Most technology start-ups lack the experience and resources needed to manage the plethora of security, privacy, and compliance issues inherent in a growing technology business. Nevertheless, the legal and business implications of poorly managed privacy and data security practices are too important to ignore. A single error can undermine the trust of investors and customers, attract unwanted regulatory attention or litigation, and ultimately, derail a start-up’s success.
In this follow up to the first instalment, Francoise Gilbert from Greenberg Traurig LLP talks about 5 additional privacy and data security mistakes that start-ups must avoid.
6. Failure to provide adequate security
Many countries require that companies provide adequate protection for the data – or certain categories of data – in their custody.
A company’s size is not an excuse for failing to seek the proper resources, technologies or experts to ensure the adequate levels of security are adopted to suit the nature of the data stored or processed by an entity.
Security breaches are to be avoided by all means. They are significantly disruptive. A company that has implemented a well thought through written security programme will be less exposed to potential security breaches and to the significant consequences of security breaches.
In most cases, a company that has suffered a breach of security might be required to publicly disclose the occurrence of the breach. It may have to send notices to affected parties and regulators, and offer credit monitoring or identity theft insurance, which is usually a significant expense. If a state of federal regulator becomes aware of the breach, a lengthy, invasive and gruelling investigation of the company’s practices may follow, resulting in significant cost, disruptions, and potentially ending with an order that submits the company to the supervision of a regulator for the next twenty years.
7. Assuming that bigger is better
Some tech start-ups tend to collect much too much data just because “we may need it later” and “storage is cheap.” The more data a company has in its custody, the more vulnerable it is to legal violations and security breaches.
Collecting too much data can cause a compliance issue; some laws require entities to collect only the minimum amount of data necessary to achieve a stated purpose. Additionally, having a lot of data can become a significant responsibility, as well as potentially costing the company significant amounts of capital. For example, some laws grant individuals the right of access to data that a company holds about them. In case of an individual’s request for access to data, the company will be required to provide copies of files that may be located in different locations, on different devices, or in different formats. The more data a company has, the more time and data experts it will need to retrieve it. Collecting a massive amount of data also causes significant security risk. The larger the volume of data the higher the probability that it will stolen.
8. Copying the privacy policy of the business next door
Start-ups often hope to “save” on legal costs by simply copying the privacy policy of another website without fully understanding what it means, or ensuring that the document describes accurately the start-ups policies and procedures. The borrowed document is likely to tell someone else’s story other than that of your company. It will describe the neighbour’s practices, which may be significantly different from those of your company, or, worse, may be illegal. From a legal standpoint, this may end up constituting misrepresentation, which can be prosecuted by a state Attorney General and the Federal Trade Commission and in some states by competitors for “unfair or deceptive practices.”
If you were to run a marathon, would you borrow your neighbour’s shoes? No. You would be concerned that they would not fit you. You would fear that you could be hurt and be unable to continue for the entire distance. Similarly, a borrowed privacy statement likely will not fit your company and may significantly hurt you in your race to the customer. It will not reflect your company, its values, its practices, or its objectives. It will state commitments other than those you would want to make.
9. Making representations that they don’t understand
It is true that legal documents may be long or difficult to read. That is not an excuse for not reading them with a critical eye. Privacy statements of some tech start-ups state “we will never sell your personal data.” This might be their intention at a particular time, but it fails to take into account that the company or a portion of its assets might be sold. An asset deal may be blocked because the main asset of the company is its database, and per the statement in the privacy policy, the database of personal data cannot be sold.
10. Misunderstanding the effect of anonymisation
When discussing personal data protection, it is common to hear: “We don’t have any personal data, our data is anonymised, and it cannot be tied to an individual.” This is a significant mistake. While it might have been true, a long time ago, that anonymisation prevented the association of a particular individual to a particular data set, this is no longer the case. In the world of data analytics, big data, semantics and other tools, there is no such thing as anonymity. Too often, a competent data scientist will be able to crack the anonymisation shell in a short time.
Be proactive from the start
It is clear that technology start-ups need to be proactive about privacy and data security from a very early stage. Small size and limited means are not valid excuses.
- Pay attention to your practices and procedures when handling personal data and sensitive business data.
- Take the time to build and maintain a data map that identifies what data is expected to be collected and from whom, and how the data is expected to be used, stored, transferred and destroyed.
- Design a data privacy and security program that addresses your company’s compliance obligations and ensures adequate data protection.
- Translate this program into clear and accurate public disclosures about your company’s practices.
- Periodically revise the program to take into account the developments in the company and its business. Train your staff, employees and independent contractors, so that they understand their obligations.
- Do not procrastinate and wait for the day when you need to respond to a due diligence questionnaire.
