Corporate compliance with an increasing number of industry regulations intended to protect personally identifiable information (PII) has made data privacy a frequent and public discussion. An inherent challenge to data privacy is, as Tamara Dull explained, “data, in and of itself, has no country, respects no law, and travels freely across borders. In the digital age, there are no geographical borders. And yet, most governments have attempted to put restrictions on how their citizens’ data is used. When we hear about foreign issues, we treat them like they’re strange and far away, ignoring the fact that those issues can very quickly come home to roost.” One such example is the pending European General Data Protection Regulation (GDPR).
Not only does data not naturally obey geographical borders – but with the pervasiveness of cloud computing, social networks, mobile devices and the Internet of Things, everything is connected, in motion and data-infused. All of that increases the risk of unauthorized access to sensitive data. This is why data privacy cannot be an afterthought.
Unfortunately, many organizations lack a clearly defined data privacy policy that details exactly what data is to be collected and how that data should be used. The era of big data also seems to encourage an excessive, almost obsessive, collection of data without consideration of its potential uses and privacy implications.
For starters, not everyone within the organization may know what sensitive data the enterprise has and/or where it's located. Part of IT’s responsibility is to make sure all data assets are properly cataloged and then share this information with the entire enterprise. The organization may also lack a well-defined way to identify which data is sensitive and therefore subject to protection.
