation of Privacy Shield, many companies are relying on the SCCs in order to continue transferring data of EU citizens to companies based in countries who are not deemed adequate for data transfer.
After the CJEU judgement, it is clear that these companies have to conduct Risk Assessments with the data recipients in these countries in order to ensure they have enough controls to mitigate any potential data or regulatory risk.
Key Features
On January 31, 2020, the government of Saudi Arabia issued the Executive Regulations to the Saudi E-Commerce Law 2019 (“ECL”) that was in effect since October 2019. The Executive Regulations together with the ECL (“Law”) aim to protect consumers’ personal data by requiring organizations to take appropriate technical and administrative measures.
Key Features
Turkey was one of the first countries to start the trend of legislating data protection. Turkey published “Law on the Protection of Personal Data No. 6698 (LPPD) covering personal data protection on April 07, 2016.” The LPPD is based on the European Union Data Protection Directive 95/46/EC and has several similarities with the GDPR. It aims to give data subjects’ control over their personal data and outlines obligations that organizations and individuals dealing with personal data must comply with. The LPPD has also provided comprehensive guidelines for the transfer of personal data to the third parties.
Key Features
In December 2019, India, following several other countries' footsteps on the privacy laws' developments, introduced the Personal Data Protection Bill (PDPB) to regulate the processing, collection, and storage of personal data. However, in November 2021, the bill’s name was amended to now be called the Data Protection Bill 2021 (DPB).
Key Features
The Irish Data Protection Act, 2018 (Irish DPA) implements the General Data Protection Regulation (GDPR) and transposes the European Union Law Enforcement Directive in Ireland. Since it incorporates most of the provisions from the GDPR and the Law Enforcement Directive with limited additions and deletions as per the national law, it is considered to be the principal data protection legislation in Ireland.
Key Features
The Personal Data (Privacy) Ordinance (Cap. 486) as amended in 2012 (the “PDPO) is the primary legislation in Hong Kong which was enacted to protect the privacy of individuals’ personal data, and regulate the collection, holding, processing, disclosure, or use of personal data by the organizations.. The Data Protection Principles ( the “DPPs or DPP ''), which are contained in Schedule 1 to the PDPO, outline how entities should collect, handle, disclose, and use personal data.
Key Features
In 2012, the Philippines passed the comprehensive privacy law, Data Privacy Act 2012 Republic Act. No, 10173 (the "DPA"). The DPA recognizes the rights of individuals to have more control over their personal data while ensuring a free flow of information to promote innovation and growth.
Key Features
South Korea has a general law and several special laws that cover data protection and individuals' privacy. South Korea's data protection regime is considered one of the strictest data protection regimes owing to its notification requirements, opt-in consent, extensive data subject rights, mandatory data breach notifications, and heavy sanctions in case of non-compliance.
Key Features
The Act on the Protection of Personal Information (the "APPI'') regulates personal related information and applies to any Personal Information Controller (the “PIC''), that is a person or entity providing personal related information for use in business in Japan. The APPI also applies to the foreign PICs which handle personal information of data subjects (“principals”) in Japan for the purpose of supplying goods or services to those persons.
Key Features
Qatar is the first gulf country that has passed a national data privacy law and has paved the way for all other gulf countries to follow suit. In 2016, Qatar enacted Law no. 13 Concerning Personal Data Protection (the “DPL”). Qatar became the first Gulf Cooperation Council (GCC) member state to issue an “European Style” applicable data protection law. The DPL establishes a certain degree of personal data protection, provides data subject rights, and prescribes the guidelines for organizations for the processing of personal data within Qatar.
Key Features
Bahrain has become a part of the countries that have enacted a data privacy regulation to protect the rights of their residents. On 12 July 2018, Bahrain drafted its law on data protection regulation, Law No. 30. This then went on to go into effect on the 1st of August 2019 as the Bahrain Personal Data Protection Law (PDPL) and supersedes all other laws. The PDPL recognizes the rights of individuals to have more control over their personal data and the needs of organizations to collect, use, or disclose personal data for legitimate purposes.
