(Courtesy photo)

Major data breaches and privacy snafus occurring on a regular basis have made it obvious that having a robust privacy compliance program should be a prime concern for businesses. But a new report suggests that companies still have a long way to go when it comes to being privacy savvy. 

Toronto-based privacy compliance software company Nymity Inc. surveyed more than 100 privacy professionals, most of whom are either in-house counsel or privacy officers and are working in the U.S., for its Privacy Pulse study. 

Almost half of the respondents ranked building a privacy program as a top priority, and more than 70% said privacy has become an integral part of the overall strategy and planning for their firms. 

And yet nearly 60% of the respondents rated their company's privacy knowledge as being “moderate to very low.”

“This may seem surprising as one would expect that privacy programs would have been built in the run-up to the GDPR,” the study states, referring to the EU's General Data Protection Regulation. 

“This could indicate that companies have been treating compliance as a tactical 'check list' item and are now struggling with how to handle privacy laws that just keep coming—particularly in the U.S. with the CCPA (California Consumer Privacy Act), Nevada, Texas, and numerous other states tabling legislation,” the report adds.

Teresa Troester-Falk, chief global privacy strategist at Nymity, wrote in an email that, until recently, “privacy was generally seen as a compliance matter that rested within legal or compliance departments and not a matter of broad concern for the business.  

“This is beginning to change as privacy matters are front and center in the headlines and more and more corporate boards are learning that noncompliance with privacy laws is a matter of corporate liability, thus tasking the business with more responsibility,” she added.  

The majority of respondents said they wanted to spend more time on privacy education, which makes sense. But nearly 70% said their privacy compliance time was being dominated by documenting policies and procedures and working on data inventory.  

The study also revealed that many businesses might have difficulties with regulatory reporting. More than 75% of respondents said it would take them two or more days to report issues to regulators if required to do so.

“The vast majority of companies have approached privacy laws as a matter of strict compliance vs. accountability,”  Troester-Falk noted. “That is, the focus of privacy 'work' has been on adherence to legal requirements, not to demonstrating compliance or reporting on it.”

But she added that “demonstrating compliance is now a legal obligation under [GDPR] and we will see more laws including this, and correspondingly there are more internal functions being created around reporting and more demand for reporting tools.”

Other findings from the report include: 

• More than 80% of respondents indicated they were reporting on privacy matters and compliance status at regular intervals to their boards, and more than 40% were reporting quarterly.
• 71% believed that privacy will become increasingly integrated or embedded into business operations.
• 35% ranked continued CCPA compliance activities as a top priority, compared with 26% who were more concerned about continued GDPR compliance. 

Read More: 

Tech's Efforts to Diminish Landmark California Privacy Law Fizzle, for Now

UK's Recent GDPR Fines Signal Unified Enforcement Approach With EU

The Debate Over De-Identified Data: When Anonymity Isn't Assured