Featured

Data Privacy Plans: When Creating One, Remember to K.I.S.S.

Data privacy sits at the center of business operations today. No matter what industry you’re in, you collect, store, and use it, and the laws now require us to better protect it. The worst thing any organization can do is make that obligation more complicated than it needs to be.

Personally Identifiable Information (PII) helps guide our decision-making processes, from purchasing to marketing to sales to hiring. Data you collect on current customers,  prospective customers, and your website visitors, for example, helps you run highly-targeted and highly-effective marketing campaigns. But data privacy regulations now complicate all of that.

As data proliferation is now a well-known fact, more people are becoming concerned about companies misusing theirs. This fear and concern have sparked new legislation around the world that regulates what businesses can and cannot do with the personal information they collect.

Whether it’s the GDPR in Europe or the CCPA and CRPA in California, new privacy protection laws are forcing businesses worldwide to change their practices to become compliant.

In response, companies have been rushing to create an all-encompassing privacy protection plan hoping to ensure compliance with California’s current laws and preps them for future regulation as well.

Of course, the challenge is these laws are complicated, and building a full data privacy plan can be just as involved. The general approach has been to create a massive program that covers every possible angle.

But is that necessary? In reality, it’s not. And that’s why companies end up scaling back. Like many other things in life, it’s best to follow the principle of K.I.S.S. — Keep It Simple Stupid.

Your Data Privacy Plan Should Fit Your Company

The KISS acronym is a funny way of reminding us not to make things too complicated, as many of us tend to do from time to time. It doesn’t mean we’re stupid, of course — far from it.

This saying is perfectly suited for companies that are building a data privacy plan. Another phrase comes to mind as well: Less is more.

Privacy is a complicated issue, but that doesn’t mean you need to build an incredibly complicated plan. Just because privacy laws are big blanket regulations does not imply a one-size-fits-all approach is right.

In most cases, such an approach is not only inappropriate, it’s onerous, costly, and unnecessarily time-consuming. A better approach is to build a privacy plan that fits your company’s risk profile.

That’s what we do at Compliance and Privacy Partners. We don’t let the regulators lead us. We help companies build a privacy program that is proportionate to your risk.

Doing anything above and beyond doesn’t always provide extra protection. It often complicates the compliance burden. Data privacy shouldn’t be about building levels of bureaucracy that rival that of the government. It should be about building simple, effective, and appropriate solutions focused on data protection.

There are Opportunities Where Gaps Exist

President John F. Kennedy once said:

“The Chinese use two brush strokes to write the word ‘crisis. One brush stroke stands for danger; the other for opportunity. In a crisis, be aware of the danger — but recognize the opportunity.”

That quote summarizes one of our three pillars of digital strategy consulting: Where gaps exist, so, too, do opportunities.

Many companies approach data privacy compliance as an arduous task they have to undertake. They seek to protect themselves from the regulatory authorities to fill the gaps in their current policies to keep them compliant.

That line of thinking is short-sighted, though. Companies that can understand there are opportunities to be had in this process are the ones who are going to separate themselves from the competition.

Instead of merely creating a data privacy plan that will abide by laws, why not use it as a way to connect with your current and prospective customers? Why not use it as a way to be a leader in your industry?

It’s amazing what opportunities you can find when you approach mundane tasks with an open mind. CAPP can help you do just that as you build your data privacy plan.

Relationships are What Matter Most

It’s essential to keep in mind that people are at the heart of your data privacy plan through it all. It’s not just the consumers whose data you are protecting but also your employees and business partners who help you protect it. Your customers have to believe that you are treating their data with care and are being responsible.

Your employees need to help you communicate this message and to execute the plan from the inside out. And business partners will serve an essential role in protecting this data exchanged between the two.

We Do More for Our Clients

We have busy enough lives as it is. There’s no need to make things more complicated than they have to be — even when we’re talking about something as crucial as data privacy compliance.

Privacy is a core value of ours at CAPP, and we can help make it one of yours, too. By working closely with your legal, HR, compliance and IT teams, we help you build a solution that matches your potential risk.

