Newsletters
Risk Central
Digital EditionMitigation Is Better Than Litigation: 3 Steps to Dodge Data Privacy Traps
Martin J. Frappolli, CPCU, FIDM, AIC, is Senior Director of Knowledge Resources at The Institutes, and editor of the organization's new “Managing Cyber Risk” textbook. He can be reached at [email protected].
Data privacy concerns aren’t new — but they are growing. Since the Privacy Act of 1974 and HIPAA in 1996, we’ve seen two factors fueling data privacy concerns. First, organizations recognize the growing value of data and seek to exploit customer data for competitive advantage.
Second, with ease of connection via the internet and the explosion of data sources, more personally identifiable information (PII) is being generated, stored, and analyzed.
Let’s examine three fundamental steps to mitigate data privacy risk — and avoid litigation.
1) Assess your exposures under GDPR, the CLOUD Act and other regulations.
The purpose of the 2018 General Data Protection Regulation (GDPR) is to “give back control to [EU] citizens over their personal data.” Under GDPR, organizations designing a new product or service must ensure that, by default, minimal personal data is collected, used and retained.
American organizations should know how GDPR affects them. If, for example, your company has customers — or employees/contractors — who are EU citizens or at least based in EU countries, you must comply with GDPR. Potential U.S. or EU business partners may shy away from non-compliant companies out of fear of contaminating their GDPR-compliant databases with non-compliant data. If EU citizens visit your website (regardless if a transaction takes place), their GDPR-protected PII is in your database.
Dan Seyer, in Forbes, writes that “instead of figuring out whether you can justify avoiding GDPR, try to justify why you would want to. With a handful of exceptions, the majority of GDPR is little more than a global privacy best practices document. A big portion of GDPR includes things that arguably most American Fortune 1000 companies should have done years ago.”
American organizations should know how GDPR affects them. If, for example, your company has customers — or employees/contractors — who are EU citizens or at least based in EU countries, you must comply with GDPR.
The Clarifying Overseas Use of Data (CLOUD) Act of 2018 permits U.S. law enforcement officials to force technology companies to surrender user data, even if that data is stored in another country with different data privacy laws. It further gives the executive branch power to enter agreements with other nations for cross-nation access to user data, regardless of the host nation’s privacy laws.
This legislation is praised by some and criticized by others; either way, it raises concerns about what kind of customer data an organization might want to collect and how it can be protected.
2) Avoid unnecessary exposures — why collect personal data you aren’t using?
It’s time to re-evaluate all points of customer contact. Think about how you (and your partners) contact customers and collect data from them. What scripts are your call center reps reciting? What kinds of information do you collect from web visitors? Do you need and do you use each data element you collect? If not, stop collecting it.
Do your customers fill out paper or online renewal forms and applications? That form you designed in 1993 may not be right for 2019 and forward. In the wake of HIPAA, most companies stopped collecting social security numbers (and hopefully removed those numbers from customer records). You might want to prepare for a new round of carefully curating the customer data you can actually use.
3) Apply time-tested risk management techniques — minimize the exposure before trying to insure against loss.
Not that long ago, fire was considered an uninsurable exposure due to the frequency and severity of losses. Over time, people and organizations developed good fire hygiene habits like building codes, fire escapes, sprinkler systems and boiler inspections. Today, we perform all of the now-routine good safety habits first, and then we buy fire insurance just in case.
Cyber risk and data privacy risk are fundamentally like other conventional risks in that we need to first mitigate the risk by good habits before seeking to transfer the risk by insurance. Know the laws and regulations around data privacy; build safe networks; enforce your data privacy standards on your business partners; train employees; collect only the data you need. Do all of those things and then seek out the proper cyber risk coverage for first-party and third-party exposures.
Large organizations have risk managers to handle these emerging risks as smoothly as they handle conventional exposures like fire. Medium and smaller organizations might seek out good cyber risk management advice from their insurance agents and brokers. Mitigate up front, and you won’t need to litigate later. &
