In-house legal teams step up on data privacy and security

The data privacy and cybersecurity landscape is evolving to make compliance more consequential for companies by adding triggers that have nothing to do with breaches of people’s personal information, says Andy Lunsford, CEO and founder of cybersecurity firm BreachRx.

The Colonial pipeline data breach in 2021 was one of several incidents that prompted regulators to realize that breaches could be damaging even in a business-to-business (B2B) context that didn't involve the loss of people’s personal information, Lunsford said in a webcast hosted by contract management software company LinkSquares.

“There was no personal information involved [in the Colonial incident], but it had a big impact on people and the economy,” said Lunsford, referring to the ransomware attack that led to a supply shortage at gas stations across the eastern United States. “So, there’s a requirement coming out shortly from the Securities and Exchange Commission that, if you’re a public company and you have a cyber incident of any kind of magnitude, you have a notification obligation to the SEC.”

Lunsford said some B2B companies might be complacent about cybersecurity and privacy because they don’t collect personal consumer information, but there’s a shift among lawmakers and regulators to close that gap. 

“If you weren’t paying attention before, you should start paying attention now, because there are these mandated requirements if you have a cyber incident,” he said. 

False sense of security

Nor can you count on your cyber insurance to be much help. 

There’s a tendency among some executives to think their incident response is largely covered by insurance, but a close look at your policy will likely show you there are a number of gaps that could leave you on the hook for the most expensive parts of responding to a breach. 

“It’s not like a situation where you have a car accident and you get all these things done and you say, ‘Come pay for it,’” said Lunsford. “With this, you have to get approval for every single thing along the way, like an HMO almost. They might not cover all these aspects.”

In a typical policy, the provider might cover the cost of notifying consumers about the incident and of credit monitoring for the consumers impacted, he said. But it might not cover regulatory investigations or contract disputes.

“These could easily be the most expensive part of the fallout,” he said. 

What’s more, many providers won’t cover breaches involving ransomware, which have become the go-to approach for many hackers. Additionally, they won’t cover any cryptocurrency losses.

“Ransomware is usually paid in cryptocurrency,” he said. “So, if you had a payment to [the hackers] in cryptocurrency, it could be a loss that’s not covered. So, you need to be more buttoned up on what a cyber response for your company might look like other than just thinking, ‘I’ll call my cyber insurance provider. They’ll put people on it to take care of it for me.’”

Steep fines

Lunsford said the trend in cybersecurity and privacy laws is to require quicker notifications and higher penalties. 

For that reason, you’ll want to be proactive about knowing what your insurance covers and what other steps you need to take to improve your compliance posture, said Tim Parilla, chief legal officer at LinkSquares. 

“You’re not thinking about privacy every day,” he said in the webcast. “You have to be deliberate in making time and to be a champion. Usually you [don’t act until] you find yourself in an uncomfortable situation and have to remediate. The best way to be effective is to be proactive.”

That means trying to get a handle on what each state requires, if the company does business nationally, and what each country requires if it interacts with people globally, including in the European Union, which requires companies to provide an incident notification within just 72 hours or face a fine of up to 4% of revenue. 

“We’ve seen that dynamic of a short deadline and a penalty based on a percentage of revenue become an international movement in every new regulation that comes out,” said Lunsford. “We’re at a point where we have 181 regulations across the world and it can get expensive for a company to miss these deadlines. If you’re new to this space, you should know that, when you look at what regulations apply to you, it’s not where your company is located; it’s where the data is coming from.”

At a minimum, someone on your team should be certified under ISO 27001, an information security standard, Parilla said.

There’s a good chance other standards, including just for lawyers, will be coming your way, said Lunsford.

The New York State Bar recently passed a continuing education requirement that lawyers take classes in cybersecurity and privacy to maintain your license to practice law. Other states can be expected to follow suit. 

“California and New York tend to be the kind of movers that change these [standards] fastest but then they spread across the country,” he said.      

Companies are collecting more data than ever about their customers and employees, while at the same having to comply with a growing number of privacy regulations both in the U.S. and abroad.

These laws are forcing organizations to create inventories detailing what data they have, where the information is stored and how it’s being processed. 

If this work is undertaken in a manual fashion, it can take large businesses months to complete and be quite costly if outside expertise is needed.

To help organizations with their data cataloging efforts, the legal, governance and risk software provider Exterro recently released its Smart Data Inventory solution.

Company officials said the technology not only quickly provides detailed information about an organization’s data activities, but it also produces regulator-ready reports mandated by privacy laws in the U.S. and abroad.

Overall, the product “forms the foundation of an organization’s privacy compliance program,” Exterro’s Chief Product Officer Ajith Samuel told Legal Dive.

Tracking data usage

Exterro officials said creating effective data privacy and governance programs starts with organizations securing a real-time understanding of the data within their systems, as well as cross-border data transfers. 

The Smart Data Inventory tool provides that type of information to businesses by identifying the data they collect and use, including personal data about individuals.

Additionally, the tool can help users track why they are collecting certain information, who might be receiving that information and where that data is stored and/or used.

In this way, Samuel said the Smart Data Inventory operates like a GPS for a company’s enterprise data landscape.

Ray Pathak, Exterro’s VP of data privacy, added that these functionalities are key because “a company’s ability to meet their compliance obligations is directly impacted by their ability to understand what information they have, where it lives, how it’s being processed and how long they keep it.”

