July has been a busy month for privacy penalties. From Facebook Inc.'s $5 billion data privacy fine and Equifax's $1.4 billion data breach class action settlement, to the U.K. proposing fines for Marriott and British Airways, companies should be more aware of the gravity of data privacy enforcement.

Part of avoiding such fines is also being aware about how to properly transfer data outside the company. While jurisdiction is key to understanding exactly what is needed to make your data transferring compliant, there are some universal things every enterprise can do to limit their  risks. Here's a look at five ways to ensure safer data transfers.

|

Examine Your Cloud Processing

Relativity global risk and compliance director Lynn Engel advises companies to thoroughly consider the type of data they are putting in the cloud and how it's being managed.

“This includes who is allowed to transfer it,” Engel says to Legaltech News. “Have they been trained on how to handle personally identifiable information as required by General Data Protection Regulation (GDPR) and other locally applicable law?”

Engel also notes that the GDPR's data transfer requirements are applicable to data transferred for e-discovery and other aspects of litigation.

|

Use Encryption With Transfers

Balch & Bingham partner Brandon Robinson says encryption is key to transferring data, though he acknowledged the technology can be costly.

Still, many state data breach notification laws have liability exemptions for encrypted data if it is received by an unauthorized party that doesn't have the key to access it, he notes. “You get a lot of bang for your buck with encryption,” Robinson says.

Likewise, Robinson says encrypting sensitive data that's transferred or stored internally is one of the quickest and easiest data privacy steps a company can make.

|

Implement Data Handling and Minimization Policies 

“I think the default is to retain the data forever. We never know when will need the data,” Robinson acknowledges. Still, he says that is a habit companies should break to decrease the amount of data that could be breached when transferred. He suggests leveraging an automated, scheduled task of deleting unneeded data.

What's more, “purpose minimization” and a data privacy policy are also important when transferring data, Robinson adds. Purpose minimization provides documentation of the data subject's consent to use their data for specific purposes. In turn, that document creates not only a record of consent but a reminder to the company of how that data should be used.

Likewise, a data privacy policy establishes a procedure for safeguarding data for internal and external use, documentation that could be useful if concerns or litigation arises. “Build into your process not just a good data privacy process but the documentation you need if there is an audit, question or lawsuit,” Robinson says. 

|

Remember: Location, Location, Location

The GDPR may be a massive data regulation that governs 28 European Union member-states, but companies based in or transferring data to other countries such as Brazil or China must remember to heed those countries' local data regulations as well. Likewise, while the U.S. doesn't have a nationwide data regulation, more states are enacting data privacy laws that may vary in content but pack a sizable penalty if a company doesn't comply. 

“I think even internationally, as you are thinking about your processes for transferring data, you also have to have a step in there that you are aware of the law where the recipient of the data will be,” Robinson says.

Engel echoes that sentiment, but notes companies should also be aware of where their data centers and their backups are located.

|

Ensure Accountability

Robinson believes it's important for every company to have a commitment from their personnel to ensure compliant data transfers.

“Part of accountability is you have someone in your organization that is being held accountable and is authorized to make sure the data is transferred securely,” he says. “Someone in the organization that wears this hat and [ensures] this data isn't going to be transferred without approval or a process to ensure [it's at] a sophisticated level.”