Carley L. Herrick, Author at Utah Business

Author: Carley L. Herrick

Carley L. Herrick

Carley L. Herrick is a privacy attorney at Parsons Behle & Latimer and concentrates her practice on data privacy and cybersecurity matters, focusing on the development of privacy policies and procedures subject to International and U.S. data privacy laws. Carley can be reached at [email protected] or 801.536.6707.

In 2020, we saw the California Consumer Protection Act (CCPA) become effective; the EU-U.S. Privacy Shield invalidated as a transfer mechanism under the General Data Protection Regulation (GDPR); and more than 30 state privacy bills introduced during the 2020 legislative session. Privacy requirements at local and international levels are becoming more stringent, and consumers’ privacy concerns are at an all-time high. Here are our 2020 top privacy tips to keep you and your business on regulators’ and consumers’ “nice” list into the New Year. Train Your Employees. Employees were the leading source of security incidents in the U.S. in 2020. Providing periodic privacy and security training is essential to combatting data breaches and protecting customers’ data. If your employees handle personal data, they should be trained on key privacy terms; the general requirements of data privacy laws like the CCPA and the GDPR; and company policies and procedures for keeping personal information safe. Map Out Your Data Companies must understand what data they are collecting, how it is being used and with whom they are sharing it to comply with privacy regulations, respond to consumer requests and manage risk. Investing time and money in a data map that shows all data entering the company and its path around and out of the organization will prove invaluable when managing vendors; responding to access and deletion requests; and identifying cross-border data transfers subject to international privacy laws. Review and Update Your Privacy Policy Providing customers with a concise, accurate privacy policy is one of the most important aspects of data privacy. Review your company’s privacy policy at least annually, and update your privacy policy when the company begins collecting a new type of personal information or starts using personal information for a new purpose not previously disclosed. Properly notify your customers of any material changes to your policy and get consent to the new terms if necessary. Choose Your Third-Party Vendors Wisely You likely use dozens of third-party vendors to assist in collecting, storing and analyzing customer data. Before engaging a new vendor, review its privacy and security policies to ensure the vendor places as much value on data privacy as you do. Typically, you should sign a data privacy agreement with vendors detailing their privacy and security obligations. Utilize Facebook’s LDU Feature To support CCPA compliance efforts, in 2020, Facebook introduced a new feature allowing businesses to limit how Facebook uses your customers’ data. When a business applies Facebook’s LDU feature, Facebook will be prevented from using your customers’ data for its internal purposes. According to Facebook, you can transfer customer data to Facebook without the transfer being considered a sale of information under the CCPA. Conduct Data Protection Impact Assessments The GDPR first introduced the concept of a data protection impact assessment (DPIA), requiring companies to assess risk associated with new projects that are likely to involve a “high risk” to individuals’ personal information. Regardless of whether your company is subject to the GDPR, conducting a DPIA before beginning a new project can help your company better understand the privacy and security risks and take measures to decrease or eliminate risks prior to implementation. Encrypt Sensitive Data Most state data breach laws have a safe harbor under which a company is not required to notify customers or authorities of a data breach if the lost data was encrypted and the decryption key was not compromised during the breach. Consider encrypting all databases holding sensitive personal information like credit card numbers, bank account numbers or Social Security numbers to take advantage of safe harbor provisions. Implement a Data Retention Plan Data minimization is a fundamental privacy principle found in almost all data privacy and cybersecurity regulations. Creating and implementing a data retention plan is essential to lowering storage costs and minimizing security risks. Remember, you can’t lose data you don’t have. To retain certain data for analytics purposes after the retention period has expired, consider anonymizing the data so it is no longer subject to data privacy laws.

Top privacy tips of 2020

In partnership with Parsons, Behle & Latimer.

March 5, 2021