Data Points: Privacy & Data Security Blog

Saturday January 28, 2017 is Data Privacy Day.  The Moore & Van Allen Privacy and Data Security group took a break from the pre-holiday revelries to put together some thoughts and tips for DataPoints.  So hoist a glass and enjoy this read, and try not to ponder too long the irony that Data Privacy Day falls on the same day as China’s New Year’s celebration.  Cheers!

• Update vendor contracts. Make sure that contracts include required data security and privacy requirements. Some older laws and regulations already impose specific data security and privacy standards for certain industries or businesses (like GLBA for the financial services industry and HIPAA for the health care industry).  More laws are requiring covered companies to ensure that their vendors are meeting higher security and privacy standards too, and we only see this trend continuing.  In addition, even if enhanced security and privacy safeguards are not required by law, more businesses are requiring these from their vendors, due to customer concerns arising from well-publicized data breaches.
• Start a data mapping program. Complying with a variety of legal requirements (like FACTA, the EU right to be forgotten decisions, and the proposed NY regulations on Cybersecurity Requirements for Financial Services Companies), requires companies to first know where certain categories of data are located.  Data mapping also can unearth data containing PII that is no longer needed, and reducing the amount of stored PII can reduce the cost of a data breach.
• While you’re at it, update data management/retention policies – many breaches are not from an external threat but from an internal sources – in many cases, much of the data that's at risk of leaking (or that was leaked) should never have been available at all. Case in point – the Ashley Madison breach.
• Train your people. Human error is one of the primary causes of data incidents and breaches.  Properly training employees can reduce your company’s risk.  Training also is required by a number of programs and laws, including the EU-US Privacy Shield, the proposed New York Cybersecurity regulations, and Massachusetts law.
• Budget for a CISO. Hackers and data security threats are not going away.  Law makers realize this, and we see an increasing trend to impose data security requirements through legislation on companies generally (not just companies in specific industries).   If your company does not already have a lead information security executive, now may be a good time to make this investment.
• Review your information security program.   Even if you have adopted an information security program, things change and new threats arise.  In reviewing your program, ask the following questions:  Are you actively following the processes and practices outlined in your program?  Are there changes in your business that your program should address?  Are there new security threats that your program should be revised to cover?
• Remember that the little things often have the greatest impacts.  Simple policy changes such as requiring employees to change device passwords on a periodic basis (e.g., 90 or 120 days), encouraging (or prohibiting) employees to not use public WiFi, and keeping track of laptops and other physical equipment, can make a big difference. Although we often think of data security as preventing malicious hackers, stolen laptops and other device losses can also create a potential substantial loss of information.