Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:00 AM
Hilary Wandall
Hilary Wandall
Connect Directly
E-Mail vvv

Simplify Your Privacy Approach to Overcome CCPA Challenges

By building a privacy-forward culture from the ground up and automating processes, organizations can simplify their approach to privacy and be prepared for any upcoming regulations.

The July 1 enforcement date for the California Consumer Protection Act (CCPA) has come and gone, but how confident are companies that they're compliant with that and other regulations? TrustArc polled 1,500 privacy professionals around the globe to gauge readiness for CCPA, as well as the overall state of privacy compliance. It turns out that for quite a few organizations, compliance is still a work in progress.

Just more than one-quarter (27%) of respondents have either some, very little, or no confidence that their company is able to keep all of their employees' and customers' relevant data secure and protected. The facets of their organizations in which respondents most lack confidence include training, tools and technology, and mindfulness.

Related Content:

ISO 27701 Paves the Way for a Strategic Approach to Privacy

The Threat from the Internet—and What Your Organization Can Do About It

Respondents cite a number of challenges that may affect their confidence, including increased usage of third-party technologies such as videoconferencing platforms, staying current with changing regulations, and managing risks.

The following suggestions will help organizations overcome the challenges of third-party technologies and their underlying data, an ever-changing privacy-regulation landscape, and maintaining organizational mindfulness.

Implement Additional Security Layers for Third-Party Technology
To enable employees to work remotely, numerous companies have been forced to quickly adopt new third-party applications or use existing third parties differently during the COVID-19 crisis. To manage vendor risk effectively, it is essential that companies assess new vendors before beginning to use them. Third-party risk assessment is a critical step to ensure data privacy during remote work.

After vetting third-party vendors, companies can implement an additional layer of security, such as secure video meetings. Organizations should require employees to use password-protected videoconference services and encourage the use of "waiting room" features where the meeting host manually allows participants to enter the meeting. Taking these precautions can prevent unknown parties from entering company meetings that now increasingly include discussions of highly sensitive information. Adding these safeguards will make it easier for organizations to ensure the information discussed or shared in these virtual meetings remains secure.

Automate Risk-Assessment Processes to Remain Current
There are now more than 900 different privacy regulations around the world, and this list continues to grow and evolve on a daily basis. To remain current, companies must examine each law; pore over their records, including data from third-party sources; and determine the risk factor of their data as it pertains to each law. Often, organizations maintain this compendium of regulatory risk factors via spreadsheet and other manual processes.

Attempting to stay apprised of 900 existing laws and regulations — even as hundreds more swirl around US state legislatures — by manually calculating risk factors is a Sisyphean task. To remain current, companies will have to leverage technology that can automate parts or all of these processes, thereby simplifying risk assessment.

Operationalize Risk Management
In addition to making risk-assessment processes more automated, successful organizations should weave the considerations of personal data usage into the fabric of their company and services. One way to do that is to have a chief privacy officer (CPO) lead ongoing discussions about privacy and ensure that privacy is embedded in the framework of the organization.

Privacy isn't a checklist item, a task with a beginning and an end. Rather, it is an ongoing strategy that CPOs and other privacy officers, such as chief information security officers (CISOs), should be responsible for administering. Privacy officers must work to do the following:

  • Ingrain data privacy concerns into their entire organization from day one.

  • Expend resources on individual rights management, privacy-by-design principles in product and service development, and operationalized data governance in the form of record-keeping, data retention and deletion policies, and mapping data flows.

Above All, Simplify
Between the myriad privacy laws, the array of technologies companies use, and the increasing reliance on data as a business asset, data privacy compliance is a complicated issue. With so many moving parts, it's no wonder that many organizations struggle to build ongoing privacy programs. By building a privacy-forward culture from the ground up and automating processes wherever possible, organizations can simplify their approach to privacy and ready themselves for CCPA as well as any regulations coming up on the horizon.


As a lawyer, scientist, and ethicist with 25 years of experience, Hilary Wandall is a highly regarded data privacy thought leader and international data regulation expert. She is often called upon by government agencies in the US, the EU, Asia and Latin America to provide her ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-21
Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation (e.g., routing node, payment-receiver,...
PUBLISHED: 2020-10-21
Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount collis...
PUBLISHED: 2020-10-20
Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
PUBLISHED: 2020-10-20
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.
PUBLISHED: 2020-10-20
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.