Against a backdrop of looming privacy regulation, VFS Global’s Group Data Protection Officer, Astrid Gobardhan, looks at the various benefits of privacy investment for organisations – from better security, improved customer confidence, right through to brand enhancement and reduced operational costs.
Certain types of personal data are very valuable to criminals, and can be very damaging to an individual or business if it falls into the wrong hands. As the world becomes more digital and more connected, more of this sort of data is generated and passed between various sources on a regular basis.
Government regulations and supervisory authorities aren’t just about keeping irresponsible parties in line. They also provide vital security guidance to every type of organization that handles sensitive personal, business or government information.
Data protection regulations also ensure that the end user has a transparent view of and a say in the processing of personal data. These safeguards play a significant role in everything from the preservation of civil rights to ensuring that democratic institutions function properly.
Some types of personal data are clear candidates for regulation: medical records, banking information, national ID numbers and so on. But some of these regulations also cover items that might seem relatively innocuous at first glance: home addresses, email addresses, website profile information and so on. For example, the European Union General Data Protection Regulation (GDPR) has stipulations about anything that is unique to an individual to include phone numbers and social media accounts. People have varying levels of privacy preference with these items, but they are often protected by regulation because they can be used for targeted scams and attempts at identity theft.
Given that regulations often take the size and customer count of businesses into consideration in terms of penalties and the scope of protection of personal data, compliance is particularly important for enterprise-scale organizations. You do not necessarily have to have an active business presence in a country or region; simply storing data on or moving it through servers there may subject you to their data protection rules.
The WhatsApp GDPR violations pertain to Article 12 and 13(1)(c) requirements that platform users be clearly informed of the legal basis under which their personal information is being collected.
DLA Piper Annual GDPR and Data Breach Report: 2022 a Record Year for GDPR Fines Despite Drop in Breach Count
With a total of €2.92 billion levied throughout the bloc in 2022, GDPR fines are up in spite of a small drop in the overall data breach count as the bloc eyes stronger regulation for AI.
French regulator CNIL found that the tiktok.com website, which allows users to view content via a web browser without logging in, did not have an adequate process for cookie consent.
The Introduction of the California Consumer Privacy Act (CCPA) And the Change of the CISO Role in 2023
As the CCPA comes into effect in the new year, we should prepare to see stricter regulations unfold both in the US and at a national level. Companies hiring for the CISO role must ensure candidates are informed of the legal expectations and are up to speed with protocols for security incidents.
CNIL has hit Apple's App Store with a fine of €8 million over its ad personalization practices, taking it to task for not properly collecting consent and making the process of opting out too indirect.
Irish DPC Orders €390 Million Fine to Meta Over Targeted Advertising, Orders Implementation of Ability To Opt Out
Irish DPC has handed down a €390 million fine to Meta over its targeted advertising practices on Facebook and Instagram. The fine stems from a long legal battle over Meta's claim that users enter into an implicit contract agreeing to receive personalized ads when they accept the terms of service.
Microsoft faces a hefty fine over Bing cookie consent issues, and has additionally been given three months to get the system into compliance or it could face additional fines of €60,000 per day.
Irish DPC Adds Late December Data Breach of 400 Million Twitter Users To Existing Probe of API Vulnerabilities
The Irish DPC probe centers on an API vulnerability that appears to have been exploited by multiple parties before being detected and remediated. The data breach first came to light in August and was acknowledged by Twitter.
Better methods of managing data using innovative technology avoids a reactive posture to data, and instead turns to a proactive one. But how can leaders become more proactive in their approach? And how can they make the data more proactive to meet the growing challenge of comprehensive data risk management?