Photo: MP McQueen/ALM

Challenges facing organizations from new data privacy, protection and security regulations enacted around the world were discussed at a PrivSec New York, a two-day conference at Columbia University this week that was attended by hundreds of professionals, including in-house counsel and big firm attorneys.

"The age of privacy has arrived and it is here to stay," said Karima Noren, co-founder of The Privacy Compliance Hub and The Legal Pod in the U.K. who formerly was senior legal counsel and head of emerging markets at Google. Noren was once an associate at Ashurst, according to her LinkedIn bio.

Columbia Law School professor of law, science and technology Tim Wu, who spoke about the EU's General Data Protection Regulation, U.S. state laws and anticipated U.S. federal law on data privacy, said, "The level of public desire for privacy is very, very high."

Corporate executives, consultants and attorneys discussed the impact of the GDPR, the California Consumer Privacy Act of 2018 and the New York Department of Financial Services' influential cybersecurity regulations enacted in 2017, among other topics. 

The patchwork of federal, state and local laws in the United States governing data breach notification and data protection in the absence of a comprehensive federal law in the U.S., and the compliance hurdles it presents for companies trying to comply and fend off litigation, was a recurrent theme among the various panels.

Unlike the GDPR, New York's cybersecurity regulations governing banks and insurance companies, for instance, do not include a provision for certifying standards for entities to prove compliance. "I wish there was," said F. Paul Greene, a privacy and data security chairman at Harter, Secrest & Emery in Rochester, New York.

Greene said that while New York's law has been influential and used as a model by the National Association of Insurance Commissioners as part of its model legislation, other states are varying from it enough to add more complexity.

Alan C. Raul, founder and leader of the privacy and cybersecurity practice at Sidley Austin in Washington, D.C., spoke of a "proliferation of agencies and enforcement actions" in the U.S., including by the Federal Trade Commission the "de facto privacy and security regulator," but also by the Securities and Exchange Commission, the Commodity Futures Trading Commission, the New York State Department of Financial Services, state attorneys general and other agencies. Raul said, "digital governance could be the next expectation" of boards of directors and senior executive leadership.

In fact, a key takeaway from the event was the need to instill privacy as a culture from the top of organizations including at the CEO and board of directors level. Several speakers noted that many companies approach the task of complying with the new rules around data privacy, protection and security as a project, when it actually is an ongoing responsibility requiring behavioral change throughout the organization.

"It is not a one-time project, it is a culture," said Noren.

Bill Schaumann, a privacy solutions engineer at WireWheel, a software company based in Arlington, Virginia, that provides software-as-a-service tools for tracking and safeguarding customer data, talked about the big change coming from the advent of the internet of things of interconnected devices, which is changing the nature of data being collected and stored from transactional data such as credit card purchases, to behavioral data about individuals and their activities.

Speakers also addressed the need for technology officers, information security officers and legal counsel and other executives to work together to address growing threats, instead of operating in silos.

The Data Protection World Forum, which organized the event, is based in London and offers information on privacy, security and data protection and hosts events in London, Dublin and the U.S. that are attended by more than 10,000 delegates. The New York event was its first in the states. Its online publications receive 50,000 visitors per month. Its launch director and founder is Nick James, who was previously senior vice president for a Daily Mail and General Trust acquisition in North America, according to the company. 

Read More:

Preparing for the New Data Breach and Security Requirements Under the New York SHIELD Act 

Cybersecurity Insurance Regulation: Pitfalls and Best Practices 

As Cyberattacks on Business Grow, General Counsel Are 'Thirsty' for More Details 

How Much Will Be Enough? Third-Party Diligence Under the NYDFS Cybersecurity Requirements