Compliance with regulations

To further aid compliance, the Exterro software provides automated, AI-driven discovery of personally sensitive data and related data subjects. It then highlights which external regulations or internal policies are triggered by these discoveries.

Exterro provided the example of an organization collecting fingerprints from elderly individuals for use in administering health and wellness programs. In the hypothetical use case, at least one individual lives in Portugal and all the data is stored in France.

Based on this information, the Smart Data Inventory would determine that the European Union’s General Data Protection Regulation (GDPR) is triggered because elderly individuals are considered vulnerable data subjects and fingerprints are a special category of data.

Processing personal data with the purpose of administering health and wellness programs also requires an additional assessment, which in this case would be a Data Protection Impact Assessment (DPIA).

As a result, the Smart Data Inventory would flag the processing activity as “likely high-risk” and automatically produce the GDPR Article 35 report as required, according to Samuel.

Furthermore, he said that organizations can use a configurable rules engine to create enforcement triggers for internal requirements that are more restrictive than jurisdictional privacy laws and regulations. 

Data Subject Access Requests

Exterro officials said the Smart Data Inventory also helps customers respond to data subject access requests, known as DSARs.

These requests typically feature the submitter seeking to find out what information about them the organization holds and how they are using such information.

The Smart Data Inventory has mapped more than 600 types of personally identifiable information, known as PII, to categories across multiple global regulations, according to Exterro President and CEO Bobby Balachandran.

“If a DSAR is submitted, Exterro Smart Data Inventory will be able to quickly identify what PII is held, how it’s used and where it is stored, making it easy and efficient to respond to the DSAR,” he said. 

These capabilities could prove particularly useful to companies doing business in California, a state in which employees and job applicants can now submit DSARs in addition to consumers. 

Future-proofing

Additionally, Balachandran and Samuel said Exterro’s Smart Data Inventory can help users “future-proof” their data privacy compliance efforts.

They make this claim because they said the software is continually updated to reflect the latest privacy regulations from around the world.

“Thus, if a law is enacted or an existing one changes that requires a specific report when certain criteria are met, Exterro Smart Data Inventory will automatically include these new requirements, ensuring our clients maintain compliance in whatever jurisdiction they are doing business,” Samuel said.

Employee-related data protections in California’s landmark privacy law take effect in 2023, making it crucial your organization write a retention policy if it doesn't have one, especially if you’re seeing a higher than usual number of workers leave for greener pastures, specialists in the field say.

Much of the focus on the California Consumer Privacy Act (CCPA), enacted in 2018 with amendments set to kick in soon, has been on the consumer side, but starting in January all of the same requirements will apply to employees, Darcey Groden, an attorney with Fisher Phillips, said in an Exterro webcast. 

That means current or former employees can request to know what personal information you have on them and can ask you to delete it.

Especially if you have disgruntled former employees, you can expect to see the law evoked.

“Unhappy employees are more likely to exercise rights related to data requests … whether they left of their own volition or otherwise,” said Constantine Karbaliotis, senior privacy advisor at Exterro. 

Complying with a deletion request will get tricky because you can’t let it force you into conflict with other laws. If you’re holding personal data to meet requirements for tax or other regulatory purposes, for example, you can’t just get rid of the data. 

“An employee can’t use CCPA to force you to break that law,” said Groden. “It doesn’t trump other laws.”

Wide-ranging data

The California law, the first in the United States and which has tougher employee-data mandates than other, subsequent state laws, requires organizations to have a secure process for retaining employee data and to let employees know what you’re retaining, if you’re asked by them, and to delete it if they request that and doing so doesn’t violate other laws. 

In some ways, organizations can expect compliance to be more complicated than with consumer data requests, because on the consumer side, data is typically transaction-related, so as long as you have a process for maintaining transaction data, you can honor a data request relatively easily.

It’s harder on the employee side because the data comes in all types of formats, over long periods of time and is stored in any number of places.

What’s more, much of the data is unstructured, meaning it’s not searchable in a database. Emails, text messages and work products, among other things, can all contain personal employee information but knowing what you have, where it is and so on, promises to be a big challenge.

“Employers often don’t even know what’s out there,” Groden said. 

Third-party use of employee data is another problem area, compounded by HR departments’ typical reliance on outside companies to handle much of what they do.

“Benefits and insurance” are third-party functions, Groden said.

Organizations that are already complying with privacy laws outside the United States, like the General Data Protection Regulation (GDPR) in the European Union, will have a leg up on the California law because these other laws already include employee rights. 

For organizations to which employee-data rights will be new, best practices for compliance start with creating a multi-function task force to write a data retention policy and set in motion a process for inventorying employee data in all its forms. The team also needs to know what other employee data laws are in effect so the process can be built to respond to data requests in compliance with these other laws. 

The California law lets organizations deny an employee request for data if it conflicts with other laws or the data is needed for a legitimate business purpose. But when there is a denial, the data that’s retained can only be used for the purposes related to the denial. That means you can’t use data you’re hanging on to for, say, tax compliance for some other use. 

It’s these kinds of nuances that will make compliance a challenge even for mature organizations that have a good team and process in place. 

“California became the first but it won't be the last” to have this kind of law in place, Groden said. 

As a contract lifecycle management provider, LinkSquares holds a lot of sensitive customer information.

In light of that reality and the growing number of state-level data privacy laws, LinkSquares Chief Legal Officer Tim Parilla said his company takes data privacy very seriously.

“The way that we think about our customers' information is that contracts are right up there with Social Security numbers as far as needing to protect them,” he said.