We not only build you a program that works today but anticipates what’s to come in the ever-changing world of data privacy, data security and regulation. Through it all, we help you see that compliance isn’t a burden but rather an opportunity.

Turn Waves Of Regulation Into Oceans Of Opportunity with CAPP.

To learn more about how Compliance & Privacy Partners can help prepare you for the new wave of privacy regulations reach out to us at 323-413-7432 or email us at support@capp-llc.com for a free consultation with a Certified Information Privacy Manager.

Featured

Prop 24: New Privacy Regulations Rock The State of California

A Special Report from Compliance & Privacy Partners

California Privacy Rights Act
The CPRA amends and expands the California Consumer Privacy Act (CCPA)—California’s current privacy law that itself is nearly brand new.

Californians took a step toward more privacy protections when they voted to pass Proposition 24 on November 3. The ballot created what’s known as the California Privacy Rights Act, known as the CPRA, which will expand and amend the previously-existing California Consumer Privacy Act (CCPA). So, what does this mean for Californians and companies that do business in the state? It can be confusing, so let’s take a closer look at some of the law’s major points.

The Background

California has a unique system of ballot propositions. It allows people and groups to go around the state government to get certain initiatives passed into law.

To appear on an official ballot, groups must file a proposal with the attorney general’s office. Then, they must receive a certain number of signatures supporting the measure by a specific date. Once those signatures are confirmed, the proposition can appear on the ballot.

In 2020 alone, there were 12 ballot measures on which Californians could vote. If a ballot measure passes, it becomes law in the state — regardless of how elected officials feel about it.

The group that supported the CPRA, Californians for Consumer Privacy, has also supported other privacy measures in the past. In 2018, they got enough signatures to get the CRPA on the ballot, but they agreed to withdraw that application in exchange for the state legislature passing the CCPA.

In the two years since its passage, the group wasn’t satisfied with how the CCPA turned out. So, it moved forward again with a ballot for the CPRA, which the group saw as a stronger law.

What Does CPRA Do?

This new law is now the baseline for all privacy laws within California. Only a further ballot measure would be able to repeal it. If lawmakers were to pass an amendment to it, the groups that support CPRA could sue to have that blocked.

The only other way that the law could be changed or modified is through a future ballot passage, or if the federal government or court system invalidated it. That could be done only if it were ruled unconstitutional, or if a federal privacy law pre-empted it.

Is CPRA Effective?

There is an adjustment period now that CPRA has passed. Most of the significant provisions won’t take effect for two more years — on January 1 of 2023. This gives businesses that are affected enough time to make necessary changes. The “Right to Know” provision of the law takes effect a year earlier, on the first of 2022.

In the meantime, businesses have to comply with the current CCPA until the CPRA is fully in effect.

What Are the Differences Between CPRA and CCPA?

There are several ways that the new law differs from the original one. It seeks to take consumer privacy one step further in many cases.

There are ten primary areas where the two are different.

1. Business Regulations

A “covered business” is redefined under CPRA. In some instances, the number of businesses covered will decrease from CCPA, while in others, it will increase. That’s because:

  • It will not be applied to as many small and mid-sized businesses as CCPA because the threshold for the number of households/consumers has been increased from 50,000 to 100,000.
  • Businesses that buy, sell, or share personal information are subject to the new CPRA. Companies that get at least half of their yearly revenue in this way are subject to the law.

2. Sensitive Personal Information

The law creates an entirely new dataset known as “sensitive personal information.” It’s now subject to full disclosure and limitation. Consumers also now have the right to limit the use of their personal information by businesses.

CCPA is much broader in how it treats sensitive personal information, but not so for CPRA. There are separate restrictions and requirements on this type of information, including:

  • A requirement to offer an opt-out for both disclosure and use of it
  • A required opt-in consent standard for disclosure and use of it
  • A requirement that limits the purpose of use
  • A requirement on full disclosure

See the differences between various privacy laws below.

3. New and Expanded Rights

CPRA not only modifies some of the privacy rights California consumers have under CCPA; it also creates brand new ones.

