Imagine That IP Law Blog

One month ago, the idea of a meat processing plant as the subject of a cyberattack seems almost inconceivable to the average person. Yet, in early June, JBS, the world’s largest meat supplier, wrestled to resolve a massive breach that shut down parts of its supply chain in the U.S. and Australia. Three weeks before, a similar attack had disrupted the Colonial Pipeline’s computer infrastructure, causing soaring gasoline prices and temporary shortages in the southeastern U.S.

These attacks highlight a vulnerability facing all organizations in today’s rapidly changing privacy environment.

How exposed are you? Are you prepared for the challenges facing business owners today? Consider these three areas when assessing the adequacy of your company’s data protection program and evaluating proper risk management.

Privacy Awareness Training

The number one issue facing companies today is privacy training. There are many reasons to keep company data secure, but a privacy infrastructure is only as secure as its least informed employee. Therefore, an organization must have clear, defined, and adequate privacy awareness training. Threats to privacy range from external sources like hackers to internal sources, such as mishandling data by employees. Aside from criminal costs, consequences arise from mishandling privacy data, including substantial government-imposed fines for non-compliance with the law.

Security breaches also compromise customer trust. Exposing a client to data breaches weakens trust and business relationships may suffer. Training employees on high stakes privacy issues is an imperative baseline to any data protection program.

A broad overview of training covers best practices for interacting with technology, employee responsibility with regard to sensitive data, the rights of data subjects pertaining to their information, and obligations for data breach reporting. However, each organization has unique needs that necessitate privacy awareness training tailored to its industry.

Privacy Compliant Infrastructure

While privacy awareness training is a first step in ensuring compliance with both best practices and government privacy regulations, a company must also consider regularly updating technology and other infrastructure to ensure data and network security and to protect against security breaches. One way to ensure compliant infrastructure is to embrace privacy-enhancing technologies. Examples of such technologies include using Virtual Private Network (VPNs), encrypting data through Secure Sockets Layer (SSL) or similar technologies, and using secure cloud-based architecture to store data.

Privacy Audits

A privacy audit is an assessment tool that ensures an organization's privacy practices are compliant with current laws and regulatory requirements. Every organization has unique needs in terms of its data handling practices and are subject to specific duties and obligations under existing privacy laws. To that end, an experienced data privacy professional assesses the organization's needs and ensures that the organization’s privacy and cybersecurity framework is adequate. An experienced privacy auditor delineates the organization's key risk factors and reviews existing privacy policies on how data is collected, maintained, disseminated, and disposed. An audit also includes a review of risk-management policies and processes implemented by the organization. The audit results in a comprehensive report on the organization's state of privacy compliance, and creates a roadmap of action items need to strengthen the privacy framework.

With increased reliance on user data, combined with constantly developing privacy law, a company must consider its privacy program to stay competitive in the market, and to avoid strict consequences that result from data breaches. Regular and comprehensive privacy awareness trainings and infrastructure updates create a privacy-preserving mindset with an organization, but to ensure best practices, a privacy audit is needed to fully align a data privacy and cybersecurity program with a company’s needs.