Parilla recently shared with Legal Dive several overarching best practices for in-house legal teams responsible for helping their companies operationalize data privacy initiatives.

Evaluating your data

An important initial step companies should take is assessing the type of data they possess and collect.

This inventory helps a legal team determine the company’s level of risk if a data breach were to occur, as well as the laws and regulations they need to comply with regarding data storage and breach notification.

For example, a company that gathers email addresses and usernames has a much different risk profile than one that collects banking information and social security numbers, Parilla said. 

A key determination that legal teams need to make is whether their company is in possession of personally identifiable information or what in some jurisdictions is referred to as personal information. This could include credit card, driver’s license and home address information. 

Breaches or suspected breaches of personally identifiable information typically require notifications to those customers who may have been affected, with some states also requiring the provision of services such as credit monitoring to impacted consumers.

Identifying allies and forming teams

Parilla said an important second step for a legal team is identifying other departments and employees who will be key allies in carrying out data privacy initiatives.

These collaborators will normally include personnel from the IT department, product engineers and sometimes compliance professionals.

“If you have your legal team, your IT team, and you have your engineers, you have a pretty good start for the people who need to really be bought in and be stakeholders in your security and your privacy program,” Parilla said.

He said these teams should meet on a regular basis to discuss key data privacy action steps, such as any security certifications it would worth seeking from outside organizations.

The action steps should include conducting a gap analysis to help cross-functional teams determine where they are today in terms of data security and what they need to do to enhance their efforts.

“Probably the best way to actually start to implement a plan is to appoint leadership and then do that gap analysis,” Parilla said.

Practice makes perfect

It’s also essential that the leaders of data privacy programs ensure their efforts are ongoing, rather than set-and-forget initiatives, according to Parilla. 

One way to keep privacy and security top of mind is to do regular tabletop exercises in which key personnel go over their roles in the case of a data breach.

Fire drill-type scenarios in which little to notice is provided about a potential breach can also help companies review how quickly they mobilized and communicated.

Parilla said if legal teams and their colleagues are well prepared to “contain, remediate, focus on relationships and understand [their] legal obligations,” they are well-positioned to deal with data breaches.

“It's not only how you respond to contain the damage, it's how you respond to maintain the relationships with your customers who are affected,” he said.

When it comes to evolving privacy restrictions, corporations should be careful what they wish for.

Digital technology inherently develops fast; the federal government, also inherently, tends to move slow. This inertia stifled consumer privacy concerns. So as corporations sought clarity on privacy issues, various states stepped in to fill the regulatory vacuum. The result: vexing confusion.

For example, California, New Mexico, Maine, and Virginia already have significant consumer privacy laws. New York, Massachusetts, Maryland, and Hawaii have new laws in the works. Nearly 25 states are at various stages of the legislative process, ranging from holding out altogether to playing the waiting game.

This patchwork approach creates a daunting challenge for any organization with a nationwide footprint to navigate. It’s already making a significant impact on the administrative and financial overhead of compliance professionals, as well as their organizations’ potential exposure.

Recently, as corporations sought additional clarity on privacy issues, the feds stepped in. The result: more vexing confusion.

The Situation (for Now)

For starters, the Biden administration made its changes through an executive order instead of through the legislative process. Such orders work through federal agencies rather than court-enforced legislation. This gives regulators the authority to enforce policy goals. But if the past is any guide, if the White House switches parties, the next two paragraphs would vanish with the stroke of a pen.

Still, President Biden’s executive order issued last July, “Promoting Competition in the American Economy,” is currently in force, and it does link anti-competition inquiries in merger situations to data privacy.

The order’s stated aim: “…to enforce the antitrust laws to meet the challenges posed by new industries and technologies, including the rise of the dominant Internet platforms, especially as they stem from serial mergers, the acquisition of nascent competitors, the aggregation of data, unfair competition in attention markets, the surveillance of users, and the presence of network effects.”

Biden’s appointments of “tech foe” Jonathan Kanter as antitrust chief at the Department of Justice and of Lina Khan as chair of the Federal Trade Commission underscore this more aggressive posture.

As a result, pre-merger due diligence and second requests will involve far more regulatory scrutiny. We expect acquiring entities will be forced to undertake more effort to ensure they don’t run afoul of the additional regulatory oversight.

What to do now (No matter what)

As regulatory enforcement increases, seminal cases are litigated, and even more states enact privacy regulations, a federal standard will become more likely. The implications of any federal legislation for businesses, especially those for whom personal data is a significant asset, could be enormous for the unprepared.

Given the uncertainty created by this collision of unknowns, companies should protect themselves on the privacy front. Specifically, organizations should assess their data management processes, workflows, and controls to ensure their compliance protocols stay robust.

Let’s start with companies preparing for mergers and acquisitions. Regulators are increasingly observant about compliance infringements, while acquiring companies are under pressure to ensure they do not inherit historical privacy issues and liabilities.

Federal Trade Commission (FTC) oversight in merger enforcement has been intense in recent months. Describing 2020 as “a fiscal year like no other,” the FTC recorded its busiest merger enforcement year since FY 2001; multiple actions were amended or abandoned even before the second request stage.

As pre-M&A due diligence grows more intense, privacy compliance will inevitably move closer to center stage in transactions. Failures in compliance can lead to collapsed deals or substantial reductions in purchase prices. Also, as more states customize their privacy legislation, we can expect even more compliance challenges.

