TDWI Articles

How to Survive the Coming Data Privacy Tsunami

Prepare for new data privacy regulations by fortifying these eight focus areas.

Just as we became used to the idea that the EU's General Data Protection Regulation (GDPR) is a fact of life and made modifications in our data collection procedures, the Brazil General Data Protection Law (LGDP), the California Consumer Privacy Act (CCPA), and waves of other proposed new data privacy laws are forecasting a privacy tsunami heading our way. With so many acronyms swirling around, you could be easily be overwhelmed.

For Further Reading:

Who Truly Owns That Data?

California's New Privacy Law: What You Need to Know Now

Privacy Laws Will Soon Be Inescapable

However, although you will need to pay attention to the details of individual data regulations as they arise, all the privacy regulations share a number of commonalities. By addressing these eight areas now, you will be safely on high ground when the waves begin to pound.

Accountability and Governance

Data privacy requirements are intended to motivate organizations to self-manage their data in a way that respects end users. To address accountability and governance requirements in your organization:

  • Review the risk to your organization from data privacy issues, and consider alternatives, including insurance, in case you are fined
  • Mandate that data privacy become part of the policy program, including staff training, measurement, and compliance reporting
  • Clearly document roles, responsibilities, and reporting lines to embed privacy compliance

Consent and Processing

A fundamental requirement under most privacy regulation is that end users must be aware when, how, and why their data is collected -- as well as what happens to it after collection. To address this, your enterprise should:

  • Review that the data being collected and used is necessary and for a specific purpose, such as completing a user's desired action
  • Identify sensitive data and ensure it is treated as such through the use of special encryption or by validating vendor storage practices for sensitive data
  • Confirm that you clearly capture and document user consent for data collection
  • Confirm that you can modify or erase user data when needed

Notifications and Data Rights

Gone are the days of legalese or simply taking data from users because we can. Data privacy regulations require transparency, user awareness, and forthright behavior. Your organization should:

  • Write user notices clearly so they can be easily understood—properly targeted to children where relevant—and reflect your specific data collection and use practices
  • Update your data privacy policy to clearly state the rights of prospects and customers regarding the collection and processing of their personal data
  • Create and test processes to correct and delete all user data if needed
  • Develop a solution to give users their data in a portable electronic format

Privacy Design

Organizations that treat privacy as a core design principle will always be in alignment with data privacy regulations. In my consulting experience, I see many self-disciplined organizations that have historically had good privacy practices and have little to address with each new law. To strengthen your privacy design:

  • Create or update the policy and associated processes to embed privacy into all technology and digital projects
  • Don't forget to embed privacy into projects outsourced to vendors and partners

Data Breach Notification

For many organizations, the question nowadays isn't whether your organization will have a breach, but rather when will it happen and how will you respond. To address this reality, your organization must:

  • Create (or review and update as needed) a data breach policy and response plan to reflect detection, notification, and actions to mitigate loss
  • Consider obtaining insurance for a possible data breach to cover regulatory penalties that your organization may face but not be able to handle on its own
  • Incorporate data breach terms and requirements into all vendor and third-party contracts

Data Localization

New data privacy regulations state where data must be physically stored and the requirements for transferring it to another country. To handle this:

  • Identify and update all cross-border data flows from the country where the data is collected
  • Review data export procedures for both on-premises and cloud solutions

Children's Online Privacy Considerations

Data privacy regulations are concerned with all end users, but the rules are even stricter about children and their online data protection and rights. To get ahead of these issues, your enterprise should:

  • Define what data you collect from children, whether as a business practice or through efforts such as "take your child to work day"
  • Ensure your user notifications and online privacy statements are written so that a child could understand and clearly state whether parental consent is required to accept

Contracting and Procurement

Most businesses may struggle to understand exactly what personal user data is collected via websites, mobile applications, and other digital platforms, especially through third-party software solutions and vendors. To make sure that your organization isn't caught out, you should:

  • Ensure that all vendor, customer, and third-party agreements reflect current data regulatory requirements
  • Define procurement processes such that privacy is integrated into all products and services the organization buys
  • Pay special attention to vendor policies on data minimization, the visibility of data flows, and data ownership

The Bottom Line

After years of collecting as much data as we could, we are starting to realize that all that data has an evil twin: risk. In addition, consumers have become more aware that their data is a valuable resource, and they're asking more questions about how it's used and who has access to it. Governments across the world are also starting to pay more attention.

Make sure that you get ahead of the coming waves of data privacy regulation today, or your organization risks drowning when they hit.

 

About the Author

Kristina Podnar is a digital policy innovator. For over two decades, she has helped high-profile companies around the world see policies as opportunities to free the organization from uncertainty, risk, and internal chaos. Her new book, The Power of Digital Policy: A practical guide to minimizing risk and maximizing opportunity for your organization is available on Amazon and through other fine booksellers. For more information, visit Kristina at www.kpodnar.com or on LinkedIn and Twitter.


TDWI Membership

Accelerate Your Projects,
and Your Career

TDWI Members have access to exclusive research reports, publications, communities and training.

Individual, Student, and Team memberships available.