Data Privacy

Data is being created now faster than at any point in history and it is showing no signs of slowing down. The world is becoming more technologically integrated on a daily basis. The most recent reports suggest that the digital universe is going to expand to the size of 44 zettabytes by this year; this is equivalent to a billion terabytes.

Businesses are also more data-driven than ever. It has never been more imperative that data is appropriately handled and managed on an ongoing basis. According to Fortune Business Insights, the data security industry was worth over a billion dollars last year and it is projected to continue to grow exponentially with time.

Data security is a complex network of interconnected concepts that center around protecting digital data. Data privacy is one of the cornerstones of that network of concepts and it is increasingly pertinent to individual businesses in the modern landscape that we live in.

In this guide, you will be introduced to data privacy and its key concepts and how those concepts are implemented in business landscapes to drive success, maintain regulatory compliance and promote stronger client relationships.

What Is Data Privacy?

Data privacy is a facet of data security that focuses on the way that data is handled from inception to long term storage and implementation. Data security as a whole is the practice of protecting data from becoming compromised, either from internal or external attacks. These two terms are often used in an interchangeable way; however, there are some key differences between the two.

Data privacy relates less to protecting data from becoming compromised and instead refers to the governance of data. This branch of data security is what dictates how data is handled and ensures that it is handled properly when it comes to collection, usage, storage, and so on. Data privacy also encompasses how data is shared (if applicable).

There are three main concerns when it comes to data privacy:

The first of these is consent. This has to do with how data is shared with third parties, or other entities that are on the outside of a data privacy agreement between you and a client.

The next area of focus in data privacy is notice. This has to do with the legal collection and storage of data.

Finally, there are regulatory restrictions. Regulatory restrictions in data privacy happen at the national level as well as within individual states. Remaining compliant with these regulations not only help protect your business from fines and criminal charges but also helps protect customers and clients’ right to privacy.

There are a lot of moving parts when it comes to data privacy so having a complete solution to your approach to data privacy is imperative. Especially because data privacy is imperative to the success and longevity of individual businesses.

Why Is Data Privacy Important?

Data is an economic asset and it needs to be managed as such in order for a business to make the most effective use of it. The idea of data as an asset is not a new concept but it has become more essential as technology and the application of data have expanded. When you view data as an asset, it is very easy to understand what an important part of your operations that data privacy is.

Data plays multiple roles in an individual organization and provides significant value when it comes to informing decisions to mitigate risk, streamlining operations, and driving quality and revenue generation. Data can influence relationships with stakeholders and other businesses. It can also be one of the major keys to innovation in your space. The way that a business uses data is nearly limitless and ensuring that it is properly handled is the primary way of protecting this vital asset.

One of the most glaring examples of data as an asset is the ubiquitousness and success of Google. The entire empire that Google has built is based on data; not only the data that it archives around the web but also the data that it collects, uses and sells that originates from its users. Even outside of the realm of these so-called “data empires,” this information is the driving force behind a diverse range of businesses and even industries as a whole.

The deeply essential nature of data is what makes data privacy so important. There have been mounting controversies over the years across almost every industry when it comes to customer and client privacy. Failing in this area is something that can destroy the vital trust that customers and stakeholders place in a business and destroy reputations almost overnight.

Having a clear approach to how you handle data privacy is important because consumers, users, clients, and customers will all expect a certain level of transparency when it comes to that approach. If you can’t explain how you are storing, using, and protecting the data that you rely on, who is going to be able to trust you? This transparency is also important to stakeholders and your competition.

Further, individuals and businesses alike have their own rights to privacy. Dr. Ann Cavoukian put it best when she explained that “privacy forms the basis of our freedom.” When you’re not actively addressing data privacy, you could be infringing on the rights of others, or even violating the overarching regulations that guide data privacy and make it so necessary to begin with.

No matter where your business operates, there are laws that control how data is used, stored, and shared. Breaking those laws can harm your business, force you to pay steep fines, or even result in criminal charges.

Data privacy is essential to the survival of a business.

The History and Current State of Data Privacy Laws

Privacy laws are laws that have been created with the goal of protecting the right to privacy that individuals and businesses have. The right to privacy is widely upheld as one of the foundations of freedom and it is important to understand these laws and the regulations they impose when it comes to ensuring data privacy and preserving it in the long term.

The first privacy law that was ever established was the US Privacy Act of 1974 and it addressed data that is held by government agencies. Ever since then, there have been a number of acts that have been passed into law over the years. These include:

The Health Insurance Portability and Accountability Act of 1996: Commonly known as HIPAA, this act protects patient information in a medical setting.
The Gramm-Leach-Bliley Act of 1999: Abbreviated as the GLBA, this act protects financial information that is considered nonpublic personal information.
The Children’s Online Privacy Protection Act of 2000: COPPA was created to protect data belonging to children under the age of 12.
The Privacy Rule of 2000: This was an addition to HIPAA that served to create extra layers of safety for the private health information of individuals.
The Sarbanes-Oxley Act of 2002: This act was created to protect people against the fraudulent practices of corporations across a variety of industries and it’s commonly known as SOX.
The Federal Information Security Management Act of 2002: FISMA was enacted to order federal agencies to protect the data that they collect and store.
ISO 27001 of 2013: This futuristic-sounding piece of legislation provides an outline for how information security management systems should work.
The General Data Privacy Regulation of 2018: The GDPR, which you can read more about below, applies to citizens of the European Union and seeks to protect their personal data.
The California Consumer Privacy Act of 2020: The CCPA was created in the state of California to protect the data of its residents; however, this legislation has a ripple effect that you will learn more about below.

