2019 Trends Overview: Compliance, Privacy and Security Family Tree

Also in the realm of financial services, the New York Department of Financial Services (DFS) continues to roll out their Cybersecurity Regulations (NYCRR500). Perhaps the gold standard in prescriptive security regulations, January 2018 introduced the first round of annual written compliance notification to the DFS superintendent and the 72-hour cybersecurity event notification requirement. Both rules are designed to create transparency in the event of a material data breach, and through legal attestation, to hold officers of the company legally accountable for the security posture of the firm, and for reporting security events that could harm their clients. The rules go further and tighten board reporting mechanisms, annual security testing and other security protocols designed to harden financial cyber defenses. The last traunch of DFS cybersecurity rules green light this year.

The GDPR

The greatest tectonic shift in compliance and privacy rules came in May when the European Union General Data Protection Regulations (GDPR) came into effect. GDPR imposes strict obligations on data controllers (those that collect and determine the use of data) and data processors (those that store or manipulate data on behalf of data controllers), while simultaneously offering more guidance on appropriate security standards. GDPR also mandates a 72-hour breach notification guideline, which is more stringent than most state-level notification clauses that use terms like "reasonable and timely." Moreover, these rules provide rights to consumers to know what information is collected, for what purpose and the right to be forgotten. Failure to comply with GDPR regulations brings the heftiest fines of up to 4% of a non-compliant firm's worldwide revenue.

Commitment to compliance in Europe and other countries that control European citizen data is questionable with no census and is yet to be tested in the courts. Perhaps the recent Marriott breach discovered in September yet not reported until the end of November, will surely test these rules and EU privacy commissioners' resolve to enforce the 72-hour notification articles.

Canada

In November, the Canadian Breach of Security Safeguards Regulations of the Personal Information Protection and Electronic Documents Act (PIPEDA) came into force, mandating notification requirements triggered by the discovery of a significant data breach. Under the new regulations, organizations that experience a data breach must conduct a risk assessment to determine if the breach poses a real risk of significant harm to any individuals whose information was exposed, and then notify "as soon as feasible" the Privacy Commissioner, affected individuals and any other agency (think law enforcement) that might mitigate harm to those affected. Violations of the Act can yield fines of up to $100,000.

California

While not in effect until January of 2020, but voted into law in 2018, the California Consumer Privacy Act (CCPA) is the Plymouth Rock of privacy in the United States. The law cites the tens of millions of people whose personal data was misused by the data mining firm Cambridge Analytica, a greater desire to heighten data privacy controls and transparency of data practices and the people's desire for privacy and more control over their information. The Act provides specific provisions around full disclosure regarding the collection of personal information (including sources, the purpose and whether the data is disclosed or sold to another party). It also provides the right to be deleted (like the GDPR right to be forgotten) and wraps these rights in protection of equal service and pricing, even if the individual exercises his or her rights under the Act (the net neutrality of privacy). The Act is enforced with penalties up to $100-$750 USD per consumer (per violation). That puts settlements in the sphere of GDPR penalties.

Study Warns of Major Cyber Attack

In a recent independent study of 1,250 global security and business leaders, CEOs, board members and technical executives unanimously predict a major cyber attack in the next two to five years. Over 60% of respondents assume a major event will occur. Business leaders now fear consequences of a major cyber attack more so than regulatory retaliation. Operation disruption and reputational damage are of greater concern than potential financial losses and regulatory penalties. This trend reflects a shift from a compliance-centric security approach (avoiding punishment) to a more self-actualized mindset determined to reduce the risk of business-altering outcomes to protect the organization, its investors and clients.

As a result, the idea that "the CISO is the least interesting person to the board, until they are the most important person" is a thing of the past. Most boards are now strongly familiar with security budgets, strategies and policies, technologies, and current security and privacy risks. Line of sight to the board is also direct. Almost half of the surveyed security officers report to the board of CEO, a third report to the CIO (which is problematic), and a small handful now report to a privacy or data officer.

Privacy in 2019

Perhaps the greatest innovation of the 21st century is turning the consumer into the product. In a connected world of Apple, Google, Amazon, Facebook and others, consumer preferences and behaviors are the raw materials for big data analytics that become a commodity for sale. As we've seen before, compliance and regulations often play catch up to technical innovation. And in 2018, compliance turned to focus more on privacy, perhaps the counterbalance to a new economy of "the consumer is the product." 2018 is the year when privacy commissions and industry regulators moved their chess pieces into place. 2019 and beyond will see industry pawns sacrificed to send a message to the cardinals and royalty of the corporate world. The message: privacy and data responsibility must be as important to the officers of a business as profitability is to the investors. As such, privacy and compliance blur together, and security becomes the guardian, keeping the others in check.

*****

Mark Sangster is a cybersecurity evangelist who has spent significant time researching and speaking to peripheral factors influencing the way that legal firms integrate cybersecurity into their day-to-day operations. In addition to Mark's role as VP and industry security strategist with managed cybersecurity services provider eSentire, he also serves on our Board of Editors and as a member of the LegalSec Council with the International Legal Technology Association (ILTA). He can be reached at [email protected].