Some of the modified rights include:

  • Businesses have to notify third parties that they must delete personal information they buy or receive.
  • Data applicable under “Right to Know” is now expanded beyond just the previous 12 months if collected after January 1 of 2022.
  • Opt-outs must also include the sharing of personal information, not just the sale of it to third parties.
  • Businesses have to abide by the same opt-in selling rights to minors. In other words, they now must wait at least 12 months after a minor has declined to sell/share their personal information.
  • Consumers can request their personal information be transmitted in a specific way — as long as it is commonly used and structured.

Some of the new rights include:

  • Consumers can request corrections if any of their personal information is wrong.
  • Consumers can opt-out of technology that makes decision-making regarding personal information automated. In other words, they can’t be profiled based on a consumer’s health, interests, location, economic situation, etc.
  • Consumers can also request information about any automated decision-making technology.
  • Consumers can limit the use of their sensitive personal information. They can ban businesses from sending it to third parties altogether.
  • Cybersecurity audits and risk assessments are now mandatory for any activity that is labeled high-risk. These audits have to be submitted regularly to the California Privacy Protection Agency.

4. Behavioral Advertising

CPRA seeks to regulate all digital advertising. It will now separate digital advertising into two categories — non-personalized and cross-context behavioral.

Personal information that businesses want to share for cross-context behavior must be subject to the Right to Opt-Out, while the other is not. This first-party advertising, as it’s called, is designated for internal business use.

There were already many businesses who were treating the Right to Opt-Out under CCPA this way. So, they won’t be required to make many changes, if any at all, in this regard.

5. New Authority

CPRA will establish a new agency that will be tasked with enforcing the law. It will be called the California Privacy Protection Agency, or CPPA. The new body will have the power to make rules, enforce rules, and investigate instances of non-compliance.

Also, there will no longer be a 30-day “cure period,” as there is under the current CCPA. This means that once a business is notified of a potential violation by the state attorney general’s office, they must act right away.

This new law will also increase maximum penalties up to $7,500 for any violation that concerns a minor. That’s triple the current maximum under the CCPA.

6. GDPR Alignment

Some of the CPRA is structured after the General Data Protection Regulation (GDPR) law that has been in effect in Europe since 2018. The three main areas that are now codified are:

  • Data: Businesses have to limit the collection, retention, sharing, and use of personal information only to what is considered “reasonably necessary and proportionate” to their purpose. It also can’t be processed for undisclosed and/or incompatible uses.
  • Storage: Businesses always have to tell consumers how long they’re retaining their personal information, and they must do this for every category of personal information. They also can’t hold onto the information for longer than “reasonably necessary” for each purpose they disclose.
  • Purpose: If a business wants to change a purpose for why they collect and/or use personal information, they must issue a new consumer notice.

Businesses that don’t comply are now also subject to enforcement through the newly-created CPPA. A violation of any three of these codes is enough for enforcement, even if no other offense is committed.

7. Service Providers

CPRA creates a new category of businesses called “contractors,” which amends the definition of a “service provider.” Contractors must now not only abide by these regulations, but they must state that they understand them and will abide by them.

They must notify businesses if they work with any sub-contractor sub-service provider, and those parties must abide by the same rules in a similar written contract.

These contractors and service providers must help businesses if a consumer makes a request for privacy. Finally, companies have to hold service providers/contractors accountable (via contract) from combining the personal information they receive with other collected data.

8. Exemptions

The CPRA did grant some leeway to the state Legislature to work on regulations about business-to-business and employee exemptions. They now have until the start of 2023 to do so through a new bill. The Legislature could, of course, try to challenge this aspect of the CPRA, but they’d be in for a fight if they indeed tried to do so.

9. Consent Standard

A consent standard existed under CCPA, but it will now more closely align with the definition laid out under GDPR. This makes it much stricter, although some of this already existed under CCPA.

It includes:

  • Research exemptions
  • Financial incentive programs and an opt-in consent
  • Consent to disclosure and use by a secondary firm after already opting out
  • Minors having the power to opt-in to their personal information being shared or sold
  • Consent required to sell or share personal information following an opt-out

10. Data Breaches

The CCPA already has a private right of action in place for data breaches, and CPRA doesn’t alter that in any way.

