Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:00 PM
Connect Directly
E-Mail vvv

Avoid That Billion-Dollar Fine: Blurring the Lines Between Security and Privacy

While doing good for the user is the theoretical ideal, the threat of fiscal repercussions should drive organizations to take privacy seriously. That means security and data privacy teams must work more closely.

In the wake of companies such as British Airways, Marriott, and Facebook facing record privacy violation fines, organizations are seeing the ramifications of not having their privacy compliance under control. Clearly, the lines between data security and data privacy are blurring, and companies are beginning to establish their lines of defense for data security — and are still figuring out data governance and management.

The responsibility for helping companies comply with privacy regulations lies in a gray area between security teams and data teams. To avoid the billion-dollar fines that are becoming more common, privacy and security teams must collaborate to achieve compliance.

Formidable Fines
Last year, tech behemoths including Facebook, Google, Apple, and YouTube all came under investigation for violations of the European Union's General Data Protection Regulation, and some have been fined as a result. Facebook was hit the hardest, garnering the largest fine ever required of a tech company, $5 billion. In the EU to date, we've seen fines racking up to €372 million. The introduction of California Consumer Privacy Act will only raise the bar for these fines globally.

As a result, companies have established accountability with a data protection officer (DPO) and involved every employee in the privacy conversation. We can expect these practices to become more common, and security teams, as well as data management and governance teams, will be more involved in privacy-related matters. Additionally, while the tech giants have made the most spectacular headlines, we have also seen those fines and infringement repercussions trickling down to smaller companies across the globe, broadening the need for implementation of privacy best practices. 

Recent smaller fines include a $21,000 fine for a Swedish school after it conducted a trial in which the attendance of 22 pupils was tallied using facial recognition.

Similarly, a €500 million online food delivery company in Germany failed to comply with data subject access rights after not deleting accounts of former customers in 10 cases — even if they'd been inactive in the company's service platform for years. To make matters worse, eight former customers also complained about unsolicited advertising emails from the company. Specifically, a data subject who had objected to the use of his data for advertising purposes still received 15 additional advertising emails from the delivery service. In other cases, the company did not provide the data subjects with the required information or they did so only after the Berlin data protection officer intervened. This resulted in a nearly €200,000 fine, which is significant compared with the company's global revenue.

These cases illustrate that data privacy has become a very broad topic, spanning beyond the traditional data security vulnerabilities that we first think about. Every company must be prepared, no matter its size and business activities. In addition to the fines, repercussions for companies that fail to comply include:

  • Exposure to reputational and revenue risks as data privacy violations are breaking customer satisfaction and relationships: For example, the Information Commissioner's Office, the UK's independent authority on data privacy, said that 46% of the complaints it collects are related to the disrespect of the right for data access, rectification, and deletion.
  • Rising costs in their operations: For example, it has been shown that addressing subject rights requests, which gives individuals the right to obtain a copy of their personal data, with a manual process is not only error prone but can be very costly, with an average of $1.40 per request, according to a recent Gartner survey

Collaboration for Compliance
Privacy teams must establish the framework for data privacy, which includes, but is not limited to, data security and protection against data breaches. Typically, privacy teams are responsible for knowing where user data is and how it flows, proactively safeguarding it and making sure it is used for a purpose. One important role of the privacy team is to establish privacy by design, which means that each project within the company that needs personal data must understand and be accountable for the impact it has on privacy. This requires strong collaboration between the privacy, security, IT, and data teams to protect, monitor, and take action once a breach has occurred — whether it involves sensitive user, company, or customer information.

While the privacy and security teams are generally not intertwined, they certainly have overlap that needs to be addressed. To give companies the best chance of avoiding fiscal repercussions, data privacy teams must take stock of how data use can be interpreted as a personal privacy infringement and share their practices with security teams, which can take measures to protect the data where it lives before it is threatened.

Having a DPO who acts as an orchestrator, engaging both the privacy and security teams and educates employees is a best practice for ensuring compliance. Once a niche role, the DPO got a huge boost with GDPR, which made it mandatory, and today there are an estimated half-million DPOs registered in Europe alone! While the chief security officer (CSO) role is not a result of privacy regulations, it has become more widespread across the enterprise and was elevated to an executive level in the digital era.

Privacy is a different discipline from security though, and there needs to be accountability and practices that are deployed widely so everyone in a company understands and implements them. The CSO acts as a bridge between security and privacy to ensure this happens, especially in the US, where regulations do not mandate a DPO.

Not only is data privacy important for the good of the individual, but it must also be a top priority for companies, which risk losing billions of dollars. While doing good for the user is the theoretical ideal, the threat of fiscal repercussions should drive organizations to take privacy seriously — and this is best practiced through collaboration between security and privacy teams. Everyone from security and privacy teams to sales and marketing teams must be in compliance and understand their responsibilities. Educate every individual at the company and collaborate together on training and trust exercises. 

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "With International Tensions Flaring, Cyber-Risk Is Heating Up for All Businesses."

Jean-Michel Franco has dedicated his career to developing and broadening the adoption of innovative technologies and is currently the Senior Director of Product Marketing at Talend. He is an expert of GDPR, CCPA, and data privacy, working on the front lines with Talend's ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Are You One COVID-19 Test Away From a Cybersecurity Disaster?
Alan Brill, Senior Managing Director, Cyber Risk Practice, Kroll,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-26
libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.
PUBLISHED: 2020-10-26
An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application usi...
PUBLISHED: 2020-10-26
Ruckus through is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py.
PUBLISHED: 2020-10-26
Ruckus vRioT through has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.
PUBLISHED: 2020-10-26
In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable]. The problem has been patched in version ...