Make the ‘culture of privacy’ a priority!

AS we all know, all organizations are collecting data as part of their business directing processes. What we unfortunately also know is that some of the big tech companies around the world know more about us than we want them to know. What is even worse is that these big tech companies are selling our personal data which can easily be bought by “bad” organizations that are misusing our personal information.

Therefore, it cannot be reiterated enough: personal information is property that belongs to us, which companies must handle with care.

That makes privacy compliance a much more complex challenge. Companies need to think more about what’s best for the consumer as we handle personal data, as well as how to accommodate the consumer and the rights he or she might exercise under various privacy regulations.

In short, businesses need to make a “culture of privacy” a priority, in much the same as anti-corruption activists like the Integrity Initiative and partners stressed the importance of a culture of compliance in the 2010s. A culture of privacy and security must be the watchword now.

It forces deeper changes in business processes, policies, and corporate awareness of privacy—and any time we talk about changes in policy, procedure, and corporate culture, the compliance function is crucial to that.

Now let’s get more practical. When you translate those goals into capabilities that the company must have to get the job done, several emerge as the most important:

1. Data Management

THE regulation includes a list of specific types of information within the scope of the Data Privacy law—names, e-mail addresses, photos, audio recordings, Internet search history, biometric data, and more—plus the catch-all, “any information that can reasonably be associated” with a specific person.

The most fundamental compliance capability is simply to understand what personal data your company collects. Where does that data enter your extended enterprise? What business processes touch it? What third parties touch it? Where is the data stored?

2. Assessment and Monitoring of Third Parties.

OVERSIGHT of third parties is not a new capability per se, but the Data Privacy law pushes the need for that capability to new heights. For example, it draws a distinction between “service providers” and other third parties. A service provider receives personal data from your business as part of a written contract, to execute a specific task for you: write a legal brief, host a web site, run payroll, and so forth.

This means compliance functions will need to sharp en their assessment of third parties, to understand the exact business relationship and assure that it meets all the criteria for service providers.

3. Building Compliance Business Processes

REMEMBER, the Data Privacy law gives residents certain rights to their personal data. For example, under the Data Privacy law, consumers have a right to see the data that a company has collected about them. Consequently, companies need to devise policies and procedures to fulfill that right: a way for consumers to submit the request, procedures to identify all the relevant data, and a way to present that list of data back to the consumer.

Well, security specialists have already identified bogus data access requests—where hackers pretend to be someone asking to see his data and dupe a company into sharing it. Companies will need to be aware of that threat and build identity-confirmation controls into their access request procedures.

Likewise, consumers can ask for companies to delete their personal data.

These are only three capabilities a company will need to develop to achieve DPA compliance; we could discuss many more. Fundamentally, the DPA will require the compliance function to get more involved in structuring business processes, since so many business processes now involve at least some processing of personal data—and achieving DPA compliance is about handling personal data with proper care, at all times.

There is plenty training on data privacy protection available and there is automation available to assist Data Privacy Officers to supervise the data flows in organizations.