Data Privacy Today: Pitfalls, Strategies and the Future Ahead

In a world where majority of businesses are moving or have moved towards the digital, consumers and organisations are conducting majority of their transactions on the world wide web. 

At the same time, as has been highlighted by the recent World Economic Forum – Global Cybersecurity Outlook 2024 report, cybersecurity and data privacy are some of the top risks for boards and organisations worldwide.

On one hand, organisations are looking at collect more and a wide variety of data for their consumers to utilise innovative analytics and data crunching and provide focussed services and capabilities to their customers. At the same time, they run a serious risk of reputational, compliance and revenue impact if the data is mismanaged or is impacted / breached in the event of a cyber-attack, insider threat or an accidental action. The globalisation of businesses and the digital economy has led to increase in cross-border data flows and regulatory complexities for all organisations.

High-profile data breaches across the world and increased media attention have raised public awareness and concerns about data privacy. Individuals are now more conscious of their digital footprint and are demanding transparency, control and protection over their personal data, prompting organisations to prioritise privacy measures for their customers.

“The way organisations manage data privacy today has a direct and long term impact on how reliable and trustworthy consumers see them as.”

As evident, this can have a direct impact on the organisation’s revenue, competitive standing and long term strategic goals.

Over the past decade, data privacy has undergone significant transformations, driven by technological changes, regulatory developments, and shifting attitudes towards privacy. The introduction of landmark regulations such as the EU's General Data Protection Regulation (GDPR) in 2018 ushered in a new era for data privacy governance. This change imposed stringent requirements on organisations regarding data collection, processing and protection focussing on compliance and accountability. 

The evolving cyber threat landscape, characterised by sophisticated cyberattacks, ransomware incidents and nation-state-sponsored espionage, poses significant risks to data privacy for organisations and individuals alike. Cybersecurity incidents such as ransomware and data breaches intersect at various critical junctures, reflecting the complex interplay between cybersecurity incident management and the protection of sensitive information. In the context of data privacy, maintaining data integrity is essential for upholding trust and confidence consumers have in the organisation's ability to protect their personal information.

Australia's data privacy landscape is undergoing significant evolution and is being shaped by regulatory developments, technological advancements as well as and shifting consumer expectations. Despite robust privacy regulations, Australia faces challenges in effectively protecting individual privacy rights. Concerns persist around data breaches, surveillance, data sharing practices and the collection of personal information for targeted advertising purposes, prompting calls for stronger enforcement, transparency, and accountability measures. As the country navigates the complexities of the digital economy and addresses the evolving privacy risks, cyber leaders must proactively collaborate to uphold privacy principles, ensure safeguarding consumer data and most importantly work towards fostering a culture of privacy-consciousness in line with international standards and best practices.

The pitfalls

While new technologies offer organisations and customers avenues to reach farther, faster and access new economic opportunities, there are some significant pitfalls which necessitate cyber leaders today to take specific proactive steps in managing data:

1. Cybersecurity data breaches: The digital infrastructure vulnerabilities as have been shown by the cyber-attacks and data breach incidents continue to be an ongoing concern. From ransomware attacks crippling critical systems in the IT and OT sectors to large-scale data breaches compromising sensitive information of millions of individuals, the cyber defense lapses pose significant threats to data privacy. Human errors, insider threats, new technologies threatening  encryption protocols and lack of sufficient data movement visibility further amplify these risks
2. Usage of data by third parties: While data sharing provides new opportunities for collaboration, it further complicates privacy risks as the data exchanged between entities may be subject to exploitation or misuse. Clarity and transparency regarding data sharing practices in addition to appropriate contractual governance measures heightens concerns regarding data sovereignty and accountability
3. Complicated regularity landscape: The continuously evolving landscape of data privacy regulations such as the General Data Protection Regulation (GDPR), presents a complicated compliance challenge for organisations, especially those operating across multiple jurisdictions. Non-compliance to requisite compliance requirements exposes businesses to fines but most importantly erodes customer trust, tarnishes brand reputation and potentially has a long term competitive impact in the market. Meticulous end to end data visibility, governance practices and transparency in data handling processes is the need of the hour for every business
4. New technologies and devices: Every consumer today is using or is surrounded by multiple smart devices from watches to home assistants. Personal data, including end user browsing data, purchase history, usage habits as well as authentication information such as biometric data is leveraged consistently today for targeted advertising and profiling. While huge amounts of personal data is being generated and shared across multiple systems for commodification, data ownership, management consent and security vulnerabilities continue to pose a serious challenge to privacy management
5. Lack of end to end Risk Assessment and data governance practices: Failure to ensure thorough risk assessments may result in overlooking potential vulnerabilities and threats to data privacy. Without a clear understanding of the organisation's risk landscape, cyber and risk leaders may fail to allocate resources effectively and prioritise mitigation efforts
6. Insider Threats and awareness: Insider threats remain a serious challenge. Neglection of employee training and awareness could leave organisations vulnerable to inadvertent data breaches, social engineering attacks, or malicious insider activities
7. Misalignment with business: Cyber leaders must ensure alignment of data privacy initiatives with business objectives and risk appetite. Continuous business and privacy impact assessments are a critical control. Failure to communicate to the business the value of data privacy may result in limited resources, conflicting priorities, and insufficient support for data privacy efforts
8. Cyber insurance coverage: Cyber insurance policies often include coverage for expenses related to data breach response, management and regulatory fines. However, the extent of coverage may vary depending on various factors. These are adherence to cybersecurity best practices, assessment against industry standard guidelines and frameworks, data privacy management efforts and incident response planning. Insurers may scrutinise organisation data privacy practices and incident response capabilities when underwriting policies or processing claims

Strategies for data privacy management

“Every cyber leader plays a key role in safeguarding data privacy today while adopting a proactive approach tailored to the dynamic threat landscape we face today.”

