a. Online Data Privacy
CCPA
The California Consumer Privacy Act (CCPA, soon to be CPRA) regulates how consumers’ personal information is collected and treated. The privacy law applies to businesses operating within or outside of California offering products and services to consumers living in California. The CCPA impacts over 40 million California residents and 0.5 million businesses in California. Amongst the many privacy rights that CCPA bestows on consumers, the right to opt-out ensures businesses do not sell consumers’ personal information. Businesses are required to set up a “Do Not Sell My Information” button on their website to comply with this right.
GDPR
The General Data Protection Regulation (GDPR) is by far the most comprehensive privacy and data protection law in the world, inspiring many other countries to follow up on the provisions provided under GDPR. The regulation is based on the EU Charter of Fundamental Rights, which considers the protection of an individual’s personal data as a basic human right. GDPR considers that in all cases the individual “owns” their data, and any time it is used by an organization, it is only on loan, and the individual can ask for data access, data update, data deletion, and that the data can only be used for the purpose it was initially collected.
The GDPR has set a broader definition of personal data and imposed strict regulations on data collection, storage, processing, access, security, and transfer. The GDPR applies to all organizations operating within or outside the EU regions dealing with the personal data of individuals living in the EU.
CPRA
The California Privacy Rights Act (CPRA) is an upgraded version of the CCPA, which went into effect on January 1, 2023. The new Privacy Act has amended data privacy rights by modifying and introducing additional consumer rights. Amongst the many other additions, the CPRA has also introduced a new category of personal information, i.e., sensitive personal information (SPI), mandating businesses to only use SPI for limited purposes, and at the same time, enabling consumers to restrict businesses from any other uses. The new law will be enforced by the California Privacy Protection Agency (CPPA).
LGPD
The Brazilian Lei Geral de Proteção de Dados Pessoais (LGPD) models most of its provisions after the EU GDPR. LGPD has defined 9 privacy rights for individual data subjects, 10 legal bases for lawful processing of personal data, and the obligation for businesses to provide a data protection impact assessment (DPIA) upon the request of the Brazilian Data Protection Authority (ANPD). LGPD further requires businesses to recruit a data protection officer (DPO) to oversee the implementation of the law and offer guidance to the senior management regarding compliance with LGPD.
b. Financial Data Privacy
PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is an industry-centric data privacy and protection framework that governs only the collection, processing, and security of credit card data. The PCI DSS defines 12 security requirements grouped under 6 goals that every payment card processing service must comply with to ensure the secure collection and processing of cardholders’ data.PCI focuses more on specific security technologies, policies, and processes.
c. Healthcare Data Privacy
HIPAA
The United States Health Insurance Portability and Accountability Act (HIPAA) regulates how the personal health information of an individual should be treated. Under HIPAA, personal health information is covered for up to 50 years after an individual’s death. The violation of any act under HIPAA would result in a fine of $1,500,000.
Challenges Organizations Face with Data Privacy Protection
Although privacy laws provide a few hints, principles, and guidance on data privacy and protection, they don’t necessarily elaborate completely on how a sound data privacy framework should be implemented. Let’s take a look at some of the challenges that hinder organizations from ensuring the protection of data privacy and meeting compliance requirements.
a. Pervasive Sensitive Data
Most organizations have sensitive data across a number of different systems and environments. Especially, organizations that deal with petabyte-scale data often have sensitive data in their managed, on-prem systems, or cloud servers. The challenge of discovering sensitive data becomes more intimidating when it comes to finding it across legacy systems, where it tends to get lost. It is fairly challenging to monitor the flow of data in a dynamic environment and to track its lineage and residency.
b. Rapid Increase in Shadow IT
Data privacy becomes challenging with the proliferation of data assets, especially shadow IT. Shadow IT is the use of applications, systems, and resources that aren’t sanctioned by the IT team, and it may include BYOD. The growth in shadow IT can be measured by the fact that 80% of employees admit that they use cloud applications without the approval of the IT team. Other statistics report that 83% of IT teams believe that employees use unsanctioned cloud storage services to store business data. Keeping track of all those devices across the board can be challenging, which may lead to poor data privacy.
c. The Growing Number of Global Privacy Laws
As mentioned earlier, there are now more privacy laws across the globe than there were a decade ago. The challenge arises with varying regulations, provisions, and definitions associated with personal information, processing, and protection. Compliance becomes challenging for businesses that deal with data at a petabyte scale. Businesses find it difficult to track the level of data privacy they need to implement for varying datasets.
d. Ineffective Access Control
Most data privacy breaches are often the result of poor access control. Internal employees, malicious employees, or corporate spies might gain access to data that is not properly protected. With the growth in data systems and the data itself, it becomes difficult for organizations to keep track of sensitive resources and employees’ access levels.
