Privacy Is Top Priority But Spending Will Decrease, Survey Says

So if companies are making privacy compliance a top priority this year, why doesn't the spend reflect that goal? "A lot of organizations — which I think could be detrimental for their risk mitigation efforts — are taking a wait-and-see approach with the CCPA," said Michael Hamilton, senior managing director of marketing at Exterro.

Organizations may be banking on regulatory authorities not being ready enforce certain aspects of the CCPA straight away. Hamilton noted that this echoes the approach that some organizations also took to the General Data Protection Regulation (GDPR) and its tenants around the right to know and right of access.

Similar provisions are found in the CCPA and allow customers to see and obtain copies of any information a company has collected about them. Putting the necessary infrastructure in place to satisfy those data subject access requests can be pricey for a corporation, though regulators may already be finding the requirement difficult to enforce.

"What we've seen with the GDPR so far is that it's been hard for the EU Commission to really enforce the GDPR at a detailed level, meaning that they are not really able to monitor all of these different requests for personal data and deleting that personal data and anonymizing that personal data," Hamilton said.

But aside from the "wait-and-see" approach, it's possible that businesses are just allocating their privacy-related spend under a different heading. The Legal Spend Management survey, for example, shows that the majority of respondents (51%) believe the most risk for increased costs comes from litigation.

"I think that continues to be the highest amount of risk — the highest amount of risk associated with spend — based on increased litigation from the data privacy laws," Hamilton said. As for the 7% of respondents who rated the specified privacy category as being of the most risk for increased costs, Hamilton believes that refers to creating a defensible process for compliance.

Survey respondents were also asked to rate such privacy initiatives by importance using a scale of 1 (least important) to 5 (most important). Creating an online portal for individuals to request data rated at the top with a 4.5, followed by building an automated data subject access request process at 2.8. Repurposing e-discovery technology to identify, collect and review data subject access requests placed last with a 2.4 rating.

Hamilton thinks that companies could be in trouble come the July CCPA compliance date if they don't have efficient and defensible processes for managing the intake of data subject access requests. "Organizations are, I think, unfortunately going to be getting a wake-up call," he said.

*****

Frank Ready is a reporter on the tech desk at ALM Media. He can be reached at [email protected].