While legal departments are well aware of the risks associated with not complying with a patchwork of data privacy laws, it is still important for in-house attorneys to make a business case for data use to help ensure compliance.

A group of in-house attorneys discussed strategies for getting the business on board with data compliance during a webinar hosted by Exterro and the Data Protection World Forum on Tuesday.

Hugo Teufel III, chief privacy officer and deputy general counsel at CenturyLink in Denver, said when he worked in-house at Raytheon Technologies Corp., he would benchmark where his team was and how other compliance areas were managed.

"Privacy is at the forefront, but the staffing and funding for privacy compliance is not yet aligned with what staffing and funding is for other critical compliance programs within companies," Teufel said.

According to data provided by Exterro, 99% of in-house counsel recognize the importance of having a data privacy plan, however, only 1 in 5 in-house legal leaders indicated they have such a policy in place. Rachel Glasser, chief privacy officer at Wunderman Thompson in New York, said breaking compliance down to dollars and cents is the best way to get attention from the business side.

"When someone sees that we could be fined billions of dollars for not responding to an access request, it gets the point across," Glasser said.

When the California Consumer Privacy Act came into effect, many of the company's data processes were manual, Glasser said. After explaining the cost of taking one person away from their revenue-creating job to perform a data access request, the company fixed its data infrastructure to be more automated.

In-house counsel should also be helping to identify ways that data can be used to further drive revenue. Glasser, for example, said compliance often starts with taking an inventory of what data the company has. That can also be used to drive revenue and study data.

"The inventory aspect of this has helped fuel the business objective aspect of this," Glasser said. "You can't make those decisions unless you know what assets you have and what you're working with."

Andrea Ruggieri, vice president of digital and privacy legal at GlaxoSmithKline in London, said her company has been able to leverage data for research and development purposes and insights into health care.

"The business in a couple of cases has come to us and said, 'We need to XYZ with the data' and the data governance side of that was quite important," Ruggieri said.

She said in-house counsel responsible for data governance need to think about how data can enable the business and then consider what the roadblocks they may hit and what they need to see ahead of time.