What every IT pro needs to know about privacy

Regardless of whether you believe the adage that data is the new oil, or the new gold, it is inescapable that every business needs good data to operate effectively. And with data management come privacy risks and privacy obligations.

Privacy compliance has become the responsibility of the whole organisation. A proactive privacy management program is now required by law for companies with an annual turnover of more than $3m, and federal government agencies must also appoint a Privacy Champion in the C-suite and conduct Privacy Impact Assessments on high-risk projects. No longer can privacy compliance be relegated to a junior role in Legal or Information Security.

Particularly since the introduction of data breach notification laws last year, which include fines of up to $2.1m for a poorly handled data breach, IT professionals need to be across their organisation’s privacy compliance priorities and risk profile, and engaged in a holistic view of data governance. Even smaller businesses are covered by the new notifiable data breach scheme.

Anna Johnston, Director of specialist consultancy and training provider Salinger Privacy, said that the tougher Australian laws have coincided with a growing awareness of reputational risks for businesses, driven both by the Facebook/Cambridge Analytica scandal and new privacy regulations from Europe which have global effect.

“In recent years, we have been receiving more and more enquiries from IT professionals, especially in the emerging tech sectors like data analytics and IoT — clients who intuitively know they need to get privacy right, but who don’t know where or how to start going about it,” she said.

Effective privacy management takes cooperation between IT and IS, and legal, risk and compliance teams, as well as the custodians and major users of data within an enterprise, such as marketing, customer service, HR and other data-hungry or customer-facing business units.

So what should businesses focus on?

Johnston suggests thinking more broadly than just the information security mantra of ‘CIA’.

“All too often, privacy is confused with secrecy, or confidentiality. So traditionally, efforts have been focused on keeping personal information from leaking out of the organisation. But in fact an organisation’s privacy obligations stretch across the entire life cycle of information management,” she said. “When we conduct a privacy compliance review, we are looking at both data flows, and data governance, in the broadest sense.”

Privacy laws regulate what personal information can be collected in the first place (and how), create obligations in relation to data security, require the maintenance of data quality, create rights for staff and customers to ask to access (and possibly correct or delete) the personal information you hold about them, set limitations on how data may be used or disclosed, and mandate appropriate data disposal.

Johnston points out that privacy risks can therefore arise from multiple directions. A privacy breach might involve a malicious intruder cyber attack, but could also include:

• the wrong de-identification methods being used to treat data before sharing it or conducting data analytics;
• CRM systems that expose customer data beyond a strictly ‘need to know’ basis;
• the introduction of algorithmic decision-making without first testing if the data is fit for purpose; or
• the development of new databases, apps, IoT devices or AI/ML systems that haven’t been properly assessed for privacy compliance.

“IT professionals need to think beyond data security and engage with discussions about what personal information should be collected or held in the first place, as well as how it should be used and who can access what,” Johnston said.

Responding to a data breach, including the new mandatory notification requirements, also requires cooperation between IT/IS and the Privacy Officer, as well as drawing in Legal, Risk, HR, Comms/Media and others. Organisations of all types need to be prepared for a rapid response, by having a Data Breach Response Plan in place.

Other resources available to help you manage privacy compliance in your organisation include online privacy training modules on topics ranging from introductory compliance to achieving Privacy by Design; eBooks on topics such as Demystifying De-Identification and Big Data — An Ethical Framework for Protecting Privacy; a free guide to developing a privacy management program; as well as Compliance Kits containing a suite of practical tools like checklists, briefing papers and template documents to help you quickly develop your own Data Breach Response Plan, Privacy Policy and other foundational policies and procedures.

Find out more at www.salingerprivacy.com.au.

Image credit: ©stock.adobe.com/au/md3d

Please follow us and share on Twitter and Facebook. You can also subscribe for FREE to our weekly newsletter and quarterly magazine.