Not expecting any M&A activity? There’s still work to do:

- Start with rigorous data retention policies dealing with employee data in case of Data Subject Access Requests (DSARs). These will inevitably become more common due to compliance with the EU’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCCA).

- Expand your focus. Now is the time to put workflows, processes, and data management in order and ensure they are built to accommodate future changes.

- Monitor regulations on the state level. Though juggling state-by-state privacy compliance laws is not impossible, companies working in more than one jurisdiction will need to pay particularly close attention to their data to maintain compliance. While large companies have the capacity to devote resources to the problem, they will need to allocate additional resources as more states introduce their own privacy legislation.

- Keep up with the debate in Washington. The professional and organizational implications of a federal privacy law could also have direct implications for companies’ technology and security requirements, since it will necessitate intensive collaboration between IT, data management, information governance, compliance, marketing, and legal teams. The intensity of the impact will depend on whether there is a size-of-business threshold regarding the imposition of these requirements – and whether the organizations affected are ready. 

- Ask for help when needed. Since the privacy compliance field will remain challenging, if in doubt bring in expert help. For example, by enlisting law firms or alternative legal services providers like Level Legal that specialize in data privacy restrictions, organizations can anticipate whether those matters will in fact lead to litigation or fines and can brace for the inevitable shifts to come in this most complex of environments.

- Hire a chief privacy officer. CPOs help organizations foster a culture of privacy, in which privacy truly becomes a prime focal point of the company’s mission and daily operations.

While the present is confusing and the future uncertain, the more corporations address privacy restrictions proactively today, the less risk they will be forced to respond reactively tomorrow.

When companies fall victim to cyberattacks, the prior actions of their general counsel or chief legal officer to protect important data often draw close scrutiny from other executives and the board.

Company leaders typically want to know whether legal department officials with oversight of data security took reasonable steps to safeguard business and customer information, as well as ensure cybersecurity systems in place were operating effectively.

Danielle Sheer, chief legal and compliance officer at Commvault, said her data management company recently released a product that could help legal department leaders more effectively defend their organizations against cyber intruders.

The offering known as Metallic ThreatWise uses decoys to bait bad actors into engaging fake resources, which prevents them from reaching their intended targets and compromising data.

“Everybody at this point should assume bad actors are going to get it in,” Sheer told Legal Dive. ThreatWise “sets up traps for them so that we can get an early warning that they got into the system and [then] shut everything down.”

Immediate notification

Sheer highlighted that there are hundreds of millions of cyberattacks annually, and ransomware attacks are on the rise. 

Meanwhile, an attacker sits undetected within a network an average of 146 days, according to Microsoft’s Advanced Threat Analytics.

Sheer said those figures emphasize the need for companies to implement a tool such as ThreatWise that provides immediate notification to key business stakeholders when a bad actor engages a fake resource. This allows for countermeasures and remediation efforts to be initiated quickly.

She said ThreatWise alerts are much preferable to the ones GCs and CLOs fear getting late at night about a successful cyber intrusion.

“How great would it be to get a call in the middle of the night that says, ‘The ThreatWise alarm went off. We were able to stop [the attack]. We know the three files that were accessed, and they were all bait,’” Sheer said. “Versus, ‘Somebody's in the system. We don't know what's going on. We're going to get a team together. Put a strong pot of coffee on.’”

Communicating successes

Sheer advises legal teams and other departments responsible for data protection to be transparent when a threat is stifled in the same way they would notify company higher-ups when a data breach has occurred.   

The lessons learned from these events should be shared with internal stakeholders, including the executive team and company board committees that oversee risk.

“We ask our boards to invest a lot of money in cybersecurity and in security programs in general,” Sheer said. “It's really important to show them when it works.”

The ThreatWise product is part of the broader Metallic SaaS portfolio providing enterprise-grade data backup and recovery.

ThreatWise’s sensors are invisible to legitimate business users and systems, so interactions can only come from a malicious source, according to Commvault.

Sheer said she expects the product will continue to evolve to best protect users against bad actors.

“They're not going to stop trying to find new ways through,” she said. “We have to do everything we can to try to stay one step ahead of them.”

Data privacy regulations and privacy risks are evolving. From the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act to the patchwork of upcoming state privacy laws, companies go to great lengths to stay ahead of developments to minimize legal risk while continuing to promote innovation.  

And did we mention the prospect of a federal privacy law? Companies are left struggling to meet what feels like a moving target. Gone are the days when data security and privacy could be addressed in independent silos within limited segments of a business, or treated solely as IT issues.

Instead, many organizations, typically led by legal counsel, have found that the key to developing a data security and privacy infrastructure with lasting impact is by taking an enterprise-wide approach. 

Here are some practical issues for understanding how and why to develop an enterprise-wide infrastructure and the best practices we’ve identified for general counsel’s role in this process. 

Who should be at the table

Organizations approaching security and privacy as technical issues consistently fall short. A comprehensive data security and privacy infrastructure is much more than IT controls and policies in the background governing password management and encryption. Given the changing legal and regulatory landscape, you need to have a conversation beyond information security – and to do that you must understand the input and output of data. 

It’s crucial all key stakeholders are part of the conversation. In addition to general counsel or in-house counsel, you want your leaders in the effort to include representatives from human resources, information technology, information security, compliance, marketing, communications and operations.  

Identifying the right people from across the organization who can provide insight and identify areas where data security and privacy intersect with their day-to-day responsibilities is necessary for the growth and sustainability of the program.