What’s Next?

CPRA becomes fully effective on the first day of 2021. Starting around the mid-point of next year, the process of officially making the rules will begin. The Legislature has until July 1 of 2022, to adopt the final regulations under CPRA. One year after that, the CPPA will have full authority to enforce the new law.

CPRA is set to alter and expand California consumers’ privacy rights over the next few years. But there’s still a ways to go before everything is entirely in effect.

Turn Waves Of Regulation Into Oceans Of Opportunity with CAPP.

New regulations governing the use of consumer’s personally identifiable information (PII) needn’t be burdensome.  In fact, they can help protect your organization, reduce operating expenses, and identify opportunities for better governance that ensure you avoid fines, litigation exposure, and foster trust that enhances customer experiences. To learn more about how Compliance & Privacy Partners can help prepare you for the new wave of privacy regulations reach out to us at 323-413-7432 or email us at support@capp-llc.com for a free consultation with a Certified Information Privacy Manager.

FTC Finalizes Settlement with California Tech Company Related to Privacy Shield

The Federal Trade Commission has finalized a settlement with a California technology company over allegations that it falsely claimed participation in the EU-U.S. Privacy Shield framework, which enables companies to transfer consumer data legally from European Union countries to the United States.

The FTC alleged that Medable, Inc., falsely claimed in its privacy policy that it was a certified participant in the EU-U.S. Privacy Shield framework and adhered to the program’s principles. As part of the settlement with the FTC, Medable is prohibited from misrepresenting its participation in the EU-U.S. Privacy Shield framework, any other privacy or data security program sponsored by the government, or any self-regulatory or standard-setting organization.

After receiving no comments on the proposed settlement, the Commission voted 5-0 to give final approval to the settlement.

Rafael Moscatel is Managing Director of Compliance and Privacy Partners, a consulting firm specializing in data governance and privacy solutions. He is an award-winning Information Governance Professional (IGP), Certified Records Manager (CRM), Certified Information Privacy Manager (CIPM). Rafael has spent the last twenty years developing large-scale Information Management Programs for the Fortune 500 including Paramount Pictures and Farmers InsuranceReach him at 323-413-7432, follow him on Twitter at @rafael_moscatel or visit http://www.capp-llc.com to learn more.

FTC Finalizes Settlement with Utah Company and its former CEO over Allegations they Failed to Safeguard Consumer Data

The Federal Trade Commission has granted final approval to a settlement with a Utah-based technology company related to allegations that the firm failed to put in place reasonable security safeguards, allowing a hacker to access the personal information of more than a million consumers.

The FTC alleged that InfoTrax Systems, L.C. and its former CEO Mark Rawlins failed to use reasonable, low-cost, and readily available security protections to safeguard the personal information they maintained on behalf of InfoTrax’s business clients. As a result of the company’s alleged security failures, a hacker infiltrated InfoTrax’s server, along with websites maintained by the company on behalf of clients, more than 20 times from May 2014 until March 2016. The hacker accessed consumers’ sensitive personal information, including Social Security numbers, according to the FTC’s complaint.

As part of the settlement with the FTC, InfoTrax and Rawlins are prohibited from collecting, selling, sharing, or storing personal information unless they implement an information security program that would address the security failures identified in the complaint. In addition, the settlement requires the company and Rawlins to obtain third-party assessments of their companies’ information security programs every two years.

After receiving no comments on the settlement, the Commission voted 5-0 to finalize the settlement order with InfoTrax and Rawlins.

Rafael Moscatel is Managing Director of Compliance and Privacy Partners, a consulting firm specializing in data governance and privacy solutions. He is an award-winning Information Governance Professional (IGP), Certified Records Manager (CRM), Certified Information Privacy Manager (CIPM). Rafael has spent the last twenty years developing large-scale Information Management Programs for the Fortune 500 including Paramount Pictures and Farmers InsuranceReach him at 323-413-7432, follow him on Twitter at @rafael_moscatel or visit http://www.capp-llc.com to learn more.

