A constantly changing regulatory environment has become the “new normal” for data privacy, and 2020 is no exception. The California Consumer Privacy Act (CCPA) went into effect in January and introduced one of the most sweeping requirements the U.S. has seen at a state level. In addition, the global health crisis has seen concerns around new and emerging uses of personal data. As the complexity of regulations increases, so does the responsibility for organizations to manage personal data and ensure their security and privacy teams are aligned to respond to security incidents and potential privacy breaches.
Security and privacy experts from IBM, Eden Autism, Iron Mountain and American Cyber Security Management recently discussed the current regulatory environment and shared best practices on managing a privacy practice and being prepared to respond to privacy-related cybersecurity threats. Below is a summary of the key takeaways.
A Foundational Privacy Practice Helps Organizations Manage Change
In order to stay ahead of change and lessen its impact, panelists recommend that organizations develop a foundational privacy practice. Elements of having a strong privacy practice include having robust policies, processes and tools in place to help manage data privacy and breach notification requirements. Employees should be regularly communicated with about training or changes that may affect them. For example, when employees shifted to working remotely overnight due to the global health crisis, new protocols needed to be quickly implemented for handling printouts and hard copies that include personal data. Having processes and tools in place to identify and communicate these kinds of changes can help teams adapt quickly and ensure compliance.
As a result of the global health crisis, there are a wide range of emerging uses of personal and health data, such as contact-tracing apps, telemedicine and network thermometers, still being defined. Having the tools and processes to manage data collection, retention and disposal, as well as privacy breach requirements and notifications are necessary to keep abreast of the changes and continuously adapt. Panelists’ recommendations for building a foundational privacy practice include adopting technologies that scale, aligning security and privacy teams, and recognizing privacy as a strategic differentiator.
Align Security & Privacy Teams
To quote one of the panelists, “privacy is a team sport.” A strong, foundational privacy practice recognizes the importance of breaking down silos between security and privacy teams. These two teams often have varying perspectives: While security is concerned with securing the data, the privacy team is focused on understanding the type of data collected, how it is stored and when and how it should be removed. These different viewpoints are necessary for privacy breach preparation and response to be handled efficiently and in a timely manner. With more and more versions of regulations appearing all the time, panelists recommend aligning security and privacy teams to ensure collaboration and a coordinated response. Most importantly, teams should “reach across the aisle” and start collaborating now, in order to prepare, rather than doing it for the first time when trying to respond to a major privacy breach.
Adopt Technologies that Scale and Adapt with Your Needs
There is no shortage of point solutions to address very defined needs. However, panelists recommend taking a broad approach to technology so that organizations are investing in tools that solve multiple problems, rather than one, and provide a platform to proactively address future needs. For example, a panelist shared that a tool used to monitor Medicaid exclusion checking was later used for other use cases that required automated monitoring, such as policy sign-offs for privacy and security staff and automated tracking of training and license expirations. Panelists recommend taking a holistic approach in order to proactively scale and address future needs.
To help improve privacy breach response times, organizations are leveraging orchestration and automation capabilities to help provide a platform for consistent, repeatable processes for privacy and security teams. By leveraging automation to assist in responding to Data Subject Access Requests (DSARs), companies can better coordinate their response, collaborate across teams and automate portions of the process, resulting in accelerated response times. Utilizing an automated solution, such as a Security Orchestration, Automation and Response solution, also provides a system of record and audit trail.
Recognize Privacy as a Strategic Priority
Executive support and leadership for privacy is one of the most important factors needed to ensure a robust privacy practice. An executive-driven approach sets the tone that permeates throughout the organization, encouraging collaboration across departments and providing privacy the attention it requires. HR, legal, compliance, security and IT are just some of the teams affected by privacy and need to have a “seat at the table.” Setting up a governance, risk and compliance (GRC) committee with cross-functional representation is suggested as a best practice to ensure privacy is visible and departments are held accountable. Conducting an assessment each year can help identify your privacy program’s strengths and weaknesses and highlights gaps and areas of improvement.
Taking a strategic approach to privacy with executive leadership and oversight in place will not only help companies mature their privacy posture, but provide opportunities to utilize privacy as a competitive differentiator.
To learn more about best practices for adapting to the current regulatory environment and hear directly from panelists, you can listen to a replay of the webinar here.