Culture triumphs in the race to deal with data privacy

Data pri­va­cy has climbed the board­room agen­da in recent years as exec­u­tives are increas­ing­ly alarmed by high-pro­file exam­ples of com­pa­nies that have suf­fered breach­es, result­ing in expo­sure of their cus­tomers’ sen­si­tive, per­son­al­ly iden­ti­fi­able infor­ma­tion.

The last ten years have seen enor­mous data growth. Accord­ing to ana­lyst firm IDC, the amount of data in the world more than dou­bled every two years through­out the decade to reach around 40 tril­lion giga­bytes this year, and the rate of growth will con­tin­ue to accel­er­ate. Dur­ing that time, the data organ­i­sa­tions hold has become some­thing they add to their bal­ance sheets and lever­age to sup­port their over­all val­u­a­tion as a busi­ness.

The 2010s was also the decade many com­pa­nies lost the trust of cus­tomers because of the way they han­dled, or mis­han­dled, their sen­si­tive data. Intro­duc­tion of the Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR) prompt­ed many peo­ple to recog­nise dig­i­tal ver­sions of them­selves are for sale.

Yet while these issues cer­tain­ly saw data pri­va­cy appear on the board’s radar, organ­i­sa­tions still fail to dis­tin­guish between data pri­va­cy and data secu­ri­ty. Com­pa­nies have been dis­cussing and pur­chas­ing solu­tions to deal with data secu­ri­ty for many years now, but under­stand­ing the dif­fer­ence between secu­ri­ty and data pri­va­cy could help them see why, despite their large invest­ments, breach­es con­tin­ue to occur.

“When boards start to dis­cuss what their data pri­va­cy pro­gramme is, the answer often comes back as data secu­ri­ty,” says Kevin Cop­pins, pres­i­dent and chief exec­u­tive at Spiri­on, which pro­vides data dis­cov­ery and clas­si­fi­ca­tion tools to help com­pa­nies pro­tect sen­si­tive per­son­al data.

“Under­stand­ing that you can have data secu­ri­ty with­out data pri­va­cy is rel­a­tive­ly new. Data pri­va­cy has to have a strong cul­tur­al ele­ment to it.

“If some­body breaks into your organ­i­sa­tion and steals last week’s lunch menu, nobody cares. If some­body breaks into your organ­i­sa­tion and steals all your part­ners’ and employ­ees’ data, sud­den­ly it makes a head­line. Although peo­ple have done a pret­ty decent job at data secu­ri­ty, the pace at which exter­nal and inter­nal bad actors can steal data has out­paced what you can do from a secu­ri­ty stand­point.

“New reg­u­la­tions are now forc­ing organ­i­sa­tions to recog­nise that some data is dif­fer­ent and breach­es occur because of the speed at which sen­si­tive data repli­cates. It does­n’t just live in a par­tic­u­lar data­base; it lives in every nook and cran­ny of your organ­i­sa­tion and is repli­cat­ed across cloud servers as fast as the eye can blink. The threat sur­face has grown expo­nen­tial­ly and there has­n’t been the same focus on sen­si­tive data com­po­nents as there has been on build­ing secu­ri­ty around the perime­ter.”

Approach­ing data pri­va­cy in the right way requires a cul­ture shift dri­ven from the very top of the busi­ness. First­ly, there must be a recog­ni­tion that the true vic­tim of a data breach is not the com­pa­ny; it’s the per­son whose records were stolen. Breach­es can be per­son­al­ly dev­as­tat­ing, so the anonymis­ing of vic­tims of data breach­es is some­thing that needs to end and the per­son­al­i­sa­tion of breach­es needs to begin.

Approaching data privacy in the right way requires a culture shift driven from the very top of the business

Sec­ond­ly, C‑suite lead­ers need to shoul­der not only the finan­cial respon­si­bil­i­ty of any data breach, but also the result­ing rep­u­ta­tion­al dam­age and loss of cus­tomer trust. That trust, once lost, is very dif­fi­cult to regain and, if cus­tomers are no longer grant­i­ng access to their data, com­pa­nies will soon lose their com­pet­i­tive edge. Rep­u­ta­tion­al dam­age has a far longer-last­ing effect than the finan­cial cost of a breach.

“Get­ting an organ­i­sa­tion to under­stand and per­son­alise data pri­va­cy is the respon­si­bil­i­ty of the C‑suite because that’s who dri­ves cul­ture,” says Cop­pins. “It needs to be per­son­al. It is the per­son in the office cube next to you and their kids whose infor­ma­tion was stolen, and they will be impact­ed for the rest of their lives. It isn’t just a process or a tech­nol­o­gy; it’s a cul­ture of respect­ing this con­cept of pri­va­cy and under­stand­ing dig­i­tal pri­va­cy is the same as per­son­al pri­va­cy.

“At Spiri­on, data pri­va­cy is part of who we are, and until C‑suite execs under­stand the val­ue of rep­u­ta­tion and trust, a cul­ture of data pri­va­cy is not going to pur­vey through the organ­i­sa­tion and they’ll con­tin­ue to treat any data as any data. A lot of respon­si­bil­i­ty lives there and it’s much more impor­tant than set­ting out a pol­i­cy or buy­ing a few dif­fer­ent ven­dor tools to say we care about pri­va­cy. A cul­tur­al shift must hap­pen.”

Spirion’s tech­nol­o­gy enables organ­i­sa­tions to dis­cov­er and val­i­date the loca­tion of per­son­al infor­ma­tion in their infor­ma­tion ecosys­tem, and then clas­si­fy and con­trol it accord­ing to the data pro­tec­tion man­dates they’re sub­ject to, such as the CCPA (Cal­i­for­nia Con­sumer Pri­va­cy Act), GDPR or even spe­cif­ic con­tracts. This enables com­pa­nies to get the big pic­ture of how data flows through the organ­i­sa­tion, and gain real com­mand and con­trol over that data.

The com­pa­ny enables organ­i­sa­tions to meet the require­ments of new data pro­tec­tion laws because cre­at­ing a data inven­to­ry is so fun­da­men­tal to com­pli­ance. It’s also cen­tral to cre­at­ing a suc­cess­ful data pro­tec­tion pro­gramme. In terms of tech­ni­cal secu­ri­ty con­trols, data clas­si­fi­ca­tion is foun­da­tion­al to oth­er con­trols, such as data loss pre­ven­tion and next-gen­er­a­tion fire­walls to enforce an organisation’s data pro­tec­tion stan­dards.

“Despite the view that breach­es are always a result of bad actors, much of the dan­ger to per­son­al data is sim­ply from organ­i­sa­tion­al insid­ers who mis­han­dle data and expose it to the world,” says Scott Gior­dano, vice pres­i­dent and senior coun­sel, pri­va­cy and com­pli­ance, at Spiri­on.

“Data clas­si­fi­ca­tion is huge­ly impor­tant, not only to iden­ti­fy sen­si­tive data, but also to help com­pa­nies build the right cul­ture. Unless per­son­al data pro­tec­tion is engrained in the cul­ture, all the mon­ey in the world will not help. The old say­ing about cul­ture eat­ing strat­e­gy for break­fast couldn’t be more per­ti­nent.”

For more infor­ma­tion please vis­it spirion.com