What is data privacy, really, and what tools are required for it?
During the first decade of the 21 century, organizations came to realize the value of the data held in their IT systems. That data could be used to support a variety of organizational goals, including individualized marketing campaigns, improvements to operational efficiencies, and assurance of regulatory compliance. Accordingly, methodologies and tools were developed to manage, maintain, and leverage data, such as data governance, data quality, and data analytics tools.
In the second decade of the century, we have witnessed a growing social and corporate awareness regarding organizations’ use of data. These range from consumers who want to limit the use of their personal data to corporations which require that certain data potentially impacting their reputation or brand be closely managed.
This emerging discipline is called data privacy and it is distinct from data security which focuses on technical methods designed to protect data from unauthorized access.
Three general types of data are addressed by data privacy:
Data privacy regulations are designed to protect an individual’s personal information (PI) – data that can be used to identify the individual – and will be the focus of this discussion henceforth as it is representative of the tools and methodologies required.
The template for such regulations has been the EU’s General Data Protection Regulation (GDPR), effective May 25, 2018, which governs the use of all EU citizens’ data, regardless of where the using organization is located. The California Consumer Protection Act (CCPA), effective January 1, 2020, similarly governs the use of all CA residents’ data, again regardless of where the using organization is located. Other similar regulations are under consideration by various US states.
While organizations located in the EU and CA are clearly impacted by these regulations, they apply more broadly to organizations with consumers from those locations. For example, the Chicago Times website was, for over a year, inaccessible to users in the EU. Marriott, a US-based corporation, has been fined $123M for a data breach under the UK Data Protection Act (similar to GDPR). It is therefore imperative that organizations are in compliance with the relevant data privacy regulations.
