The California Consumer Privacy Act passed into law in 2018 is scheduled to go into effect January 2020. It could potentially have dire consequences for unprepared businesses serving their customers especially when they demand to be forgotten.
The new law affects everyone from internet service providers to mom-and-pop shops when it comes to privacy, data retention and compliance regulations. Failure to comply with the pending CCPA regulations can result in having to pay massive fines, similar to the recent General Data Protection Regulation (GDPR) fines levied against Google in the European Union. However, there are steps that organizations can take to ensure compliance while protecting consumer data referenced as personally identifiable information (PII) or personal health information (PHI).
Companies looking to capitalize on the ever-shifting privacy landscape can maximize this opportunity by asking not just how, but why. The reasons that necessitated the CCPA are of similar logic to those that brought about its predecessor GDPR for Europeans and PIPEDA for Canadians – governments are drafting laws that aim to hold organizations accountable for safely storing and protecting consumer data. The requirements of these regulations range from the now-expected cookies prompt on websites to the use of pseudonyms when storing the data volunteered by consumers.
Another approach for organizations looking to understand the ins and outs of CCPA is to simplify the requirements. There are hundreds of pages of CCPA requirements that can equally intimidate Fortune 500 companies and small businesses alike. These requirements can be distilled into a few key steps for organizations planning to minimize risks of privacy non-compliance.
- Identify all sources of data within the organization. In order to safely secure all data that falls under an organization’s purview all sources of data flowing into the organization must be understood and documented. This makes it easier to sort the data into the appropriate data storage protocols.
- List who can access the sources of data. Much of the focus on PII / PHI revolves around who has access to that data. By always knowing who has access to PII / PHI, organizations can minimize risks while also gaining more control over internal processes.
- Establish requirements for each data source. Companies should determine the requirements necessary for each source of data. Predetermining data requirements, such as which fields need to have pseudonyms applied, can force organizations to give more thought to the volume and type of data expected, and better understand how best to store it.
- Determine what processes must be changed to comply. A little foresight can go a long way. Organizations examining data processes today can avoid potentially hefty fines for non-compliance when the CCPA goes into effect in 2020.
- Take control of data retention processes. Once companies have taken the proper steps to limit access, establish requirements, and determine processes for storing data, the next step is to take complete control of the data retention process. Establishing and maintaining control of data is the ultimate compliance goal for organizations that fall under jurisdiction of CCPA or GDPR. Additionally, there are vendors who offer capabilities such as automation and enhanced searchability of data retention.
There is no time like the present for organizations to start taking steps to ensure CCPA compliance. Often the most time-consuming part of the process is determining what steps are needed and who is best qualified to understand and overhaul data retention processes. Get a head start on understanding the 2020 requirements and take action before it’s too late.
Chris Jordan is CEO and co-founder of Fluency Security (www.fluencysecurity.com), a security audit and automation technology firm that uses artificial intelligence to retain and organize data to meet regulations and support investigations in seconds.
BroadbandBreakfast.com accepts commentary from informed observers of the broadband scene. Please send pieces to firstname.lastname@example.org. The views reflected in Expert Opinion pieces do not necessarily reflect the views of BroadbandBreakfast.com and Breakfast Media LLC.
- Strategies for Interconnecting Middle-Mile and Last-Mile Fiber Critical Amid COVID19 Pandemic
- Breakfast Media Minute: September 25, 2020
- SiFi Network’s FiberCity Now Live in Fullerton, Ajit Pai Addresses Telehealth, Georgia Uses Ookla Speed Data
- State and Regional Broadband Initiatives Are Critical to Expanding Internet Access
- For Broadband and Future of Work, Coronavirus Pandemic is a Reset and Not a Pause
Signup for Broadband Breakfast
Fiber4 months ago
Fiber Networks Hold a Cybersecurity Advantage Over Rival Co-Axial and Wireless Technologies, Say Panelists
Congress4 months ago
Senators Introduce Healthcare Broadband Bill as House Companion, Proposes $2 Billion Telehealth Expansion
Artificial Intelligence3 months ago
Brookings Panelists Emphasize Importance of Addressing Biases in Artificial Intelligence Technology
China5 months ago
China Expert Predicts that Nation’s Flawed Coronavirus Response Will Damage the Power of Chinese Communist Party
Infrastructure6 months ago
Broadband Breakfast Live Online Will Stream Every Wednesday at 12 Noon ET on ‘Broadband and the Coronavirus’
Education6 months ago
Online Elementary Education is No Spring Break for Parents Teaching from Home
Artificial Intelligence3 months ago
U.S. State Department Employing Artificial Intelligence Against COVID-19 Misinformation
Rural5 months ago
Why the Rural Digital Opportunity Fund is So Significant, and How to Succeed in Applying For RDOF