FTC Grants Final Approval to Settlement with Former Cambridge Analytica CEO, App Developer over Allegations they Deceived Consumers over Collection of Facebook Data

FTC Grants Final Approval to Settlement with Former Cambridge Analytica CEO, App Developer over Allegations they Deceived Consumers over Collection of Facebook Data

The Federal Trade Commission has granted final approval to a settlement with the former CEO of Cambridge Analytica, LLC and an app developer who worked with the company to resolve allegations they used deceptive tactics to collect personal information from tens of millions of Facebook users for voter profiling and targeting.

In its complaint, the FTC alleged that app developer Aleksandr Kogan worked with Cambridge Analytica and its former CEO Alexander Nix to enable Kogan’s GSRApp to collect Facebook data from app users and their Facebook friends. The FTC alleged that app users were falsely told the app would not collect users’ names or other identifiable information. The GSRApp, however, collected users’ Facebook User ID, which connects individuals to their Facebook profiles.

The Commission recently announced an Opinion that found that Cambridge Analytica, which filed for bankruptcy in 2018, engaged in similar conduct in violation of the FTC Act.

As part of the settlement, Kogan and Nix are prohibited from making false or deceptive statements regarding the extent to which they collect, use, share, or sell personal information, as well as the purposes for which they collect, use, share, or sell such information. In addition, they are required to delete or destroy any personal information collected from consumers via the GSRApp and any related work product that originated from the data.

The Commission received one comment on the proposed settlement. The Commission voted 5-0 to finalize the order and to send a response to the commenter.

Rafael Moscatel is Managing Director of Compliance and Privacy Partners, a consulting firm specializing in data governance and privacy solutions. He is an award-winning Information Governance Professional (IGP), Certified Records Manager (CRM), Certified Information Privacy Manager (CIPM). Rafael has spent the last twenty years developing large-scale Information Management Programs for the Fortune 500 including Paramount Pictures and Farmers InsuranceReach him at 323-413-7432, follow him on Twitter at @rafael_moscatel or visit http://www.capp-llc.com to learn more.

FTC Finalizes Settlement with Company that Misled Consumers about how it Accesses and Uses their Email

The Federal Trade Commission finalized a settlement with an email management company that allegedly deceived some consumers about how it accesses and uses their email.

The FTC alleged that Unrollme Inc., which helps users unsubscribe from unwanted emails or consolidate their email subscriptions, falsely told consumers that it would not “touch” their personal emails in order to persuade consumers to provide access to their email accounts.

In fact, Unrollme shared users’ email receipts from completed transactions with Unrollme’s parent company, Slice Technologies, Inc. E-receipts can include, among other things, the user’s name, billing and shipping addresses, and information about products or services purchased by the consumer. Slice uses anonymous purchase information from Unrollme users’ e-receipts in the market research analytics products it sells.

As part of the settlement with the Commission, Unrollme is prohibited from misrepresenting the extent to which it collects, uses, stores, or shares information from consumers. It must also notify those consumers who signed up for Unrollme after viewing one of the allegedly deceptive statements about how it collects and shares information from e-receipts. The order also requires Unrollme to delete, from both its own systems and Slice’s systems, stored e-receipts previously collected from those consumers, unless it obtains their affirmative, express consent to maintain the e-receipts.

After receiving two comments, the Commission voted 4-0-1 to approve the settlement with Unrollme as well as responses to the commenters. Commissioner Rohit Chopra abstained from the vote.

Rafael Moscatel is Managing Director of Compliance and Privacy Partners, a consulting firm specializing in data governance and privacy solutions. He is an award-winning Information Governance Professional (IGP), Certified Records Manager (CRM), Certified Information Privacy Manager (CIPM). Rafael has spent the last twenty years developing large-scale Information Management Programs for the Fortune 500 including Paramount Pictures and Farmers InsuranceReach him at 323-413-7432, follow him on Twitter at @rafael_moscatel or visit http://www.capp-llc.com to learn more.