As local privacy regulations take effect in places like California and the U.K., security leaders around the world are sensing a shift toward stronger data privacy and transparency — and are using these laws as guidelines to help them make budgetary decisions.
The California Consumer Privacy Act was signed into law on June 28, 2018, and will take effect by 2020. The law will take an approach similar to the General Data Protection Regulation (GDPR) regarding transparency and consent around personal information. GDPR went into effect across the European Union (EU) just one month before the new law’s signing.
Like other privacy regulations, organizations in California must now ensure their customers know what kind of information they are collecting and sharing with third parties, such as advertisers and marketers. Consumers can choose to opt out of having their information collected, and companies that fail to comply risk incurring fines from the state’s attorney general.
Local Privacy Regulations Guide Private Sector Security Strategies
While GDPR and the California Consumer Privacy Act focus on how companies gather and manage data, other legislators are trying to ensure that the systems they use don’t fall prey to cybercriminals.
The U.K.’s Cabinet Office, for instance, published the first iteration of its “Minimum Cyber Security Standard” in June 2018. Though designed as a checklist for government agencies, organizations can adopt some of its practices in the private sector — such as checking websites and applications for common vulnerabilities — to keep ahead of further privacy legislation. As with more traditional privacy regulations, it outlines several mandatory requirements, including support for Transport Layer Security (TLS) encryption.
Regulatory Activity Impacts Security Budgets Around the World
These new laws and regulations reveal that chief information security officers (CISOs) from California to the U.K. are starting to use privacy regulations as a guide to determine what resources they will need to be effective.
For instance, according to a February 2018 report from consulting group Ankura, The Shifting Cybersecurity Landscape: How CISOs and Security Leaders Are Managing Evolving Global Risks to Safeguard Data, 73 percent of CISOs said regulatory activity drives their decision-making around security budgets — and all respondents said they had to comply with at least one such framework.
Even if privacy regulations like GDPR don’t directly pertain to their organizations, the Ankura report suggested that security leaders are paying close attention because they recognize that one piece of legislation can influence what other governments may demand in the future.
In other words: The effects of cybersecurity legislation in places like the E.U., the U.K. and California are reaching far past their own borders. As data privacy laws proliferate around the world, security leaders everywhere will be impacted by the shift toward greater protection and transparency.