Challenges facing organizations from new data privacy, protection and security regulations enacted around the world were discussed at PrivSec New York, a two-day conference at Columbia University that was attended by hundreds of professionals.
“The age of privacy has arrived, and it is here to stay,” said Karima Noren, co-founder of The Privacy Compliance Hub and The Legal Pod in the U.K. who formerly was senior legal counsel and head of emerging markets at Google.
Columbia Law School professor of law, science and technology Tim Wu, who spoke about the EU’s General Data Protection Regulation, U.S. state laws and anticipated U.S. federal law on data privacy, said, “The level of public desire for privacy is very, very high.“
Corporate executives, consultants and attorneys discussed the impact of the GDPR, the California Consumer Privacy Act of 2018 and the New York Department of Financial Services’ influential cybersecurity regulations enacted in 2017, among other topics.
The patchwork of federal, state and local laws in the United States governing data breach notification and data protection in the absence of a comprehensive federal law in the U.S., and the compliance hurdles it presents for companies trying to comply and fend off litigation, was a recurrent theme among the various panels.
Unlike the GDPR, New York’s cybersecurity regulations governing banks and insurance companies, for instance, do not include a provision for certifying standards for entities to prove compliance. “I wish there was,” said F. Paul Greene, a privacy and data security chairman at Harter, Secrest & Emery in Rochester, New York.
Greene said that while New York’s law has been influential and used as a model by the National Association of Insurance Commissioners as part of its model legislation, other states are varying from it enough to add more complexity.
Alan C. Raul, founder and leader of the privacy and cybersecurity practice at Sidley Austin in Washington, D.C., spoke of a “proliferation of agencies and enforcement actions” in the U.S., including by the Federal Trade Commission the “de facto privacy and security regulator,” but also by the Securities and Exchange Commission, the Commodity Futures Trading Commission, the New York State Department of Financial Services, state attorneys general and other agencies. Raul said, “digital governance could be the next expectation” of boards of directors and senior executive leadership.
In fact, a key takeaway from the event was the need to instill privacy as a culture from the top of organizations, including at the CEO and board of directors level. Several speakers noted that many companies approach the task of complying with the new rules around data privacy, protection and security as a project when it actually is an ongoing responsibility requiring behavioral change throughout the organization.
“It is not a one-time project; it is a culture,” said Noren.
Bill Schaumann, a privacy solutions engineer at WireWheel, a software company based in Arlington, Virginia, that provides software-as-a-service tools for tracking and safeguarding customer data, talked about the big change coming from the advent of the internet of things of interconnected devices, which is changing the nature of data being collected and stored from transactional data such as credit card purchases, to behavioral data about individuals and their activities.
Speakers also addressed the need for technology officers, information security officers and legal counsel and other executives to work together to address growing threats instead of operating in silos.
This article first published on sister site Law.com.
- New privacy laws taking shape worldwide
- 5 questions the U.S. must answer before enacting privacy law
- States begin adopting insurance cybersecurity requirements