Governance structure

It might sound elementary but understanding who is doing what within your data security and privacy framework is key to success.  

You need to take a hard look at resources, people’s roles and responsibilities, and what gaps in governance exist. Is a data protection officer under GDPR or other regulations legally required, or is a privacy officer sufficient? Will the organization identify data owners, with corresponding responsibilities? Developing infrastructure with clearly delineated roles and responsibilities is key to the lasting success of the program.

Legal and regulatory obligations

As a lawyer, we’re trained to understand the rule that applies before we apply that rule to the facts of a case. The same approach is warranted in understanding your data security and privacy obligations. Conducting a privacy regulatory assessment that evaluates current and upcoming jurisdictional requirements is a fundamental starting point for building a roadmap to address data security and privacy requirements. Does the GDPR apply to your business? Are you doing business in California sufficient to bring you within the scope of that legislation?

Once you have an understanding of the laws and regulations that apply to your business, the next step is understanding what your program looks like and what, if any, gaps exist based on these requirements.

Data map

Whether you like it or not, many organizations collect and process a tremendous amount of data. Data increasingly drives what we do to grow our business daily, even if you are not in a traditional data industry. It is key to ask: what data do you have and collect, for what purpose is it being processed, and how is it being shared?  

Developing a data map is a key ingredient to understanding the flows of data in and out of the organization and is critical for complying with state, federal and international privacy laws. The data map will serve as the foundation for a number of your organization’s policies, including your website privacy policy, data subject access right policy and management of your data retention.

Incident response management

Preparing for a potential data breach or cybersecurity incident should be a top priority for every business. The threat landscape requires you to shift your perspective on cyber threats from “if” to “when” as you examine preparedness, protocols and employee education. 

Creating a detailed incident response plan is a necessary step in this process, but a response plan is only as effective as its execution.  

Testing your plan annually helps to identify vulnerabilities, improve coordination and communication and is a cornerstone best practice for all companies – and a requirement in many regulated industries under some cyber insurance policies and for certain government contractors. And don’t forget to print a hard copy of the plan in case access becomes limited during an actual or suspect event. 

Culture change

We may have heard it before, but training is the key to improving employee engagement overall and truly impacts the data security and compliance culture within an organization.  

The fact is, many of today’s cyber threats are a result of human error, making end-users of company systems incredibly relevant to overall company security. Providing the training and raising awareness among staff members about the types of security threats that target them directly should be at the top of every security investment.

Further, raising awareness across your organization about the importance of cybersecurity and privacy requirements is a fundamental aspect of building out your enterprise-level infrastructure.  This includes onboarding and implementing annual programs that train and raise awareness about the types of common security threats that target employees (such as phishing attempts), as well as how to identify common security threats.

Conclusion

As we often share with clients, Rome wasn’t built in a day; and, neither will your privacy and security infrastructure magically appear. But building a scalable, sustainable enterprise-level data security and privacy infrastructure should be a priority for every organization regardless of size. 

The challenges presented by the current legal and threat landscape aren’t changing anytime soon, so it is vital for every organization to put in place a compliance roadmap that is right-sized for their resources, team size and jurisdictional reach. Beginning today, even with just initial internal discussions, you can start down a critically important path to minimize legal risk in this increasingly technology-driven world.

Traditionally, data privacy regulations were principles-based and would result in companies determining how to best implement the principles across their organizations. 

In more recent years, however, regulators have begun moving away from principles-focused regulations to specific technical requirements.

This shift should prompt privacy professionals, including those working under the umbrella of in-house legal departments, to more closely collaborate with their engineering colleagues, said Brandon Wiebe, general counsel and head of privacy at the privacy platform Transcend.

“Because these regulations have gotten so much more specific and technical, privacy organizations really need to have a direct line of sight into the way these rules are actually implemented throughout the tech stack,” Wiebe told Legal Dive.

Workflow involvement

Wiebe joined Transcend from Twilio in May and said at the time that he had seen firsthand “how privacy compliance continues to evolve from policies to complex technical implementations.”

As a result, he recommends that legal teams’ privacy personnel be involved with engineering workflows to ensure that privacy management practices are incorporated when products are being built.

This approach could include privacy professionals performing privacy impact assessments for new products that are in development. These assessments ideally would be added into the product requirements documents known as PRDs, he said.

“Getting in early and being part of that product development or engineering process goes a long way to making sure that privacy controls are technically implemented early on, so that you don't have to retrofit privacy after a product is already built and shipped,” Wiebe said.

Privacy teams should also work with UX teams when they are designing opt-in and opt-out website banners to ensure they comply with dark patterns requirements, he said. Additionally, these types of collaborations will help companies comply with data sharing requirements under the California Privacy Rights Act (CPRA).

Education

Wiebe acknowledged that employees working on the privacy side, including lawyers, are sometimes hesitant to converse with company engineers because of a fear of not being able to communicate about technology in terms both sides understand.

He says privacy professionals should make the effort to gain additional knowledge about key technologies so they can more easily converse with engineering and product colleagues and break down this divide.

Wiebe called this approach meeting engineers and product personnel “where they are,” which will better equip organizations to ensure they are in compliance with important data privacy regulations.

“I think based on the regulations, we’re effectively required to develop really positive relationships with these teams and find a way to work really closely with them,” he said.

Government enforcement

Wiebe pointed to an enforcement action in California in recent months as one example of the type of technical privacy requirements necessitating the need for privacy professionals to work closely with engineers.

