Remember the Snowden revelations in 2013? Who can forget, it was in every newspaper and television headline. A government secretly spying on its citizens. It doesn't get more scandalous than that.
The event is just one of many high-profile cases that have happened over the years involving the violation of people's digital privacy.
There is also the Cambridge Analytica and Facebook data privacy scandal that made headlines in 2018. This was after it was discovered that the social media giant was selling personal user information to the political consulting firm so that they could create psychological profiles of American voters.
And now, judging from the major changes we are witnessing in US data privacy laws, it seems we have reached a tipping point.. Existing laws are being re-evaluated and new laws and regulations are being created.
And while that is good news for individuals, it leaves organizations with the huge task of ensuring that they are in adherence to these new laws and regulations for data privacy compliance. The list goes on with the pros and cons of privacy laws for consumers and corporations.
In this post, we explore the different data privacy laws and regulations that affect your organization as well as steps you can take to ensure compliance.
Get An Instant Free Course Preview
Try our best-in-class, interactive, and engaging courses for free!
What is data privacy compliance?
Data privacy compliance refers to the proper handling of sensitive customer data while adhering to the set data protection laws, regulations, and data privacy best practices.
A company is said to be compliant, if they meet the legal and regulatory requirements for collecting, storing, and using sensitive data.
Admittedly, the data privacy and regulatory landscape in the US is still in its infant stages and there are a lot of grey areas as to what qualifies as personal data and the right way to handle it.
Still, this should not be an excuse for noncompliance
And on the upside, most of the new laws and regulations are drawing their inspiration from the General Data Protection Regulation (GDPR). Therefore, any company looking to create a compliant environment can be inspired by the 7 guiding principles of the GDPR.
Importance of data privacy compliance
Let's review the importance of data privacy compliance.
- Ensures your business is protected against data breaches by requiring you set up necessary security measures.
- Helps avoid potential law suits and regulatory investigations that may arise if there is a data breach.
- Customer retention. Customers become loyal to your brand because they are guaranteed the security of their sensitive data.
GDPR and its impact on international data privacy laws
The General Data Protection Regulation was actualized on May 25, 2018, and it defines how the personally identifiable information (PII) of European Union citizens should be handled. The regulation puts EU residents in control over their data allowing them to dictate who stores the data and how they can use the data. Under GDPR EU residents can request that a company deletes any data it has on them.
Also, covered companies are required to notify all affected people and supervising authorities within 72 hours of a data breach.
The GDPR is by far the most comprehensive and far-reaching data privacy regulation and is serving as a blueprint upon which other countries can build their own.
The GDPR is built on 7 principles. By understanding the intention of these 7 principles you can create a data processing system that aligns with them and you will effectively be one step ahead in the regulatory compliance game.
Understanding the 7 principles of the GDPR
Lawfulness, fairness, and transparency
Lawfulness means that every action you take in the lifecycle of consumer data stays within legal limits. This means no data collection without getting consent from data subjects and also no using customer data to serve your interests at the expense of consumer interest.
Fairness on the other hand means that you don't mislead the consumer about your true intentions with their data or try to collect additional data without their knowledge.
Transparency means keeping the consumer updated on every aspect of how their data is being handled.
Purpose limitation
Before collecting sensitive data you need to have a specific, explicit, and legitimate reason to collect the data. This purpose should be communicated to the consumer through a privacy notice and it should not change at any point during the data handling process.
If it reaches a point that you have to use the data for another purpose other than the one communicated to the consumer, then you need to ask for their consent again.
Data minimization
Only collect the data you need to achieve your purpose. Let's say you want some personal information from your website visitors that will allow you to sell them your services.
In such a case, you can have them give you their email address and maybe add their phone number as an optional choice. There is no need to ask for their home address. This may come at a later stage if you need to deliver your product or service at home.
Accuracy
All data you collect and store should be accurate and up to date. Set up controls to check for inaccuracies and ensure that outdated and incomplete data is deleted from your database.
Storage limitation
Don't store customer information for longer than necessary. The GDPR requires that you justify the length of time you store user data. Once the data has served its purpose you have no business keeping it.
Integrity and confidentiality
Set up security measures to protect data from internal and external interferences. The data should be guarded against unlawful processing, accidental loss, destruction, or damage.
Accountability
Have relevant documentation to prove regulatory compliance. Under GDPR word of mouth is not enough to prove compliance. You need to record every step of the data lifecycle in a way that can be understood.
