Internet-global-business

 

Last week, TrustArc released its 2019 Measuring Privacy Operations survey, which points to compliance only becoming a more challenging task for organizations across the globe to successfully implement into their operations.

The survey's 327 respondents hailed from the U.S., European Union and Canada while working in a variety of sectors that include legal, government, financial services, tech and telecommunications.

One major takeaway? Privacy has become something of a juggling act, with many respondents indicating they were complying with more than one of the many international laws in place along the lines of the EU's General Data Protection Regulation (GDPR).

For example, the largest number of EU respondents (45%) indicated they were complying with between two and five laws, while the same held true among the bulk U.S. participants (37%). By contrast, only 28% of EU based responses indicated that they were focused exclusively on a single law, while 9% of U.S. answers said the same.

"The number of laws that people were trying to comply with was surprisingly large, and I think is just painting the path to where it's going in the future, given that right now U.S. seems to be headed down the state-by-state path," said Chris Babel, CEO of TrustArc.

Per the survey, 15% of U.S. respondents are already complying with 50 or more privacy laws, which stands in stark contrast to the 2% of EU respondents who are attempting the same. If that number seems a little high, Babel pointed out that some U.S. companies have to think about the GDPR as well as the forthcoming California Consumer Privacy Act (CCPA) and any other state laws on the books.

He also emphasized that American culture has traditionally been more litigious in nature, which could be impacting the direction of privacy strategies as well.

"U.S. businesses are trying to focus more broadly on a lot of these laws that effect them as where Europeans are focusing on the law that's closest to them," Babel said.

In terms of the gritty details of those compliance efforts, the survey suggests that many of the operational changes that entities are making are still centered around the basics. For example, respondents were asked to identify privacy operational changes made in the last 12-months, with the majority of both U.S. (77%) and EU and U.K. (85%) indicating that they had updated their website's privacy policy one or more times. Changes to a website's cookie policy was second-runner up among 44% of U.S. respondents and 56% of answers from the EU and U.K.

So why are organizations still working on privacy basics more than a year after the GDPR was enacted in May 2018? Babel thinks some entities are either realizing they didn't comply with a law properly in the first place, are responding to additional guidance that has emerged over time, or are still winding their way through their first go-around with GDPR or CCPA compatibility.

"Many people just start with the things that are visible to consumers because they figure that that's where a regulator might look first," Babel said.

Still, as organizations continue onward with their privacy compliance process, there could potentially be some unintended consequences for future e-discovery projects. For example, 36% of overall respondents said they had decreased data retention time over the last 12-months, while 42% said personal data was being deleted more frequently.

Babel alluded to a need for companies to juggle multiple perspectives on their data, from potential litigation to brand reputation or even breaches.

"To me it's another input in the equation of how you think about retention inside of an organization," Babel said.