Key strategies in a cyber leader’s arsenal include:

1. Privacy by Design approach: Integrate privacy considerations into the design and development of applications, systems and processes from initiation to implementation. Adopt anonymisation, technologies which assist or support privacy-enhancement and most importantly ongoing privacy impact assessments (PIAs) to embed privacy by design principles and mitigate privacy risks proactively across the enterprise
2. Third party Risk Management: Assess the data privacy practices of third-party partners, vendors and service providers through an ongoing governance processes and strong contractual agreements. Ensure clear expectations regarding data handling are communicated and agreed including data security protocols and incident response procedures to ensure appropriate management of risks associated with data in outsourcing and external collaboration
3. Technical controls: Implement encryption and robust access controls measures to protect data in transit and at rest. Implement multifactor authentication (MFA), role-based access controls (RBAC), and principles of least privilege across the enterprise to enhance data confidentiality, integrity as well as availability and limit unauthorised access to customer and organisation data. Implement robust monitoring tools and governance measures to detect and respond to unauthorised access, anomalous activities, insider threat events and / or data breaches in real-time. Vulnerability assessments and penetration testing across IT and OT environments is another critical control that should be driven across the enterprise. Invest in techniques and tools that enable data anonymisation, pseudonymisation and de-identification to minimise the risk of re-identification and unauthorised access
4. Process controls: Implement appropriate organisational processes for data classification to categorise data based on sensitivity levels and align appropriate controls for access, transmission and storage based upon the classification levels. Implement data lifecycle management process to enforce data retention policies, data encryption and minimisation principles and secure review and disposal procedures based on a defined criteria. Internal audit is another critical process and governance control in data privacy management
5. End to end Risk assessment: Conduct end to end risk assessments across the enterprise to identify potential vulnerabilities and threats to data privacy. This should include assessment of critical processes, third-party partners and vendors as well as the technology landscape to proactively identify and mitigate risks. Ensure ongoing reporting to senior management and tracking actions as part of governance
6. Develop, train and test response plans: Develop and update organisation wide incident response procedure and plans focussed on identified critical risk scenarios such as data breach, ransomware or privacy incidents. Train employees on response plans and test through tabletop and live exercises to test response capabilities, cross-functional team readiness, internal and external communication responsibilities and identify gaps in incident readiness. Employee training and awareness programs are a critical control and should be enforced to foster a culture of data privacy awareness and drive accountability among employees. Continuous review and monitoring of this control is critical 
7. Governance and Accountability: Ensure effectiveness of data governance process including data classification, access controls, and data lifecycle management. Measure metrics such as data inventory completeness, accuracy of data classifications, and the proportion of sensitive data subject to appropriate access controls to gauge the organisation's data governance maturity and identify areas for improvement
8. Continuous monitoring: Continuously monitor, report and manage the organisation's incident response capabilities and effectiveness in mitigating data privacy incidents, including ransomware attacks, data breaches, insider threats or unauthorised disclosures. Measure and report metrics such as mean time to detect (MTTD), mean time to respond (MTTR) and containment capabilities to assess the efficiency and effectiveness of incident response processes. Implement, monitor and report the completion and effectiveness of privacy impact assessments (PIA) conducted for new projects, initiatives, or systems. Measure metrics such as the timeliness of PIA completion, identification of privacy risks and mitigation measures into project workflows or new initiatives to ensure proactive privacy management and privacy by design approach
9. Review, Report & Restrategise: Develop a comprehensive privacy management metrics dashboard that consolidates key performance indicators (KPIs), risk indicators and compliance metrics to provide stakeholders with visibility into the organisation's data privacy status. Ensure regular review and reporting to analyse trends to senior management and benchmark against industry peers so that you can restrategise, if necessary to drive continuous improvement

Future ahead

As the domain of data privacy continuous to evolve, apart from the various strategies described earlier, there are some key focus areas for cyber leaders for the future:

• Enhancement of data governance practices and frameworks
• Improved customer transparency and consent mechanisms
• Strengthening third-party risk management practices
• Engaging in ethical data collection and management practices
• Proactive regulatory compliance
• Commitment to build trust through improved transparency and accountability

Data privacy as a function has evolved from a peripheral concern to a central pillar of governance, ethics, and trust today. Organisations today are grappling with complexities across regulatory requirements, technological advancements and societal expectations This has necessitated a holistic approach to data privacy management by cyber leaders across the board. 

As data continues to permeate every facet of our lives, the trajectory of data privacy will be shaped by ongoing regulatory developments, innovative technological solutions, and ongoing dialogues amongst privacy practitioners for improved data privacy management transparency, rights and responsibilities.

FOR MORE INFORMATION

To learn more about Data Privacy, contact your local RSM Adviser.