privacy compliance

What is privacy compliance?

Privacy compliance is a company's accordance with established personal information protection guidelines, specifications or legislation. Privacy compliance has become a prevalent business concern due to an increasing number of high-profile regulations -- including the European Union's (EU) General Data Protection Regulation (GDPR) and the California Consumer Privacy Act -- designed to protect unauthorized access to personally identifiable information. 

Past and current privacy laws

The EU Data Protection Directive, also known as Directive 95/46/EC, was adopted in 1995. It was designed to protect the privacy and security of all personal data collected for or about EU citizens, especially as it relates to processing, using or exchanging such data. These data protection rules applied not only when responsible parties are established or operated within the EU, but also when the controller used equipment located inside the EU to process personal data.

Privacy compliance reentered the spotlight in 2013 when former National Security Agency (NSA) contractor Edward Snowden leaked details surrounding a previously undisclosed surveillance program called Prism. Details of the Prism program's scope drew controversy due to the program's violation of rules such as the safe harbor policy agreement established by the U.S. and the EU in 2000 to regulate the ways in which U.S. companies export and handle the personal data of European citizens. Privacy compliance also gained widespread attention after hacks of customer information at large retailers, including Target Corp. in 2013 and Home Depot in 2014.

GDPR updated and unified data privacy laws across the EU, replacing the Data Protection Directive. It was approved by the EU Parliament on April 14, 2016 and went into effect on May 25, 2018.

GDPR focuses on expanding the data privacy rights of consumers and includes mandates to make businesses more transparent with customers about how they use their personal data. Under GDPR, complying companies are required to notify all affected parties and supervising authorities within 72 hours of a data breach.

The California Consumer Privacy Act (CCPA) was signed into law by Jerry Brown, the then-governor of California, on June 28, 2018, and went into effect on Jan. 1, 2020. It gives California residents the right to know what data is being collected about them and whether that information is sold and gives them the ability to refuse that data being sold. The CCPA also stipulates consumers have access to their personal information collected by compliant companies. In 2023, the California Privacy Rights Act (CPRA) will amend the CCPA and provide additional privacy protections for consumers.

Although state privacy laws are more advanced than federal laws, in June 2022, the U.S House of Representatives Committee on Energy and Commerce voted in favor of the American Data and Privacy Protection Act. ADPPA still needs to pass the House, Senate and be signed by the President before becoming law.

In addition to California, Virginia has officially enacted comprehensive consumer privacy legislation. In March 2021, Virginia Governor Ralph Northam signed the Virginia Consumer Data Protection Act, which goes into effect on Jan. 1, 2023. The VCPDA gives consumers the right to access their data as well as opt out of this data collection. Other privacy acts that will go into effect in 2023 include the Colorado Privacy Act, the Connecticut Data Privacy Act and the Utah Consumer Privacy Act.

The Washington Privacy Act has yet to become law, but it will grant residents of Washington various rights regarding their personal data, including the right to restrict or object to processing.

Numerous countries around the world have also established comprehensive data privacy laws. According to the United Nations Conference on Trade and Development, 71% of countries have privacy laws.

Privacy compliance challenges

Many modern companies collect copious amounts of complex data as part of everyday operations and rely on analytics of this information to run the business. This type of data collection creates challenges for privacy compliance processes, starting with proper business data identification and classification to determine which regulations apply.

Large global companies face challenges such as determining which international laws apply to them and then developing data governance rules and deletion schedules accordingly. Companies must implement the appropriate infrastructure, management and workforce to keep data compliant throughout its lifecycle. This can be a drain to company resources as data governance processes are revamped, roles are redefined and legal consultations increase to accommodate compliance rules. Smaller companies face privacy compliance challenges as well, most notably the drain on IT and legal resources that might be ill-equipped to handle complex regulatory compliance mandates.

Privacy compliance can be a business differentiator for modern companies. Those accused of violating data privacy rights risk significant hits to the company's reputation and customers' trust, along with significant fines and potential legal action.

Maintaining privacy compliance

Organizations should develop information governance programs, data privacy policies and employee training programs to help achieve compliance with regulatory mandates. Detailed, documented information governance programs that include data privacy policies also help ensure proper response in the event of a breach, as well as provide necessary documentation during regulatory audits and investigations.

These information governance programs should include processes to inventory personal information and establish procedures to keep this data private, while also making it available should the customer request it. Companies should also keep detailed documentation of their accordance with any relevant compliance rules, which will be necessary if a legal or regulatory incident occurs.

As privacy compliance continues to be a top concern for corporate management, companies are turning to specialized software and consultancies to ensure personal information protection. Some companies choose to institute a chief privacy officer (CPO) position or expand the role of the chief compliance officer (CCO) to include the development and implementation of policies designed to protect employee and customer data from unauthorized access.

Adhering to data privacy compliance requirements presents several challenges. Learn what steps organizations can take to overcome them.