Compliance analytics helps data storage meet PII standards

The regulatory morass

GDPR has quickly become the de facto standard by which other privacy protections are measured. The regulation applies to any organization that collects personally identifiable information (PII) from citizens in the European Union. GDPR holds these organizations fully accountable for protecting PII data, no matter where they might be headquartered. EU citizens must consent to having their data collected and have the right to know what information is being collected and to request that the data be forgotten. Organizations that fail to comply face stiff penalties, up to 20 million euros or 4% of their annual global turnover, whichever is greater.

GDPR is not the only regulation organizations must contend with. For example, the U.S. has HIPAA and the Sarbanes-Oxley Act of 2002. And more regulations are being added every day, such as the California Consumer Privacy Act, which goes into effect on Jan. 1, 2020.

Adhering to these regulations is no small matter, especially as data sets become larger, more diverse and even more widely distributed. Managing data is difficult enough, but protecting that sensitive business information is even harder. Ensuring that the data complies with all applicable regulations can be the stuff of nightmares, particularly if regulations conflict or new ones continue to appear.

Because of these challenges, many organizations are looking for compliance analytics offerings that go beyond traditional -- and often manual -- approaches. A predictive analytics component uses statistical methodologies to uncover patterns in data, often incorporating AI technologies into the analytical processes. For example, machine learning might be used to train predictive algorithms to root out possible compliance violations based on current and historical data. The more data that's available, the more accurate the predictions.

Moving to advanced analytics

The use of predictive analytics and AI to address compliance issues might conflict with prevailing opinion about these technologies, which often views them as a growing risk to privacy. And there's good reason for this. The technologies require large, centralized data stores to achieve the most effective results, leading to security and confidentiality risks, as well as the potential for abuse. For this reason, any project that uses these technologies must put safeguards in place to ensure that PII data is protected at every phase of the operation.

At the same time, compliance analytics technologies have the potential to help protect data, ensure privacy and achieve compliance with applicable regulations. They make it possible to sift through large data sets from heterogeneous sources to uncover patterns, identify anomalies and predict possible risks before they occur. By using advanced analytics, organizations can take a proactive approach to compliance, rather than guessing at what might go wrong or waiting until something does go wrong before responding.

At the heart of compliance analytics are sophisticated algorithms that can be trained to identify patterns in the targeted data. For example, an algorithm could be trained to look for the inappropriate use of PII data as it applies to regulations such as GDPR or HIPAA. The algorithm could then trigger a specific response based on the output, such as escalating a potential issue to the compliance team for further review.

Using predictive analytics and AI technologies to address compliance requirements can lead to greater efficiency than traditional approaches. Analytics can reduce many of the manual processes that go into trying to achieve compliance, such as visually sifting through data or needing to investigate each potential risk. Compliance analytics provide a more complete picture of the data landscape, faster and more efficiently than a dedicated compliance team could otherwise achieve.

One of the biggest benefits of using these technologies is the reduction of false positives that come with more traditional approaches, saving time and effort. Advanced analytics offerings can also help minimize the risk of human error that comes with manual processes, especially when working with massive data sets. And they can reduce the potential for fraud because the data is not accessed directly.

The result is a more effective approach to compliance, as well as lower costs, not only because there is less demand on an organization's internal resources, but because the risk of violating the regulations is lower, helping to avoid the fines, lawsuits and tarnished reputations that can lead to lost revenue.

Compliance in action

Using advanced analytics to address compliance is a relatively new field, but one that's quickly gaining ground, as evidenced by the growing number of vendors that recognize its potential. For example, Digital Nirvana's MonitorIQ is a compliance logging product that makes it possible for broadcasters to repurpose broadcast content to comply with global regulations. Accelerite's ShareInsights offering provides a platform for analyzing large data sets to achieve regulatory compliance.

Another example is MinerEye's Data Tracker, a governance and data protection product that enables customers to identify and protect data assets to ensure compliant cloud migrations. The product tracks data at the byte and pixel levels, including unstructured, undermanaged and dark data. In addition, M-File's intelligent information management platform can help simplify compliance by making it easier to locate and manage PII.

These are not the only compliance-related products using predictive analytics and AI, but they do represent the growing trend toward compliance analytics and the important role it can play in today's highly regulated environments. As products mature, along with the technologies that support them, compliance tools that incorporate predictive analytics and AI technologies will get better at analyzing the volumes of disparate data, helping to ensure that an organization can indeed reach regulatory compliance and safeguard its personal information.