California Attorney General Rob Bonta alleged that Sephora failed to disclose to consumers that it was selling their personal information and failed to process user requests to opt out of sale via user-enabled global privacy controls in violation of the California Consumer Privacy Act (CCPA).

As part of a settlement requiring Sephora to pay $1.2 million announced in August, the multinational retailer must provide mechanisms for consumers to opt out of the sale of personal information, including via the Global Privacy Control (GPC).

“Technologies like the Global Privacy Control are a game changer for consumers looking to exercise their data privacy rights,” Bonta said in a prepared statement. “But these rights are meaningless if businesses hide how they are using their customer's data and ignore requests to opt-out of its sale.”

Bonta also said he hoped the settlement “sends a strong message to businesses that are still failing to comply with California’s consumer privacy law.”

General counsel will need to work closely with IT leadership to operationalize big changes to California’s Consumer Privacy Act (CCPA) by the start of next year. 

Close cooperation between legal and IT is necessary because some of the most important requirements in the California Privacy Rights Act (CPRA), which was enacted in 2020 to strengthen CCPA consumer protections, specifically link compliance with website and app design.    

“It’s a really interesting concept they’re driving at here,” David Stauss, an attorney with Husch Blackwell, said in a webcast. “They've essentially bundled the [enforcement] concepts with design aspects.”

Increased privacy focus

CCPA was enacted in 2018 following passage of the European Union’s sweeping General Data Protection Regulation (GDPR), which seeks to give consumers control over how organizations use personal information. 

CPRA builds on CCPA by introducing a novel concept – sensitive personal information (PI) – and also by imposing new requirements around the sharing of data. The new law also takes aim at what some in the privacy field call dark patterns by requiring digital environments to stop using ambiguity as a tactic to discourage people from opting out of protections.   

Although CCPA and CPRA protections apply only to California consumers, the infrastructure that organizations build to make their websites and apps compliant will be the same infrastructure any consumer interfaces with, no matter where they are. What’s more, other states, including Virginia, Connecticut and Colorado, are mandating their own privacy protections, making it difficult for organizations to operate digitally without following these states’ privacy laws.

Design considerations

CPRA’s attack on dark patterns is a key reason compliance and design are interwoven. The term refers in part to organizations’ efforts to manipulate consumer behavior by creating asymmetric navigation paths – paths that favor an organization’s use of personal data over the consumer’s preferences. An example is an organization sending consumers to its privacy policy rather than an opt-out button when consumers click a link to limit the use of their personal data. Although the opt-out button is included in the privacy policy, it’s left to consumers to scroll down until they find the link to click.

Another example is the way organizations tweak design to discourage consumer opt outs. For example, instead of giving consumers two identical choices – either to opt out or opt in – organizations give an asymmetrical choice – either to opt in or learn more about privacy. Only when they click on the “learn more” option are consumers given the opt-out choice.

“They’re looking to hold businesses accountable for designing ways to discourage users from exercising their rights,” Stauss said. 

Sprinkled throughout CPRA are design requirements that organizations must follow, limiting the flexibility of IT leadership in making technical changes. There’s little flexibility, for example, on deciding how, where and what kind of links the organization uses to direct people to their privacy policy.

“For websites, the link needs to appear in a similar manner as other links that the business uses on its home page,” said Shelby Dolen, an attorney with Husch Blackwell. “For example, they must use the same font size and color as any of the other links.”

Data Sharing

To deepen protections, CPRA introduces a concept, sensitive PI, and builds on CCPA limits on the selling and sharing of data by adding a requirement that organizations confirm, on the website and in an app, that they’ve acted on a consumer’s opt-out choice. That means if a consumer clicks a button opting out of having their sensitive PI shared with a third party, the organization must respond with confirmation they acted on the request.

“This is stuff businesses are going to have to look at and say, ‘How do we operationalize these concepts?’” Stauss said.

Sensitive PI includes consumer driver’s license and Social Security numbers that organizations collect and store, typically as part of transactions. 

What makes this technically difficult is that systems and processes must be in place, as part of the behind-the-scenes operational infrastructure that's needed for organizations to be able to confirm a request on a website or in an app.

For consumers who choose not to allow third-party data sharing, for example, the organization must be able to show, through a radio button or a toggle switch, that the request has been complied with. Behind the scenes, a process must be in place that automatically blocks off the consumer’s data from sharing while also pushing down the request to contractors, service providers and third parties. 

Rights to know, delete and correct

Similar underlying technical changes are needed to comply with a CPRA requirement that organizations be able to correct sensitive PI and not just delete it at consumers’ request.

To comply, organizations must create a process for accepting and evaluating information that consumers provide showing that their stored data is incorrect and then for correcting it and confirming to the consumer that it’s been corrected. Organizations have 10 days to acknowledge receipt of the request and 45 days to address it.

Addressing it includes pushing the request down to service providers, contractors and third parties. 

In cases where correcting the information isn’t practically feasible, or takes a disproportionate effort to correct it, organizations must let consumers know why it’s not feasible. They can also just delete the data as long as doing that wouldn’t negatively impact the consumer.

The option not to correct the data can’t simply be because of the difficulty of operationalizing a process to do it.

“A business that fails to put forth adequate processes to comply with consumer requests can’t then use this disproportionate effort claim,” Stauss said. 

Rush for rules

Compounding challenges for complying with CPRA is a time crunch regulators are working under. The law creates the California Privacy Protection Agency, which is writing the rules fleshing out the new requirements. 