Other data privacy regulations you need to be aware of
- HIPAA - The Health Insurance Portability and Accountability Act (HIPAA) specifically focuses on organizations within the health sector. It's a wide law covering multiple areas but concerning data privacy, HIPAA compliance's main aim is to protect confidential medical information about patients.
- GLBA - The Gramm-Leach-Bliley Act (GLBA) is another industry-specific law created to regulate the financial sector. The law aims to protect the confidentiality of non-public consumer information (NPI) defined as any information collected about an individual in connection with providing a financial product or service unless that information is publicly available. Under GLBA, all covered companies are required to send privacy notifications alerting consumers about the type of NPIs being collected and shared. Customers should be given a chance to opt-out.
- CAN-SPAM - The Controlling the Assault of Non-Solicited Pornography And Marketing Act (CAN-SPAM) was created in 2003 and it governs how email communications between companies and customers are conducted. It protects consumers from receiving unsolicited emails and requires that every commercial email provide the consumer with an opt-out option.
- CCPA - The California Consumer Privacy Act is the first of its kind and is setting precedence for other states to follow. The law applies to medium and large businesses that collect personal data and it grants California residents the right to know, the right to delete, and the right to opt-out of the sale of the personal information collected by the businesses.
5 Key privacy and data protection requirements to ensure compliance
Looking at the various consumer privacy laws and regulations we have discussed, you will notice that although they may apply to different businesses, they are all advocating for a similar treatment of data.
From that, we were able to come up with 5 guiding principles that if implemented correctly will ensure that your business is well-positioned to comply not just with existing laws but also new laws as they come up.
- Identify personal information being handled by your business. To ensure the privacy of personal data, you need to have a complete map of all personal data that your business is collecting where it is stored and who can access it. But, first, you need to have a very clear definition of what is considered personal information.
- Put controls in place to protect the data. When we talk about data security, we don't mean just securing your main database. You need to protect the data beyond your enterprise. Yes, you have a threat monitor to detect data breaches but, what about the personal data on the laptop that your employees carried home. What measures do you have in place to protect this data? What about the data backed up in the cloud and data you share with a third party. Can they guarantee its privacy?
- Have a system to respond to user requests about data you have on them and who you are sharing it with. Have a system that can index your whole business enterprise to collect every information you have on your computer to promote transparency. You don't want a situation where a consumer realizes you have been collecting information about them that they are not aware of.
- Create a process for producing personal information reports. This is in case customers want a copy of the information you have on them. Have a system that can compile whole data into a neat report that can easily be understood by the consumer.
- Create compliant processes of deleting personal data. Most existing data privacy regulations require that a consumer's request to delete their data be honored promptly. Still, you have to be careful not to delete data that is necessary to comply with existing data retention laws
Who is responsible for ensuring data privacy compliance
Everyone in the business starting from management, employees, to the consumer have a role to play in ensuring data privacy compliance.
However, it's the business that stands to lose the most in case of non compliance. Therefore, apart from doing what is expected of you as a business owner you also need to have a strategy in place that ensures employees and customers play their part in ensuring compliance.
This means that apart from setting up physical safeguards like threat monitors, and technical safeguards like data encryption and authentication, business owners and management have an administrative responsibility to train their employees on data privacy best practices.
Now, this is where we come in.
Employee training to ensure data privacy
EasyLlama offers a cybersecurity and data privacy training program that will cover all the concepts we have covered in this post in more depth. This includes the regulations that govern your business, common threats that can lead to data breaches and compromise data privacy, and also security practices for protecting your organization's data.
A threat monitor will help detect system intrusions but our training will help your employees recognize common tricks that malicious actors use to infiltrate systems.
It's only through training that employees can learn about the importance of a clear desk and clear screen policy.
It's also through training that employees will learn the risks of using weak passwords or using a single password for multiple accounts.
Why choose us?
Remaining compliant is simpler than ever with EasyLlama’s suite of Data Privacy & Cybersecurity training courses. We'll help educate your entire company to follow the rules and regulations as well as avoid unnecessary fines. To start with, our training is a collaborative effort between experts in both the IT and legal landscape to ensure that it protects data privacy in a way that's compliant with existing laws and regulations.
Moreover, we use interactive video training complete with real-life scenarios and quizzes at the end to make the training fun and leave no room for misunderstanding. Our software makes it easy to track the progress of employee training which will be critical in proving compliance. Sound good? Access your free demo now.
