Law.com Subscribers SAVE 30%
Call 855-808-4530 or email [email protected] to receive your discount on a new subscription.
Companies Poised To Repeat Data Privacy Compliance Mistakes
U.S. companies haven't learned much from the missteps they made while preparing for the European Union's General Data Protection Regulation (GDPR), suggests a new study on data privacy regulation compliance.
San Mateo, CA-based data privacy management software company DataGrail surveyed 301 U.S.-based privacy professionals in information technology, operations, legal, and risk and compliance in April for its report, “The Age of Privacy: The Cost of Continuous Compliance.”
About half of the survey respondents whose companies are affected by GDPR revealed they had failed to meet last May's deadline to comply with the regulations — and 70% said the data privacy compliance systems they established or plan to have in place are incapable of adapting to new regulations.
“The interesting thing here was that, in preparing to become GDPR ready, a lot of the companies tried to build something in-house to try to scramble, if you will, to become GDPR ready,” said Daniel Barber, co-founder and CEO of DataGrail.
While most respondents reported it took them at least seven months to prepare for GDPR, 71% believed they could be ready for the California Consumer Privacy Act (CCPA) compliance deadline in less than six months. The CCPA deadline is Jan. 1, 2020.
The majority of companies are still approaching privacy regulations on a case-by-case basis, and half are using manual processes to manage GDPR privacy rights requests, which often involves a couple dozen employees and “thousands of touch points with the potential to introduce human error,” the report states.
Barber said the study's findings show that “most companies still rely on piecemeal technology solutions and manual processes, when they should be turning to privacy management solutions purpose-built for privacy regulations.”
He added: “Companies will need to integrate and operationalize their privacy management to avoid the time-consuming and error-prone manual processes to comply with these regulations.”
According to the report, most companies said the murkiness and complexities of GDPR make compliance a challenge.
Other major hurdles included lacking the time and human resources to plan and implement compliance programs and struggling to integrate compliance solutions across multiple systems and services.
The top challenges for CCPA compliance were virtually the same as those listed for GDPR.
Other findings from the report include:
- The average company held between 2,000 and 4,000 hours of meetings preparing for GDPR, while some spent more than 9,000 hours, or more than a year, in meetings.
- Nearly 80% of companies reported shelling out at least $100,000 on GDPR and CCPA compliance, while 20% have spent more than $1 million.
- Nearly 60% of companies have at least 26 employees managing data subject access requests under GDPR, and 84% have a system in place to help prevent human errors that could arise during the process.
*****
Phillip Bantz is a reporter for Corporate Counsel, an ALM sibling of Cybersecurity Law & Strategy. Follow him on Twitter @PhillipBantz.
This premium content is locked for Entertainment Law & Finance subscribers only
ENJOY UNLIMITED ACCESS TO THE SINGLE SOURCE OF OBJECTIVE LEGAL ANALYSIS, PRACTICAL INSIGHTS, AND NEWS IN ENTERTAINMENT LAW.
- Stay current on the latest information, rulings, regulations, and trends
- Includes practical, must-have information on copyrights, royalties, AI, and more
- Tap into expert guidance from top entertainment lawyers and experts
Already a have an account? Sign In Now Log In Now
For enterprise-wide or corporate acess, please contact Customer Service at [email protected] or 877-256-2473
How Secure Is the AI System Your Law Firm Is Using?
In a profession where confidentiality is paramount, failing to address AI security concerns could have disastrous consequences. It is vital that law firms and those in related industries ask the right questions about AI security to protect their clients and their reputation.
COVID-19 and Lease Negotiations: Early Termination Provisions
During the COVID-19 pandemic, some tenants were able to negotiate termination agreements with their landlords. But even though a landlord may agree to terminate a lease to regain control of a defaulting tenant's space without costly and lengthy litigation, typically a defaulting tenant that otherwise has no contractual right to terminate its lease will be in a much weaker bargaining position with respect to the conditions for termination.
Pleading Importation: ITC Decisions Highlight Need for Adequate Evidentiary Support
The International Trade Commission is empowered to block the importation into the United States of products that infringe U.S. intellectual property rights, In the past, the ITC generally instituted investigations without questioning the importation allegations in the complaint, however in several recent cases, the ITC declined to institute an investigation as to certain proposed respondents due to inadequate pleading of importation.
The Power of Your Inner Circle: Turning Friends and Social Contacts Into Business Allies
Practical strategies to explore doing business with friends and social contacts in a way that respects relationships and maximizes opportunities.
Authentic Communications Today Increase Success for Value-Driven Clients
As the relationship between in-house and outside counsel continues to evolve, lawyers must continue to foster a client-first mindset, offer business-focused solutions, and embrace technology that helps deliver work faster and more efficiently.