In this post, we’ll provide an all-encompassing run down of data security and data privacy, why it’s important, real-world examples, and key tips for your organization to keep your data secure and private.
Data security and data privacy are strongly interconnected but not the same. Knowing the differences is important to better understanding how they work, and what they each mean to your business.
With GDPR over a year old, and the California Consumer Privacy now in effect, it’s now more important than ever for organizations to make sure they understand what these two things are, why they matter and how to address them in their day to day business operations.
It’s especially important for industries with strict compliance laws such as healthcare, legal services, finance, and biotech, however, it does apply to anyone collecting data. It also should be noted that this doesn't just apply to the IT or Compliance department, but really the entire organization from marketing and sales to customer service.
Data privacy is a part of data security and is related to the proper handling of data - how you collect it, how you use it, and maintaining compliance.
Data security is about access and protecting data from unauthorized users through different forms of encryption, key management, and authentication.
With all the legalities now in place protecting consumer’s privacy and data, it’s critical that your business understands the implications of not understanding nor addressing these two items. Now that we’ve covered what they actually are, let’s dive into what it means for you.
As a business, it is your responsibility to keep your data secure and as a result, that also means protecting your employees’, customers’, partners’, and any other contacts’ data safe and secure. Without proper measures in place for this, there are a variety of scenarios that can happen:
1. If you don’t have proper security measures in place such as Multi-Factor Authentication, Multi-Device Management, Identity Management, your business could be at risk for a breach. Aside from employees, your data is your most critical asset. If it becomes compromised, the business will suffer dramatically and may even cease to exist.
2. Without proper measures in place to keep your employee or customer data private, you could be in violation of a variety of regulations. For example, healthcare companies must abide by HIPPA and not share sensitive patient information. This personal information should also not be sold or redistributed without consent. In doing so, you could be 1) violating the law and 2) end up with disgruntled customers who end up leaving you for a competitor. Either way, it has a significant impact on your revenue between fines and loss of customers. Not to mention the reputation you will form that could have lasting effects.
With the EU’s General Data Protection Regulation (GDPR) now in place, businesses need to protect the “personal data and privacy of EU citizens for transactions that occur within the EU.” Now, even though this might seem like something similar to the US, there is a significant difference concerning how the EU and US look at identification information.
While under GDPR compliance, companies need to use the same level of data security for both stored personally identifiable information such as social security numbers, as well as cookies. And even though the GDPR applies to the EU, it also applies to anyone that has dealings within the EU.
To learn more about GDPR, here is a checklist we created to make sure your organization is protecting your data.
The California Consumer Privacy Act (CCPA) took effect in January of 2020. The reasoning behind this bill was to protect the privacy and data of consumers. Essentially, it gives people the right to determine how their data is stored and shared.
With this law in place, and other states starting to follow, it’s critical for businesses in California to understand the legal ramifications and how to abide by the new law. This new law “creates new consumer rights relating to the access to, deletion of, and sharing of personal information that is collected by businesses” meaning California residents have the right to:
The CCPA applies to the following businesses (must meet only one of the following):
While this may not apply to you now, there are other states and even discussions at the federal level where data privacy rights will be more commonplace. Data isn’t going anywhere, in fact, it’s only growing, so regardless if you fall into today’s thresholds, it can’t hurt to start thinking about it for the future.
Here are a few more tips for being CCPA compliant.
In January 2019, Google was fine $57M under the new GDPR law. This shows that even the biggest companies are still struggling with what this means to them and how to incorporate the right security and compliance measures within their business ecosystems.
The complaint came from a privacy group that accused Google of not properly adjusting their data collection policies with the new GDPR regulations. While the fine may be “immaterial,” it goes to show how much they’re really cracking down on this new law.
3 Tips and Reminders for [Staying Data Secure]
One of the best places to start is making sure you're governing your data and enabling the right individuals to access approved resources, resulting in lowering your security risk. How do you do this? It starts with identity management. Identity management is the security and discipline that enables the right people to access the right resources at the right time for the right reasons. There are many tools that allow for this - our favorite being Azure Active Directory. By implementing Identity Management across your systems and network, you ensure all employee activity and data are monitored and managed in a secure way. For example, so many people are working remotely and still collaborating today - documents are being sent back and forth and shared in a variety of ways. Identity Management allows your employees can do this safely.
Conclusion
In conclusion, while data privacy and data security are certainly interconnected, there are different ways to properly address both.
As a reminder, data security focuses on the technology and tools required to deter cybercriminals from getting their hands on your information such as social security numbers, credit cards, accounts, etc.
Data privacy is complying with local and federal laws within and also outside your industry to ensure the data you’re collecting and the processes behind obtaining and what you do with that data are law-abiding.
