Navigating the Legal and Regulatory Landscape

As companies around the world adapt to comply with the EU’s General Data Protection Regulation (GDPR), legislators in the United States are under pressure from constituents to pass even more consumer privacy protection. That pressure increases with every major data privacy breach and has reached a point where the heads of major social media organizations were recently called to testify before the Senate Select Committee on Intelligence.

As of March 2018, all 50 U.S. states, as well as the District of Columbia, Guam, Puerto Rico and the U.S. Virgin Islands, have enacted breach notification laws — and recently, . Congress recently passed the Cloud Act, which allows governments to pursue the data of U.S. companies stored and serviced outside of the United States. And in the past year, five federal breach bills have been proposed (so far unsuccessfully) in the U.S. Senate.

The states have made it clear that they are serious. We’re seeing litigation and class actions against companies for failure to comply with privacy regimes — particularly where a breach has not been disclosed timely or a has been called into question. Uber, for example, recently agreed to pay $148 million to settle lawsuits brought by attorneys general in 50 states and the District of Columbia stemming from a 2016 breach and an executive decision to pay $100,000 “ransom” to hackers instead of reporting it to regulators and consumers in a timely manner, as required by law.

Government lawsuits and regulatory actions are often doubly harmful to the bottom line as costly fines and settlements can cause stock prices to fall, sparking a second round of lawsuits as shareholders seek redress.

The path to compliance isn’t always clear, and that adds to the confusion. For example, it can be difficult to harmonize security regulations, such as a mandate to purge consumer records on request, with legal precedent requiring records retention. That’s likely to get worse before it gets better, as new breaches prompt regulatory actions that will lead to additional guidance that hasn’t been written yet.

With so many regulatory variables yet to be solved for when it comes to data security and privacy, we recommend a strategy that balances security practices against data protection requirements. That means asking the right questions now, adopting the right privacy and security frameworks and taking proactive measures to align data privacy and security risks with risk appetite so that the organization will be ready for any surprises.

Board members should prepare by asking:

  • What should we protect?
  • Why should we protect it?
  • How does it fit into our architecture?

They should also ask: Why are we collecting this data? How long do we keep it? And why are we keeping it?

Companies must make sure they understand the laws — how they apply to them and their systems. In this, the company attorneys are natural allies. Whenever possible, requirements should be implemented in ways that improve, rather than complicate processes. There should be a reasonable strategy with appropriate controls to prioritize and address legal obligations, and a program or team tasked with staying abreast of new and emerging regulations. Finally, organizations should identify the data security risks that are outside of their acceptable risk range and add controls as needed.

Data security and privacy compliance is a top concern for most companies, and will remain so for the foreseeable future. Our Technology practice released a series of webinars to discuss recent developments in that space, starting with a focus on the evolving legal and regulatory landscape. You can register to listen to the webinar replay, and follow future discussions by subscribing to this blog.

Diana Candela

Associate Director
Technology Consulting – Security and Privacy

Jeffrey Sanchez

Managing Director
Security and Privacy

Joel Wuesthoff

Managing Director
Legal Consulting

Subscribe to Topics

Protiviti helped a #Manufacturing client realize enhanced data quality and a robust data governance program after upgrading to #SAP s/4 HANA, positioning the client for global transformation and continued success. https://ow.ly/T99450QXOGY #ProtivitiTech

Particle Physicist Dr. Harry Cliff joins The Post-Quantum Podcast to explain how #QuantumComputers can simulate particle interactions, how they can handle mind-boggling amounts of data, and his new book, Space Oddities. Listen now! https://ow.ly/i1vw50QXQng #ProtivitiTech

Discover how Protiviti replaced a global footwear company’s archaic legacy system by leveraging Microsoft Power BI and improved the company’s bottom line. https://ow.ly/hnXt50QSOCU #ProtivitiTech #ClientStory

Protiviti’s Nick Puetz encourages senior leaders to take advantage of the #NIST resources to fully understand the changes and how it affects their #Cybersecurity programs. https://ow.ly/mqmT50QTKeX

What are the benefits to #ProcessMining the order-to-cash process? Identifying process variations and compliance issues are among the benefits, says Protiviti’s Marshall Kelley. https://ow.ly/hrY650QToXb #ProtivitiTech

Load More