Navigating the Legal and Regulatory Landscape

As companies around the world adapt to comply with the EU’s General Data Protection Regulation (GDPR), legislators in the United States are under pressure from constituents to pass even more consumer privacy protection. That pressure increases with every major data privacy breach and has reached a point where the heads of major social media organizations were recently called to testify before the Senate Select Committee on Intelligence.

As of March 2018, all 50 U.S. states, as well as the District of Columbia, Guam, Puerto Rico and the U.S. Virgin Islands, have enacted breach notification laws — and recently, . Congress recently passed the Cloud Act, which allows governments to pursue the data of U.S. companies stored and serviced outside of the United States. And in the past year, five federal breach bills have been proposed (so far unsuccessfully) in the U.S. Senate.

The states have made it clear that they are serious. We’re seeing litigation and class actions against companies for failure to comply with privacy regimes — particularly where a breach has not been disclosed timely or a has been called into question. Uber, for example, recently agreed to pay $148 million to settle lawsuits brought by attorneys general in 50 states and the District of Columbia stemming from a 2016 breach and an executive decision to pay $100,000 “ransom” to hackers instead of reporting it to regulators and consumers in a timely manner, as required by law.

Government lawsuits and regulatory actions are often doubly harmful to the bottom line as costly fines and settlements can cause stock prices to fall, sparking a second round of lawsuits as shareholders seek redress.

The path to compliance isn’t always clear, and that adds to the confusion. For example, it can be difficult to harmonize security regulations, such as a mandate to purge consumer records on request, with legal precedent requiring records retention. That’s likely to get worse before it gets better, as new breaches prompt regulatory actions that will lead to additional guidance that hasn’t been written yet.

With so many regulatory variables yet to be solved for when it comes to data security and privacy, we recommend a strategy that balances security practices against data protection requirements. That means asking the right questions now, adopting the right privacy and security frameworks and taking proactive measures to align data privacy and security risks with risk appetite so that the organization will be ready for any surprises.

Board members should prepare by asking:

  • What should we protect?
  • Why should we protect it?
  • How does it fit into our architecture?

They should also ask: Why are we collecting this data? How long do we keep it? And why are we keeping it?

Companies must make sure they understand the laws — how they apply to them and their systems. In this, the company attorneys are natural allies. Whenever possible, requirements should be implemented in ways that improve, rather than complicate processes. There should be a reasonable strategy with appropriate controls to prioritize and address legal obligations, and a program or team tasked with staying abreast of new and emerging regulations. Finally, organizations should identify the data security risks that are outside of their acceptable risk range and add controls as needed.

Data security and privacy compliance is a top concern for most companies, and will remain so for the foreseeable future. Our Technology practice released a series of webinars to discuss recent developments in that space, starting with a focus on the evolving legal and regulatory landscape. You can register to listen to the webinar replay, and follow future discussions by subscribing to this blog.

Diana Candela

Associate Director
Technology Consulting – Security and Privacy

Jeffrey Sanchez

Managing Director
Security and Privacy

Joel Wuesthoff

Managing Director, Robert Half Legal
Consulting Services

Subscribe to Topics

Unifying and automating financial processes enables firms to reduce operational expenses and make smarter decisions. Join #ProtivitiTech and #Microsoft to see how #Dynamics365 can support compliance requirements and changing business environments.

The #DevSecOps ecosystem is people, processes and technologies interwoven to manage the application lifecycle. It's a priority to implement practices in the DevSecOps toolchain by defining a secure #IAM program. Learn more in #TechnologyInsights:

Project portfolio management takes a centralized approach to managing and aligning projects with company goals. Protiviti's Samir Datt shares in @TechTarget how it adds value to #projectmanagement.

#ProtivitiNews #ProtivitiTech

Protiviti's @KonstantHacker joined The @QRLedger Show to discuss the quantum threat. Watch the episode to learn when Konstantinos believes the quantum apocalypse will take place and how to prepare.

#ProtivitiTech #QRL #quantum #quantumcomputing

CFOs are overhauling their technology budgets as inflation, slumping economic growth and other external forces jeopardize their earnings targets. Randy Armknecht shares more with CFO Dive.

#ProtivitiNews #ProtivitiTech #CFODive #CFO

Load More