A wave of new regional data privacy regulations has washed over the landscape since 2018 aimed at making our digital experiences safer and more secure. At the same time, a constantly changing regulatory environment has become the new normal for data privacy.

The California Consumer Privacy Act (CCPA) went into effect in January 2020 and introduced one of the most sweeping requirements the U.S. has seen at a state level. In addition, the COVID-19 pandemic heightened concerns around new and emerging uses of personal data.

As the complexity of regulations increases, so does the responsibility for organizations to manage personal data and ensure that their security and privacy teams are aligned to respond to security incidents and potential privacy breaches. States that now have local privacy laws include Massachusetts, New York, Hawaii, Maryland, North Dakota, Virginia and Vermont – with many more to follow suit.

If your organization is collecting, analyzing or sharing personal data, you need to protect the privacy of data in your trust throughout its lifecycle. It’s not just good business practice, although breached data can pose a brand issue. You need to comply with the growing number of global data privacy laws such as the General Data Protection Regulation (GDPR) and reduce the overall security risks of exposure to your company with the appropriate policies and governance.

We have listed below five key action steps you can take as you embark on managing a privacy practice and being prepared to respond to privacy-related cybersecurity threats:

1.      Institute a Foundational Privacy Office

To stay ahead of change and lessen its impact, organizations should work toward developing a foundational privacy practice. Elements of a strong privacy protocol include robust policies, processes and tools to help manage data privacy and breach notification requirements. Regular communications should inform employees about training or changes that may affect them. For example, when employees shifted to working remotely overnight due to the global health crisis, new protocols needed to be quickly implemented for handling printouts and hard copies that included personal data. Having processes and tools in place to identify and communicate these kinds of changes can help teams adapt quickly and ensure compliance.

As a result of the global pandemic, there are a wide range of emerging uses of personal and health data, such as contact-tracing apps, telemedicine and network thermometers. Having the tools and processes to manage data collection, retention and disposal, as well as privacy breach requirements and notifications, is necessary to keep abreast of the changes and continuously adapt. A successful privacy practice includes adopting technologies that scale, aligning security and privacy teams, and recognizing privacy as a strategic differentiator.

2.      Align Security and Privacy Functions

A strong, foundational privacy practice recognizes the importance of breaking down silos between security and privacy teams. These two teams often have varying perspectives: while security is concerned with securing the data, the privacy team is focused on understanding the type of data collected, how it is stored and when and how it should be removed. These different viewpoints are necessary for privacy breach preparation and response to be handled efficiently and in a timely manner. With a plethora of regulations appearing consistently, we recommend aligning security and privacy teams to ensure collaboration and a coordinated response. Most importantly, teams should start collaborating now, rather than waiting to do it for the first time when trying to respond to a major privacy breach.

3.      Adopt Scalable and Adaptable Technologies

We recommend taking a holistic approach to proactively scale and address future needs. However, taking a broad approach to technology so that organizations are investing in tools that solve multiple problems, rather than one, provides a platform to proactively address future needs. For example, a tool used to monitor Medicaid exclusion checking was later used for other cases that required automated monitoring, such as policy signoffs for privacy and security staff, as well as automated tracking of training and license expirations.

To help improve privacy breach response times, organizations are leveraging orchestration and automation capabilities to provide a platform for consistent, repeatable processes for privacy and security teams. By leveraging automation to assist in responding to Data Subject Access Requests (DSARs), companies can better coordinate their response, collaborate across teams, and automate portions of the process, resulting in accelerated response times. Utilizing an automated solution, such as a Security Orchestration, Automation and Response solution, also provides a system of record and audit trail.

4.      Make Privacy a Strategic Priority

Executive support and leadership for privacy is one of the most important factors needed to ensure a robust privacy practice. An executive-driven approach sets the tone that permeates throughout the organization, encouraging collaboration across departments and providing privacy the attention it requires. Compliance, HR, legal, security and IT are just some of the teams affected by privacy and need to have a seat at the table. Setting up a governance, risk, and compliance (GRC) committee with cross-functional representation is a best practice to ensure privacy is visible and departments are held accountable. Conducting an assessment each year can help identify your privacy program’s strengths and weaknesses and highlight gaps and areas of improvement.

5.      Stay Informed of the Future of Data Privacy Laws

With states taking it upon themselves to innovate in this area, it’s perhaps only a matter of time before a federal law is introduced to create a level playing field. In the meantime, there are three lessons to draw from the state experiments:

• ‘Personally Identifiable Information’ (PII) will be further enhanced, including encompassing probabilistic identifiers (or quasi-PII) that can be used to indirectly identify consumers.
  
• The right to delete will become an essential part of privacy laws. Whether that will extend to a broader “right to be forgotten” is less likely.
• There’s now an understanding among regulators that consumers want to know all the information the companies have about them, backed up with the right to view and correct this data.

In summary, taking a strategic approach to privacy with executive leadership and oversight in place will not only help institutions mature their privacy posture but provide opportunities to utilize privacy as a competitive differentiator.

Copyright © 2022, CBIZ, Inc. All rights reserved. Contents of this publication may not be reproduced without the express written consent of CBIZ. This publication is distributed with the understanding that CBIZ is not rendering legal, accounting or other professional advice. The reader is advised to contact a tax professional prior to taking any action based upon this information. CBIZ assumes no liability whatsoever in connection with the use of this information and assumes no obligation to inform the reader of any changes in tax laws or other factors that could affect the information contained herein.

CBIZ MHM is the brand name for CBIZ MHM, LLC, a national professional services company providing tax, financial advisory and consulting services to individuals, tax-exempt organizations and a wide range of publicly-traded and privately-held companies. CBIZ MHM, LLC is a fully owned subsidiary of CBIZ, Inc. (NYSE: CBZ).