Both are incredibly important, so I hope this article helped point you in the right direction.
If you wish to learn more, check out our tips on preparing for the CCPA. If you wish to learn more about how we can help you, learn more about our Compliance Management and Identity Management solutions.
[vc_row][vc_column][vc_empty_space][vc_column_text]San Diego, CA, February 6, 2019. Athena San Diego hosted a panel of data privacy experts to discuss how changes in privacy, General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) affect businesses in the US.
Data privacy experts that shared their knowledge and experience with the audience:
The field of privacy is changing. Consumers are now demanding privacy and noticing how their data is being used, and as a result they are taking back the control over their own data. In addition, the laws are holding companies more accountable to respect the privacy of their consumers.
The reality is, data privacy laws are going to apply to your business sooner or later, no matter where you are in the world. Therefore, being informed and ready to comply with the laws is crucial for your business to thrive in the future and establish trust with your consumers.
Robert Meyers, Director of Systems Architecture at Managed Solution explained that the number one challenge that companies face is knowing what data they are collecting in the first place: “The challenges arise when you are keeping data that you do not need anymore. Do not be a data pack rat, know what you have and delete what you do not need.”
The debate was very lively as the audience had a lot of questions and examples for the panel, demonstrating that new data privacy laws bring uncertainty. Therefore, every business should make sure they know in what way the privacy laws affect them and the data they collect and store.[/vc_column_text][grve_callout button_text="Apply here" button_link="url:https%3A%2F%2Fmanagedsolut.wpengine.com%2Fcontact-us%2F||target:%20_blank|"]To help you make first steps towards the CCPA, we offer a free 30 min consultation with our data privacy guru Robert Meyers, CISM, CIPP/E.[/grve_callout][/vc_column][/vc_row]
The purpose of the California Consumer Privacy Act of 2018 is to force changes onto enterprises that deal in personal data. The Act was passed by the California state legislature and was signed by its governor in June 2018. The bill grants consumers the right to request a business to disclose specific pieces and categories of personal information that they collect about them, the types of information sources, and the business purposes for collecting or selling the information. The bill becomes active on January 1st, 2020.
States and countries are taking consumer rights and personal data privacy more seriously.
If your business meets these thresholds, then it is liable for compliance:
Here are some details of the Consumer Privacy Act of 2018, both from the business and consumer standpoint.
Businesses need to be prepared, as the California Consumer Privacy Act of 2018 is coming into compliance in about a year. The majority of companies will be affected by these changes in conducting business in California (and other states will inevitably follow.) Businesses can’t afford to delay their response both to the GDPR and the 2018 Consumer Privacy Act.
Contact Managed Solutions to get help in preparing for the California Consumer Privacy Act of 2018 compliance.
Despite their importance, not everyone knows what data privacy laws are. In short, data privacy laws are all about prohibiting the disclosure or misuse of information of private individuals, and being compliant with data privacy laws is extremely important.
To date, there are over 80 countries that have varying degrees of data security laws in place. Most noteworthy is the European Union's recent enactment of the General Data Protection Regulation (GDPR). The United States, on the other hand, is somewhat notorious for not having a similar, comprehensive set of data privacy laws, but instead, some limited sectoral laws in some areas, based on the Fair Information Practice.
Despite the differences that may occur, some basic principles apply everywhere in the US.
SMEs are concerned whether they are, in fact protecting their client's data and whether they are in compliance with Data Privacy Laws. Here are several other conditions/reasons why SMEs are concerned.
What's more, many of these businesses may not even be aware that they use cloud-based services - in which case they need to comply with these regulations. If you are using Gmail or Outlook.com, you are using the cloud.
All of the requirements presented above will only become more binding and rigorous with time, right alongside the seriousness of the data breaches, themselves.
It is also important to remember that a data breach can also cause more damage to a business than the direct value of the loss. First, there are the personnel costs related to the recovery. Then, we have others such as post-incident costs used for improving customer relations, the brand image, the investigation, plus the many years needed to protect your customer's credit.
The legal costs involved, such as fines, fees, and civil suits should also be mentioned here. Also, let's not forget about the value of lost customers which can quickly send an SME out of business.
ConclusionGoing forward, SMEs need to remember that there are many clearly defined requirements, both legal and financial, for providing adequate protection for your clients' data. As times goes on and digital threats become more and more prevalent, security measures will become more stringent, while providing data security will become another cost of doing business.
If you want to keep yourself up-to-date, please feel free to check out our website. Our IT professionals and engineers have 23 years of combined experience and are more than qualified to find solutions to all of your security concerns. Contact us today to schedule an assessment.
Chat with an expert about your business’s technology needs.