Data Privacy vs. Data Security
With more and more data privacy laws coming into effect globally, it has become a tremendously important strategic and operational goal for most organizations. Each regulation that comes into effect places different requirements and obligations on organizations, resulting in it being more dynamic in nature.
On the other hand, data security is a staple industry name now. Whether it’s a multinational conglomerate or a startup, it is rare to find an organization that does not treat data security as a literal matter of life and death, since data integrity loss or corruption can have devastating consequences.
But what exactly sets them apart, and more importantly, are they really so different from one another?
In a nutshell, while data privacy and security are different aspects of an organization’s data processing obligations, they are highly dependent on one another. Most organizations collect personal data from their users in the form of email addresses, phone numbers, credit cards, login credentials, and so much more.
Owing to both their regulatory obligations and operational requirements, they must maintain the privacy of this collected data. That is only possible if the data in question is appropriately protected.
Data security is the protection of data from any form of theft, corruption, and unauthorized access that may jeopardize the storage, usage, sharing, archiving, and creation of data. It is not limited to virtual space, as any physical and policy changes designed to achieve the aforementioned purpose are also data security.
Standard methods used in data security involve encryption, data masking, and redaction of sensitive data.
Data privacy, on the other hand, aims to ensure that the data subject has appropriate control over how their data is used after the organization has collected it. Giving users a chance to unsubscribe from email marketing and newsletters is an introductory example of how organizations aim to provide users with appropriate data privacy.
Other common aspects of data privacy include only sharing/selling users’ collected data with third parties after getting the users’ informed consent, as well as only using the collected data for purposes that were specified during the initial permission to collect the data.
Data Privacy in the Age of AI
AI is transforming nearly everything it touches. As AI tools increasingly rely on massive volumes of data, data privacy has become one of the most prevalent challenges for modern-day enterprises.
Machine learning models routinely collect, process, and store large amounts of sensitive personal data. Primary risks include inadvertent data disclosure, "black-box" opaqueness, linkage attacks that re-identify anonymized data, and the possibility of hostile actors deploying deepfakes or spear-phishing.
Data privacy regulates an individual's right to control how their data is collected, used, stored, and shared, minimizing the risk of data exposure and regulatory penalties for noncompliance.
Data Privacy Best Practices
Compliance with privacy regulations is imperative for customer trust and loyalty, and to stay ahead of the competition. But to achieve that, it is also important that organizations must streamline their data privacy and protection practices. Best practices include:
- Keep track of all the systems and resources containing personal information or sensitive personal information. Monitor the inclusion of new devices or unregistered devices regularly.
- Discover all PI and sensitive PI across all the structured and unstructured systems to identify their lineage, residency, and privacy use cases.
- Identify data owners to help define and establish a data governance framework.
- Monitor employees’ access level to sensitive data and implement least privilege access to reduce insider threats.
- Adopt and implement a Privacy by Design (PbD) approach to streamlining data privacy. To begin with, conduct routine assessments to minimize the risk impact on privacy. Create effective retention policies and ensure strict security measures, including encryption, MFA, SSO, etc.
- Data privacy isn’t a done and delivered process, but iterative. Therefore, leaving the implementation of the process to traditional technologies and manual labor could result in delayed implementation, erroneous execution, and compliance failure. The best feasible option is to automate the process to reduce errors and increase efficiency.
- The expansion of data is beyond the expectations of anyone. Organizations with international roots are dealing with data at a petabyte scale. Therefore, it is a must for organizations to adopt automated solutions that can help them scale their process with their growing inventory of data.
- Data privacy and data protection need to be instilled in every employee of an organization or its culture. Routine training and awareness sessions should be conducted to educate employees about data security practices.
