Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:00 AM
Hilary Wandall
Hilary Wandall
Connect Directly
E-Mail vvv

Simplify Your Privacy Approach to Overcome CCPA Challenges

By building a privacy-forward culture from the ground up and automating processes, organizations can simplify their approach to privacy and be prepared for any upcoming regulations.

The July 1 enforcement date for the California Consumer Protection Act (CCPA) has come and gone, but how confident are companies that they're compliant with that and other regulations? TrustArc polled 1,500 privacy professionals around the globe to gauge readiness for CCPA, as well as the overall state of privacy compliance. It turns out that for quite a few organizations, compliance is still a work in progress.

Just more than one-quarter (27%) of respondents have either some, very little, or no confidence that their company is able to keep all of their employees' and customers' relevant data secure and protected. The facets of their organizations in which respondents most lack confidence include training, tools and technology, and mindfulness.

Related Content:

ISO 27701 Paves the Way for a Strategic Approach to Privacy

The Threat from the Internet—and What Your Organization Can Do About It

Respondents cite a number of challenges that may affect their confidence, including increased usage of third-party technologies such as videoconferencing platforms, staying current with changing regulations, and managing risks.

The following suggestions will help organizations overcome the challenges of third-party technologies and their underlying data, an ever-changing privacy-regulation landscape, and maintaining organizational mindfulness.

Implement Additional Security Layers for Third-Party Technology
To enable employees to work remotely, numerous companies have been forced to quickly adopt new third-party applications or use existing third parties differently during the COVID-19 crisis. To manage vendor risk effectively, it is essential that companies assess new vendors before beginning to use them. Third-party risk assessment is a critical step to ensure data privacy during remote work.

After vetting third-party vendors, companies can implement an additional layer of security, such as secure video meetings. Organizations should require employees to use password-protected videoconference services and encourage the use of "waiting room" features where the meeting host manually allows participants to enter the meeting. Taking these precautions can prevent unknown parties from entering company meetings that now increasingly include discussions of highly sensitive information. Adding these safeguards will make it easier for organizations to ensure the information discussed or shared in these virtual meetings remains secure.

Automate Risk-Assessment Processes to Remain Current
There are now more than 900 different privacy regulations around the world, and this list continues to grow and evolve on a daily basis. To remain current, companies must examine each law; pore over their records, including data from third-party sources; and determine the risk factor of their data as it pertains to each law. Often, organizations maintain this compendium of regulatory risk factors via spreadsheet and other manual processes.

Attempting to stay apprised of 900 existing laws and regulations — even as hundreds more swirl around US state legislatures — by manually calculating risk factors is a Sisyphean task. To remain current, companies will have to leverage technology that can automate parts or all of these processes, thereby simplifying risk assessment.

Operationalize Risk Management
In addition to making risk-assessment processes more automated, successful organizations should weave the considerations of personal data usage into the fabric of their company and services. One way to do that is to have a chief privacy officer (CPO) lead ongoing discussions about privacy and ensure that privacy is embedded in the framework of the organization.

Privacy isn't a checklist item, a task with a beginning and an end. Rather, it is an ongoing strategy that CPOs and other privacy officers, such as chief information security officers (CISOs), should be responsible for administering. Privacy officers must work to do the following:

  • Ingrain data privacy concerns into their entire organization from day one.

  • Expend resources on individual rights management, privacy-by-design principles in product and service development, and operationalized data governance in the form of record-keeping, data retention and deletion policies, and mapping data flows.

Above All, Simplify
Between the myriad privacy laws, the array of technologies companies use, and the increasing reliance on data as a business asset, data privacy compliance is a complicated issue. With so many moving parts, it's no wonder that many organizations struggle to build ongoing privacy programs. By building a privacy-forward culture from the ground up and automating processes wherever possible, organizations can simplify their approach to privacy and ready themselves for CCPA as well as any regulations coming up on the horizon.


As a lawyer, scientist, and ethicist with 25 years of experience, Hilary Wandall is a highly regarded data privacy thought leader and international data regulation expert. She is often called upon by government agencies in the US, the EU, Asia and Latin America to provide her ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.