By David DeMoss
It’s no secret that technology has rapidly changed in the past 20 years, and cybersecurity needs to be taken seriously now more than ever. After General Data Protection Regulation (GDPR), the California Consumer Privacy Act of 2018 and New York’s Department of Financial Services implemented cybersecurity regulations in 2017, corporate executives, consultants and attorneys are talking about what actions should be taken moving forward. The nature of the way data is now collected has changed drastically, and many are saying that privacy needs to be instilled as a culture at the top of organizations, starting at the CEO’s level. Rather than treating it as a one-time project, businesses’ need to take privacy seriously, ensuring that protocols are in place to protect their data. More from MP McQueen, below.
Challenges facing organizations from new data privacy, protection and security regulations enacted around the world were discussed at PrivSec New York, a two-day conference at Columbia University that was attended by hundreds of professionals.
“The age of privacy has arrived, and it is here to stay,” said Karima Noren, co-founder of The Privacy Compliance Hub and The Legal Pod in the U.K. who formerly was senior legal counsel and head of emerging markets at Google.
Columbia Law School professor of law, science and technology Tim Wu, who spoke about the EU’s General Data Protection Regulation, U.S. state laws and anticipated U.S. federal law on data privacy, said, “The level of public desire for privacy is very, very high.“
Corporate executives, consultants and attorneys discussed the impact of the GDPR, the California Consumer Privacy Act of 2018 and the New York Department of Financial Services’ influential cybersecurity regulations enacted in 2017, among other topics.
The patchwork of federal, state and local laws in the United States governing data breach notification and data protection in the absence of a comprehensive federal law in the U.S., and the compliance hurdles it presents for companies trying to comply and fend off litigation, was a recurrent theme among the various panels.
Unlike the GDPR, New York’s cybersecurity regulations governing banks and insurance companies, for instance, do not include a provision for certifying standards for entities to prove compliance. “I wish there was,” said F. Paul Greene, a privacy and data security chairman at Harter, Secrest & Emery in Rochester, New York.
Greene said that while New York’s law has been influential and used as a model by the National Association of Insurance Commissioners as part of its model legislation, other states are varying from it enough to add more complexity.
Alan C. Raul, founder and leader of the privacy and cybersecurity practice at Sidley Austin in Washington, D.C., spoke of a “proliferation of agencies and enforcement actions” in the U.S., including by the Federal Trade Commission the “de facto privacy and security regulator,” but also by the Securities and Exchange Commission, the Commodity Futures Trading Commission, the New York State Department of Financial Services, state attorneys general and other agencies. Raul said, “digital governance could be the next expectation” of boards of directors and senior executive leadership.
In fact, a key takeaway from the event was the need to instill privacy as a culture from the top of organizations, including at the CEO and board of directors level. Several speakers noted that many companies approach the task of complying with the new rules around data privacy, protection and security as a project when it actually is an ongoing responsibility requiring behavioral change throughout the organization.
“It is not a one-time project; it is a culture,” said Noren.
Bill Schaumann, a privacy solutions engineer at WireWheel, a software company based in Arlington, Virginia, that provides software-as-a-service tools for tracking and safeguarding customer data, talked about the big change coming from the advent of the internet of things of interconnected devices, which is changing the nature of data being collected and stored from transactional data such as credit card purchases, to behavioral data about individuals and their activities.
Speakers also addressed the need for technology officers, information security officers and legal counsel and other executives to work together to address growing threats instead of operating in silos.