Simplify Your Privacy Approach to Overcome CCPA Challenges

The July 1 enforcement date for the California Consumer Protection Act (CCPA) has come and gone, but how confident are companies that they're compliant with that and other regulations? TrustArc polled 1,500 privacy professionals around the globe to gauge readiness for CCPA, as well as the overall state of privacy compliance. It turns out that for quite a few organizations, compliance is still a work in progress.

Just more than one-quarter (27%) of respondents have either some, very little, or no confidence that their company is able to keep all of their employees' and customers' relevant data secure and protected. The facets of their organizations in which respondents most lack confidence include training, tools and technology, and mindfulness.

Respondents cite a number of challenges that may affect their confidence, including increased usage of third-party technologies such as videoconferencing platforms, staying current with changing regulations, and managing risks.

The following suggestions will help organizations overcome the challenges of third-party technologies and their underlying data, an ever-changing privacy-regulation landscape, and maintaining organizational mindfulness.

Implement Additional Security Layers for Third-Party Technology
To enable employees to work remotely, numerous companies have been forced to quickly adopt new third-party applications or use existing third parties differently during the COVID-19 crisis. To manage vendor risk effectively, it is essential that companies assess new vendors before beginning to use them. Third-party risk assessment is a critical step to ensure data privacy during remote work.

After vetting third-party vendors, companies can implement an additional layer of security, such as secure video meetings. Organizations should require employees to use password-protected videoconference services and encourage the use of "waiting room" features where the meeting host manually allows participants to enter the meeting. Taking these precautions can prevent unknown parties from entering company meetings that now increasingly include discussions of highly sensitive information. Adding these safeguards will make it easier for organizations to ensure the information discussed or shared in these virtual meetings remains secure.

Automate Risk-Assessment Processes to Remain Current
There are now more than 900 different privacy regulations around the world, and this list continues to grow and evolve on a daily basis. To remain current, companies must examine each law; pore over their records, including data from third-party sources; and determine the risk factor of their data as it pertains to each law. Often, organizations maintain this compendium of regulatory risk factors via spreadsheet and other manual processes.

Attempting to stay apprised of 900 existing laws and regulations — even as hundreds more swirl around US state legislatures — by manually calculating risk factors is a Sisyphean task. To remain current, companies will have to leverage technology that can automate parts or all of these processes, thereby simplifying risk assessment.

Operationalize Risk Management
In addition to making risk-assessment processes more automated, successful organizations should weave the considerations of personal data usage into the fabric of their company and services. One way to do that is to have a chief privacy officer (CPO) lead ongoing discussions about privacy and ensure that privacy is embedded in the framework of the organization.

Privacy isn't a checklist item, a task with a beginning and an end. Rather, it is an ongoing strategy that CPOs and other privacy officers, such as chief information security officers (CISOs), should be responsible for administering. Privacy officers must work to do the following:

Above All, Simplify
Between the myriad privacy laws, the array of technologies companies use, and the increasing reliance on data as a business asset, data privacy compliance is a complicated issue. With so many moving parts, it's no wonder that many organizations struggle to build ongoing privacy programs. By building a privacy-forward culture from the ground up and automating processes wherever possible, organizations can simplify their approach to privacy and ready themselves for CCPA as well as any regulations coming up on the horizon.