Data Server Photo: Shutterstock

As the number of privacy laws increases worldwide, so too does the to-do list of the average IT department, many of which are now grappling with new responsibilities that exist well outside their traditional pockets of expertise.

In fact, Canon’s Office of the Future report found that 59% of the 1,015 IT professionals surveyed felt that the EU’s General Data Protection Regulation (GDPR) and the forthcoming California Consumer Privacy Act (CCPA) have had a negative impact on their organization.

However, the reality may be a little more nuanced. While privacy laws may be placing new burdens on IT departments, the same regulations may also be responsible for bringing a fresh set of tools and more sophisticated technologies through the front door.

“I think IT people see it as a both a nightmare and blessing at the same time,” said Frank Gillman, a principal at Vertex Advisors Group and former chief information security officer at Lewis Brisbois Bisgaard & Smith.

The nightmare part of the equation has to do with the fact that privacy laws such as the GDPR or CCPA are still in relatively early days, meaning that IT departments have had precious little time to adapt to new demands.

Gillman thinks that there’s a disconnect between IT personnel who understand the concept of privacy and those who know how to implement effective policies in tune with the standards required by law.

For example, IT departments traditionally know where all of a company’s servers are located or even how all of the serial numbers on those servers might read. Still the concept of hardware inventory takes on a whole new meaning—and urgency—in light of privacy laws.

“If a machine is compromised, can you within a matter of seconds or less than a couple of minutes identify that machine on your network, quarantine it and remove all threat? That’s what the privacy control would expect,” Gillman said.

From there the work only comes becomes more intricate, requiring a forensic-level overview of every piece of personal data that enters a law firm or organization. Gulam Zade, CEO of the legal IT consulting firm Logicforce, said that while most IT departments generally know where their data is residing, locating a specific piece of information and being able to trace its path through an organization still poses a significant obstacle.

Although there has been an uptick in the number of privacy officers gracing IT departments, a spotty data map isn’t the type of problem that can generally be solved with a new hire.

“What we’ve seen is a lot of organizations are starting to move to either document management or data management systems because those systems automatically track data for you,” Zade said.

And therein lies the blessing. Many of the tools that organizations are using to address their privacy requirements have a broader utility outside of dealing with the GDPR or CCPA, such as setting up mechanisms by which redundant data taking up space on servers can be automatically discarded.

These are the same items to which decision-makers might have previously assigned a lower priority when structuring a law firm or business’ annual budget, but the pressure generated by privacy laws could be giving IT departments more leverage.

“An interesting thing that we’re seeing right now is a lot of IT directors and people in the IT world going ‘finally, they are listening to me,’” Zade said.

Gillman compared the scenario to 2000′s Y2K scare, with the threat of potential disaster motivating companies to make some long-term enhancements to their existing IT infrastructure. But with privacy laws such as the CCPA still in their infancy, it remains to be seen if organizations are pushing their resources in the right direction.

“Everybody looks for the magic bullet but the privacy laws haven’t gone into effect yet so nobody knows what it’s going to be,” Gillman said.