Navigating the Legal and Regulatory Landscape

As companies around the world adapt to comply with the EU’s General Data Protection Regulation (GDPR), legislators in the United States are under pressure from constituents to pass even more consumer privacy protection. That pressure increases with every major data privacy breach and has reached a point where the heads of major social media organizations were recently called to testify before the Senate Select Committee on Intelligence.

As of March 2018, all 50 U.S. states, as well as the District of Columbia, Guam, Puerto Rico and the U.S. Virgin Islands, have enacted breach notification laws — and recently, . Congress recently passed the Cloud Act, which allows governments to pursue the data of U.S. companies stored and serviced outside of the United States. And in the past year, five federal breach bills have been proposed (so far unsuccessfully) in the U.S. Senate.

The states have made it clear that they are serious. We’re seeing litigation and class actions against companies for failure to comply with privacy regimes — particularly where a breach has not been disclosed timely or a has been called into question. Uber, for example, recently agreed to pay $148 million to settle lawsuits brought by attorneys general in 50 states and the District of Columbia stemming from a 2016 breach and an executive decision to pay $100,000 “ransom” to hackers instead of reporting it to regulators and consumers in a timely manner, as required by law.

Government lawsuits and regulatory actions are often doubly harmful to the bottom line as costly fines and settlements can cause stock prices to fall, sparking a second round of lawsuits as shareholders seek redress.

The path to compliance isn’t always clear, and that adds to the confusion. For example, it can be difficult to harmonize security regulations, such as a mandate to purge consumer records on request, with legal precedent requiring records retention. That’s likely to get worse before it gets better, as new breaches prompt regulatory actions that will lead to additional guidance that hasn’t been written yet.

With so many regulatory variables yet to be solved for when it comes to data security and privacy, we recommend a strategy that balances security practices against data protection requirements. That means asking the right questions now, adopting the right privacy and security frameworks and taking proactive measures to align data privacy and security risks with risk appetite so that the organization will be ready for any surprises.

Board members should prepare by asking:

  • What should we protect?
  • Why should we protect it?
  • How does it fit into our architecture?

They should also ask: Why are we collecting this data? How long do we keep it? And why are we keeping it?

Companies must make sure they understand the laws — how they apply to them and their systems. In this, the company attorneys are natural allies. Whenever possible, requirements should be implemented in ways that improve, rather than complicate processes. There should be a reasonable strategy with appropriate controls to prioritize and address legal obligations, and a program or team tasked with staying abreast of new and emerging regulations. Finally, organizations should identify the data security risks that are outside of their acceptable risk range and add controls as needed.

Data security and privacy compliance is a top concern for most companies, and will remain so for the foreseeable future. Our Technology practice released a series of webinars to discuss recent developments in that space, starting with a focus on the evolving legal and regulatory landscape. You can register to listen to the webinar replay, and follow future discussions by subscribing to this blog.

Diana Candela

Associate Director
Technology Consulting – Security and Privacy

Jeffrey Sanchez

Managing Director
Security and Privacy

Joel Wuesthoff

Managing Director
Legal Consulting

Subscribe to Topics

Protiviti’s Christine Livingston contributed to #Harvard Business Review’s latest report, speaking on the ethical issues of #GenAI governance frameworks and the importance of connecting these with your company ethos and brand values. #ProtivitiTech

What is high-speed #quantum networking? How does it work? How fast is it? Listen now to host @KonstantHacker and @NoelGoddard2 from @QunnectInc as they explore this concept and potential business use cases. #ProtivitiTech #Podcast

Protiviti recently helped a manufacturing client gain more autonomy over its #SAP environment by upgrading from SAP HANA Enterprise Cloud to SAP HANA Cloud Platform. Learn more about this successful migration. #ProtivitiTech

It can be difficult to link security risks associated with operational technology to the financial impact of OT security events. Enroll in this webinar to learn how Protiviti has utilized #FAIR to visualize critical production assets and threat scenarios.

Effective content management enhances efficiency, promotes collaboration, ensures consistency, and helps business stay compliant. Here's why Protiviti recommends #Microsoft SharePoint to support these efforts: #ProtivitiTech

Load More