Organizations are still struggling to acclimate to an ever-broadening landscape of privacy laws and regulatory guidance, and not all automation tools may be in the best position to help them just yet. This may be especially true when it comes to tracking the flow of sensitive data within an organization or parsing the nuances of various global privacy laws.

Compliance technology company TrustArc released its new Global Benchmarks Survey on Tuesday, which collects responses from a list of 1,503 participants that includes executives, managers and privacy team personnel. Respondents were asked to identify what areas, if any, were solutions deficient in meeting their privacy needs. "Automating processes" was named by 19% of respondents, placing it at the top of a list that included "ease of administration" (18%), and "tracking how personal data is being processed" (18%).

Hilary Wandall, senior vice president of privacy intelligence and general counsel at TrustArc, said part of the issue may be the complexities of various privacy laws such as the General Data Protection Regulation or the California Consumer Privacy Act. For example, response timelines, exclusions and scope of a data subject access request stemming from France may look completely different for a similar action coming out of California.

"Even if you can automate the workflows themselves, actually understanding the different requirements that can apply and being able to automate that, that's what's harder for an organization," Wandall said.

But to be sure, organizations are definitely using tech of some sort to help facilitate their privacy compliance efforts. Respondents were asked what primary solution they used to manage their privacy program. Overall, among those who responded in the U.S., Europe and U.K., internally developed systems were identified most frequently by 19%, followed by spreadsheets, email or word processing software at 17%.

Old habits die hard, and Wandall noted that this could be another factor hampering the overall use of automated privacy solutions. "Part of what makes it hard is that people are so used to doing things on paper and on spreadsheets," she said.

Survey respondents also appeared to be in some disagreement when it came to the overall effectiveness of technology at satisfying various privacy-related needs. For instance, 93% indicated that risk management was among their top three privacy challenges. However, only 31% of respondents said technology was "very effective" at integrating and aligning with broader risk management initiatives, while 41% said it was "somewhat effective" and 20% were neutral.

It could be that much like data subject access requests, successfully evaluating the risk presented by a piece of data relies greatly on the location of the consumer in question. The EU, for instance, has its own rigorous evaluation standards under the GDPR. Wandall said that the regulation mandates that organizations look at whether the collection and processing of data creates a high risk to the rights or freedoms of an individual, which could trigger a data collection impact assessment.

But while organizations have likely been grappling with the GDPR since it was enacted in May 2018, it would appear that businesses are still wrapping their heads around the CCPA. Only 47% of U.S. respondents and 31% of European respondents indicated that they were "very likely" to be compliant with the new privacy regulation, which took effect in January.

Wandall suggested that at this early stage of the CCPA's life span, businesses may be willing to take the financial risk of a regulatory compliance action as they wait to see how the law is enforced, much like they did with the GDPR.

"A lot of organizations did the minimum of what was necessary to show externally that they have the ability to comply," Wandall said.