Given time constraints the agency faces for soliciting and reviewing public comments on its drafts, there's little likelihood general counsel will have a finalized set of rules to work against until shortly before the end of the year, leaving little time to comply before CPRA takes effect in January 2023. 

“The regulations probably won’t be ready before the fourth quarter of 2022,” Stauss said. 

Although it’s not clear how much will change between now and then, the draft provides a look at the kind of operational changes general counsel and IT leadership will need to consider as they prepare. 

The Federal Trade Commission is calling out companies' use of so-called dark patterns that trick consumers into subscribing to services they don’t want or giving away data they don’t understand they’re giving away.

The agency says companies have gotten away with the use of deception for a long time but the law is catching up to them. “These practices are squarely on the FTC’s radar,” the agency says. 

In a report it released a few weeks ago, the FTC divides dark patterns into four broad groups: 1) inducing false beliefs, 2) hiding material information, 3) imposing unauthorized charges and 4) subverting privacy choices.

What they all share are design practices that are intended to mislead, like making people think they’re reading a news story when it’s an advertisement or waiting until a customer has already filled out a purchase form to disclose a fee. 

Another dark pattern tries to make it easy for consumers to do what the company wants while making it hard to do what it doesn’t want, a practice typically associated with permissions to use cookies for tracking. 

In a typical case, the opt-in button is big and simple while the opt-out button is accessible only after making the user navigate to another page and search for it in paragraphs of dense legal text. 

“Repeatedly presenting the choices as ‘Yes’ or ‘Not Now’ instead of ‘Yes’ or ‘No’” is a common pattern, the agency says.  

Enforcement tools

Although Congress has yet to pass comprehensive online consumer protection legislation, the agency has a number of statutory tools at its disposal to go after companies, the FTC says.

This includes the Restore Online Shoppers Confidence Act, which targets the use of negative-option subscription charges, and several laws that have been around for decades that can be applied in an online context. These laws include the Telemarketing Sales Rule, which targets misleading pricing practices, and the Truth in Lending Act, which targets deceptive credit charges. 

The Children's Online Privacy Protection Rule, enacted in 1998 to regulate companies’ collection of personal information for children up to 13 years old, is another major tool the agency uses. 

Probably the most comprehensive effort yet to combat dark patterns isn’t at the federal level but is incorporated into the California Consumer Privacy Act (CCPA), enacted in 2018 and amended in 2020. In a direct shot at how companies use design to manipulate people, the law specifically links some of the most important restrictions to how website and app functions look.

“It’s a really interesting concept they’re driving at here,” David Stauss, an attorney with Husch Blackwell, says. “They’ve essentially bundled the [enforcement] concepts with design aspects.”

To get permission to collect data, for example, “the link needs to appear in a similar manner as other links that the business uses on its home page,” says Shelby Dolen, also an attorney with Husch Blackwell. “They must use the same font size and color as any of the other links.” 

Federal legislation

Federal data privacy and security legislation making its way through Congress doesn’t go nearly as far as the California law in mandating design elements, but it does include requirements that opt-in and opt-out choices be presented clearly and in equal measures to prevent steering consumers in one direction over another.

That legislation, which passed a key House committee a few months ago with almost no opposition, is unlikely to pass this year but analysts see it as a rare example of major legislation that can overcome partisan gridlock. 

Separate from that legislation, the FTC report shows, the agency has the regulatory tools to go after companies. 

“Businesses [are] on notice that the FTC will continue scrutinizing these practices,” the agency says.

General counsel working through data privacy rules taking effect in California, Colorado and other states could be facing a new task as lawmakers in Congress step up efforts on a sweeping federal law that would mostly preempt state efforts.

The House Energy and Commerce Committee this week approved the country’s first major data privacy law, teeing up consideration in the House, where it stands a good chance of passing. Efforts in the Senate are more uncertain, but given the broad bipartisan support given the House bill, which passed out of committee 53-2, approval in both chambers is not out of the question.

“We’re more hopeful than we have been in years that a bipartisan privacy bill can make its way to the president’s desk this Congress,” Carl Holshouser, senior vice president of TechNet, said.

The American Data Privacy and Protection Act (H.R. 8152) is largely built around the idea that organizations can continue to track what people do on their websites and mobile apps but only for minimal purposes, a policy the bill calls data minimization. That’s defined as data that’s just enough to accomplish permitted activities and no more. 

The bill identifies more than a dozen such activities, including authentication, security protection and fraud prevention, and transactions.

Organizations can still share data with third parties, with user consent, but only for first-party marketing or advertising. 

That means, if a person shops for shoes on a store’s website, the store could still use that information to show shoe ads while the person is on another website. 

“What it wouldn’t be able to do,” Wired says in its coverage of the bill, “is match your shopping history with everything else you do on the web and on your phone to show you ads for stuff you’ve never told them you wanted. Nor could Facebook and Google continue to spy on you by placing trackers on nearly every website or free app you use, in order to build a profile of you for advertisers.”

What’s more, organizations can’t do any tracking whatsoever of minors.

Consensus approach

There appears to be broad, bi-partisan agreement on the main approach of the bill. Much of the battle to come is over how it will intersect with laws already in place in California and the handful of other states that have been proactive about privacy.

The two no-votes in the House Energy and Commerce Committee were both by California representatives who want federal protections to provide a nationwide minimum standard while allowing states to maintain their own laws.

Attorneys general in the handful of states that have already enacted laws also want the federal bill to provide a floor and not preempt state efforts. 

