It can be tough for the most progressive organizations to keep up with technology these days. The challenge is even harder for governments where politics, deliberation, and bureaucracy rule the day. Standards, norms, and regulation always lag behind the market curve, especially in IT. In the US, for example, there are no comprehensive, consent-based data privacy laws on the national level. Until that changes in the coming years businesses will continue to struggle with uncertainty and technological missteps

Today is Data Privacy Day, a global event recognized in over 50 countries to promote data privacy and protection best practices.

As society continues to ‘go digital,’ personal data is a goldmine for businesses. This doesn’t mean it’s a bad thing necessarily. It helps make the consumer experience better, and in some contexts like medical, can even save lives.

You can’t have customers in the e-commerce world without collecting personal data. Even processing a credit card for an online purchase using a guest account requires you to collect some personal information and hold it for a certain period of time. When you collect personal information, you’re required to comply with data protection regulations that apply to that information, such as CPRA, LGDP, and GDPR. And ignorance of the law is not an excuse for not complying with the law.

Given the array of threats and vulnerabilities that persist in modern information technology, data security and privacy have become competitive differentiators in today’s marketplace. They provide foundational building blocks for successful and ethical business practices, and they increase customer trust and loyalty over time.

Let’s talk about Personally Identifiable Information (PII). According to the National Institute of Standards and Technology (NIST), “If you collect it, you must protect it.” PII data breaches are defined as inappropriate disclosures, whether lost, stolen, or compromised, and whether the breach was intentional or accidental.

Have you ever wondered where your data really goes when you send it to the cloud? If you followed the bits, there is a good chance that you would find your scientific research, shopping carts, and personal emails on a hard drive in the world’s largest data depot, inside northern Virginia’s Data Center Alley.

Brazil’s LGPD Privacy Law has brought additional attention to information security and data protection.

Europe and California are no longer alone in their recent concern for data privacy. In South America, Brazil will now enforce the Lei Geral de Proteção de Dados Pessoais (LGPD), which is similar in nature to the European GDPR (General Data Protection Regulation) and California Consumer Privacy Act (CCPA). Given Brazil has a population of over 210 million people, LGPD will have global ramifications.

On July 16, 2020, the Court of Justice of the European Union (CJEU) invalidated the EU-US Privacy Shield, a voluntary program that thousands of US businesses relied on for personal data transfers from Europe to the United States. For those of you who follow these things, the case is commonly referred to as Schrems II.

Think your business doesn’t need to worry about the California Consumer Privacy Act (CCPA) because you don’t sell any data for business purposes?

You may want to take a second look.

Under the broad definition of “sale” used in CCPA, you could very possibly be subject to CCPA requirements and unknowingly failing to achieve and maintain compliance. With the financial penalties associated with non-compliance, not to mention the data security risk that results from ignoring CCPA requirements, it’s absolutely vital to make sure that you know whether or not your business activities would be considered to be “selling data” under the CCPA.

The importance of compliance in a company’s lifespan and overall strategy cannot be overstated.

New year, new you!

With the new year – and new decade – upon us, now is the perfect time to start thinking about what we want 2020 to look like.

For small business owners, or really any team member at a modern company, data privacy and information security present major challenges in the coming year. After an uptick in data breach incidents in 2019, we all need to be especially vigilant in the new year.

What is the California Consumer Privacy Act (CCPA)?

The California Consumer Privacy Act (CCPA) is a comprehensive data privacy law that will go into effect on January 1, 2020. The new consumer information security framework will have a major impact on both consumers and businesses because the regulations apply to any companies – no matter their location – that collect personal information and other consumer data from residents of California. This includes handling names, addresses, social security numbers, credit card numbers, IP addresses, and more.

The General Data Protection Regulation (GDPR) is a set of laws regarding data security that affect companies based in the EU and those with customers in the EU. Brexit is the proposed withdrawal of the United Kingdom from the European Union.

You may be aware of one (or both) of these subjects, but what may not be completely known is how one will affect the other. Understandably, there are reasons for concern for those doing business in or with the EU — since, as you likely know, the UK is part of the European Union — so let’s take a further look at GDPR and Brexit to see what effect they may have on how you run your company.