Key Features
After the Success of the California Consumer Privacy Act (CCPA) in California, Virginia is now following the same path. The Virginia Consumer Data Protection Act (VCDPA) has been passed and will go into effect on 1st of January 2023. This law is closely designed after the newer California Privacy Rights Act (CPRA) but with a few significant and important differences.
Key Features
After the VCDPA in Virginia, Colorado has closely followed suit and has passed their own comprehensive data privacy law to protect the personal data of the residents of Colorado.The Colorado Privacy Act (CPA) was signed into law on the 8th of July, 2021 and has been modelled closely after the VCDPA.
Key Features
Saudi Arabia has drafted a data privacy regulation to protect the personal data of individuals in Saudi Arabia. This law was approved by the Council of Ministers in Saudi Arabia and is named the Personal Data Protection Law (the “PDPL”).
Key Features
Uganda’s Data Protection and Privacy Act 2019 seeks to protect Uganda’s citizens and their personal data by outlining and implementing rules for processing personal data and sensitive personal data by entities within or outside the country.
Key Features
Ghana Data Protection Act 2012 establishes a comprehensive set of provisions governing the collection, processing, use, and protection of personal data by the data controller or data processor.
Key Features
Kenya’s Data Protection Act, 2019 (DPA) is based on the framework of the EU’s General Data Protection Regulation (GDPR), making it the third region in East Africa to have enacted and enforced data protection regulations.
Key Features
Malaysia’s Personal Data Protection Act (PDPA) was passed by the Parliament of Malaysia on 2 June 2010. The PDPA sets out a complete cross-sectoral framework to protect the personal data of individuals with respect to commercial transactions.
Key Features
Although there is no comprehensive data protection law in Indonesia, however, there are several regulations that regulate the Indonesia's draft Personal Data Protection Bill (PDPB) & Personal Data Protection Regulations (PDP Regulations)
Frameworks
Oman’s Personal Data Protection Law (Oman’s PDPL) has been published in the country’s official gazette, and it will come into force by February 9, 2023, one year after its issuance which was February 9, 2022. The law applies to any natural person’s personal data including but not limited to their name, location data, identification number, and health-related information.
Key Features
Kuwait’s Data Privacy Protection Regulations (DPPR) applies to all public and private Telecommunication Services Providers and related industry sectors who collect, process, and store personal data and user-related content in whole or in part of a data storage system, whether processed inside or outside the State of Kuwait.
Key Features
The Personal Data Protection Act (PDPA) protects Sri Lankan residents’ data while regulating how organizations collect, process, store, and maintain this data. The PDPA also grants users a wide range of data subject rights, meant to give them more control over their data.
Key Features
Issued on 27 July 2006, the Russian Federal Law on Personal Data (No. 152-FZ) remains one of the oldest data protection laws in effect today. Moreover, it is one of the few laws enacted before the EU's landmark General Data Protection Regulation (GDPR).
Key Features
Germany’s Bundesdatenschutzgesetz (BDSG) in German, or the Federal Data Protection Act in English, was enacted in May 2018 to implement the GDPR in Germany.
Key Features
The Data Protection Act (DPA) of 2018 was passed in April 2016 and came into effect on May 25, 2018. This was the same day the General Data Protection Regulation (GDPR) came into effect.
Key Features
Directive 2002/58/EC on Privacy and Electronic Communications, known more prominently as the ePrivacy Directive, is a key set of instructions released to ensure the privacy and confidentiality of all electronic communications within the European Union (EU).
Key Features
The New York State Department of Financial Service Cybersecurity Regulations or 23 NYCRR 500 is a set of 23 cybersecurity requirements mandatory for all financial institutions registered in New York working under its Banking Law, Insurance Law, or Financial Services Law.
Key Features
In November 2020, the European Commission released a draft of the new Data Governance Act. This came as a result of the 2020 European Data Strategy that aims to facilitate data sharing across sectors and member states.
Key Features