All of these laws come together to help protect and preserve the data privacy of both individuals and businesses. Each of them is a very important piece of the larger puzzle; however, they lack something that most people would view as the most important part. None of the privacy laws that have been enacted over the past several decades truly define data privacy.

Data privacy is a very complex issue and there is no true definition of it under the law. Instead, each of these acts provides an outline of best practices that need to be followed and details the rights of the individuals or corporations that it protects. The lack of an explicit definition is one reason why it is very important to understand privacy laws and how they apply in your industry and to your individual business.

Another thing to understand about data privacy legislation is that it is less important where your business operates out of and more important where your clients and customers live. They are the ones that are being protected under these laws and you need to have a data privacy approach that acknowledges and applies this.

Data privacy laws are not complete, either. The more data-driven the world becomes and the more data is produced, the more laws we are going to need to make sure that data privacy is being protected from all angles. Below, you will learn about the two most recent privacy laws and what they mean for businesses around the world.

California Consumer Privacy Act

The CCPA was enacted in 2018 and goes into effect officially in 2020. The purpose of the act is to protect the rights of California residents in regard to having their data sold by companies. While you may not operate your business in the state or have any customers or clients that you know of, this still applies to you.

How? If your company has a website, people from all over the world can access it. Even if they only use your website one time. It is important to remember that you have a responsibility to be compliant with all privacy laws and regulations that may impact the people who use your business or services, purchase any products you sell, and so on. The CCPA actually outlines the businesses that are subject to the regulations that the act imposes.

If a for-profit business meets any of the following criteria, they are subject to the CCPA:

The business in question has a gross annual revenue of $25 million or more.
The business purchases, receives or sells personal data from 50,000 sources or more. Sources include individuals, households, or devices.
The business earns 50% or more of its annual revenue through the sales of personal data.

On top of these criteria, the language of the CCPA also suggests that any business that handles personal data from at least four million people may face additional obligations in the future. The act outlines the rights of Californians along with a pretty substantial list of obligations for businesses that fall under it; and, of course, could result in thousands of dollars of fines if those obligations are not met.

Rather than discuss the individual rights that it covers, we are going to go over the obligations that it imposes on businesses. Under the CCPA, every business must do the following:

Notify customers in advance when personal data will be collected.
Make it easy for customers to opt-out of having their data sold.
Respond to consumers exercising their rights under the act in a specific timeframe.
Verify the identity of consumers that make requests under the act.
Disclose any financial incentives for collecting and selling the data. In addition, they must disclose how the value of the data was calculated and the reason that these incentives should be permitted under the act.
Keep record of any requests and responses from consumers that are exercising their rights under the act.
Maintain an inventory of data and track the flow of that data.
Disclose all data privacy policies and how they are applied in practice.

As you can see, data privacy is something that lawmakers and consumers take seriously. The scope of the regulations is bound to continue to increase an effective approach to data privacy is the best way to protect your business and remain in line with the current regulations.

European Privacy Laws

The second newest piece of legislation in the world of data privacy is the GDPR or General Data Privacy Regulation. It was enacted in 2016 and became applicable in 2018. One thing that stands out about the GDPR is that it applies to both nonprofit and for-profit businesses. This was a landmark victory for consumers all around the world even though this legislation was designed to protect individuals that live in the countries of the European Union.

2018 saw a lot of companies completely rewriting their privacy policies and changing the way that they collect data and what they do with it later on. As an example, prior to the GDPR, Google used to mine emails that were sent through the GMail platform in order to personalize the advertisements users would see. They claim that the change in this practice had nothing to do with the law, though.

Facebook also announced that it would be launching a completely new “privacy dashboard” for its users in their account settings, making it easier to understand and limit what data they collected and used. Hundreds of websites made similar changes. The reason why laws like this have such a widespread effect is that it is easier to create entirely new systems within a company than it is to create a new system for one specific set of users.

The GDPR was one of the most comprehensive privacy laws that has ever been created and it is also regarded as one of the most complex. It provides rules that govern how personal data is collected and handled and it also outlines the fact that consumers must be given more information about it. Under the GDPR, businesses that deal with EU customers are required to make sure that customers know, understand, and consent to the collection of data about them and the ways it will be used once it is collected.

You can view a comprehensive resource on the GDPR at The European Commission website.

With all of these regulations, having a proper plan in place becomes even more important to make sure that businesses are adhering to them. That is where the concept of data management begins.

Next Chapter