The bill doesn’t do that, although in a partial compromise, it carves out more than a dozen areas of state law that would be exempt from federal preemption, and, in the case of California, hands enforcement authority to the state’s new privacy protection agency.  

The other main sticking point is the bill’s allowance for a private right of action, which would expose organizations to individual lawsuits over privacy violations, although subject to limits. 

Before people can sue, for example, they have to let either their state attorney general or the Federal Trade Commission (FTC) know, and if they want to sue a small or mid-sized business, they have to give the business a chance to correct the violation first. 

In another compromise with California in mind, the bill delays the private right of action for four years and also allows the state to maintain its private right of action against data breaches.

The agency created in 2010 to protect people from predatory lenders, the Consumer Financial Protection Bureau, says in a policy circular it released last week that it has the authority to go after companies whose lax data management could put consumer finances at risk. 

“Inadequate security for … sensitive consumer information collected, processed, maintained, or stored … can constitute an unfair practice in violation of [the Consumer Financial Protection Act],” the agency says in Circular 2022-04. 

A company doesn't have to have a breach to be hit with an enforcement action, the agency says, because a practice can be considered unfair if there’s a likelihood it can lead to consumer harm, even if the company claims to offset its weak practices by offering a greater good to consumers. 

“The risk of substantial injury to consumers will outweigh any purported countervailing benefits to consumers or competition,” the circular says.  

Enforcement actions

CFPB went after Equifax in 2019 after hackers grabbed information on 140 million people by exploiting a software vulnerability that the credit reporting company knew about but didn’t take action on until it was too late.

“Equifax violated the prohibition on unfairness,” the agency says, “by using software that contained a known vulnerability.”

There’s overlap between CFPB’s authority to enforce against unfair practices and the Federal Trade Commission’s authority under its safeguards rule, authority the FTC has used to go after companies for poor data hygiene. 

The CFPB points to these FTC actions in its analysis justifying its enforcement authority. 

Among other companies the FTC has gone after are online check processor Qchex, which in 2006 made payments to account holders without verifying their identity, and companies involved in data management on behalf of Wyndham Hotels, which in 2012 was hit with breaches that compromised half a million account holders.

To reduce chances of getting hit with an enforcement action, the CFPB recommends companies use multi-factor authentication, employ the latest best practices in password management and be rigorous in patching and updating software – all steps companies with good data hygiene are already doing. 

“The circular does not suggest that particular security practices are specifically required under the Consumer Financial Protection Act,” the agency says. But failure to follow these best practices “might increase the risk that a firm’s conduct triggers liability under the Consumer Financial Protection Act.”

New York’s first-in-the-nation requirement for lawyers to earn data privacy and security continuing education credit is timely now that states are passing laws holding companies to account for the way they manage clients’ digital information, says Lisa Sotto, an attorney with Hunton Andrews Kurth.

Other states can be expected to follow the lead of the state, which in June received a recommendation from the New York State Bar Association to require lawyers to have at least one credit hour every two years covering data privacy and security as either an ethical obligation or from a practice-area or technological standpoint.

“I would expect that other bars would follow suit,” Sotto told Legal Dive. Sotto’s firm specializes in helping clients prevent and manage security incidents and in complying with data privacy and security requirements. “We have 45 people who do nothing but data privacy and data security and cybersecurity. It is our practice 100%.”

Two-track approach

Under the New York requirement, the two training tracks are more specialized than the mandate in most states for lawyers to have some technical competence. Some 40 states impose a duty of technical competence on lawyers, according to a LawNext compilation, but that’s a broad duty that covers knowing how to perform digital tasks. 

By adding this more focused approach, the New York requirement is an acknowledgement that data privacy and security are issues of growing importance to organizations, both from a compliance perspective and from an incident prevention and response perspective.

“A cyber incident is pretty inevitable these days,” said Sotto, whose firm has been brought in to help manage some high-profile breaches, including the Colonial Pipeline breach in 2021 that led to short-term gas shortages in the Northeast and the Yahoo! breach that put half a billion accounts at risk.  

Both in-house legal departments and law firms face an increasingly complex compliance environment. In the U.S., five states have data privacy and security laws on the books: California, Colorado, Connecticut, Utah and Virginia. 

California’s law, which lawmakers amended two years ago, gives consumers considerable control over what data an organization can keep, what controls to maintain for use of the data by other organizations and so on. It even goes so far as to prescribe what consumer opt-out and other types of buttons are to look like.  

The laws in Colorado, Connecticut, Utah and Virginia, which are all based on a similar template, differ from the California law in significant ways, adding to the challenge of complying with the different approaches.

“In some cases we need opt-in consent and in other places you need opt-out consent or no consent at all,” Sotto said. “In some cases there are … exceptions in the right to delete. In other states there are no exceptions. So, [complying] is a complex exercise right now.”

Although it’s unlikely to pass this session of Congress, lawmakers have been working on the first U.S. comprehensive data privacy and security law, called the American Data Privacy and Protection Act, which would provide long-sought uniformity across the country. 

“Everyone wants a federal law,” Sotto said.

Outside the U.S., organizations must comply with the General Data Protection Regulation (GDPR) if they engage with people in the European Union and similar laws in a dozen or so other countries. 

“Having to actually comply with [all these laws] is an issue that is tying lawyers up in knots,” Sotto said. 

At a minimum, the New York requirement is a first step in helping lawyers come to these challenges with a minimum set of tools.