Data Privacy

While legal teams have influence over some of their business' spending decisions, that rarely extends to what privacy technology their organizations purchase, according to the “How Privacy Tech Is Bought and Deployed” survey of 345 in-house privacy professionals conducted by IAPP and TrustArc.

The survey found that only 26% of organizations sought out their attorneys' input on what privacy legal update tools to purchase, while just under 20% did the same with privacy program assessment, data subject consent or data subject rights request platforms. Less than 15% of all organizations gave legal a say in any other privacy-related technology purchase.

Respondent organizations' attorneys were also among the least likely group to use any privacy technology platform as well. Only 26% said their legal teams used privacy legal update tools, while just over 15% used privacy program assessment platforms and data subject access request tools.

On the other hand, the IT, information security, and privacy and data protection teams within respondent organizations were the most likely to have input and use almost all types of privacy technologies.

Almost two-thirds of survey respondents were from corporations, while 10% were outside counsel, and the rest were from consulting businesses or the public sector. Almost half of respondents also came from the U.S., with an additional 40% coming from the EU and UK, and the remaining from Canada, Asia and other regions.

Dave Deasy, TrustArc's senior vice president of marketing, noted there has been a “shift in where privacy [technology] is owned inside the company both from a responsibility and a budget perspective. … Three or four years ago there was much more clear ownership in legal. That is becoming much more distributed across information security and IT now.”

He noted, however, that such a shift has meant more adoption of privacy technology given that “legal departments don't have a technology budget,” whereas the IT side has access to more funds.

However, Deasy pushed back on the notion that legal departments as a whole were overlooked when it came to privacy purchases. He noted that while the survey classified privacy, compliance and legal teams as separate entities, in many companies those functions are all housed under the legal department.

“I think people who are responding that they are in the privacy group, are entirely in the privacy group, but they report into legal. … I think the reality in many companies isn't so black and white.”

Though privacy purchasing decisions have increasingly become the responsibility of in-house IT teams, technology adoption was not all that widespread among respondents.

The most widely-used privacy tools among respondents were network activity monitoring software (65%) and secure enterprise communications (60%). Beyond that, only a minority adopted other tools, such as privacy legal updates and information management (38%), privacy program assessment and management (27%), and data mapping (25%). Even fewer had data subject consent (21%) or personal data discovery platforms (14%).

Deasy said that the overall adoption rates were actually an improvement from years past, and underscored the nascent nature of some privacy technology. “I think if you went back in time five or seven years ago, you would see the adoption close to zero,” he said. He added, “In a lot of cases, the tools didn't seem to exist.”

Deasy also noted that secure enterprise communications and network activity monitoring software had a higher adoption rate because they were typically IT functions and had been in the market for a fairly long time.

When asked what prevented their organizations from adopting privacy tools, most respondents cited a lack of budget as the largest barrier, followed by the need to get manager approval and the immaturity of such solutions. On the other hand, the biggest motivator to adopt privacy tools was the need to demonstrate compliance, followed by the ease of use of such tools.

The report also looked at privacy tech adoption specifically among surveyed outside counsel, which was likewise relatively limited. Slightly under half deployed secure enterprise communication platforms, the most widely used technology for the demographic. Around a third deployed network activity monitoring, incident response and privacy legal update tools as well.

Deasy reiterated that adoption levels are an improvement from the past, but also noted they may be low because such technology can add efficiencies that take away from billable hours. “In some cases, we've seen resistance simply because it runs counter to the business model.” Still, he said that as alternate fee arrangements become more prominent, adoption will likely continue to rise.