Train Your Team: Understanding Data Privacy Regulations

Now that we know why we need those regulations, let’s tackle the most popular ones and see how they’re implemented: 

General Data Protection Regulation (GDPR) 

On May 25, 2018, the GDPR, a comprehensive data protection regulation, went into force. It seeks to unify data privacy legislation throughout the European Union (EU), granting people more control over their personal information. It also enforces stringent regulations on businesses that handle it. 

 The key provisions are: 

• Data subject rights – individuals can access their data, have it corrected, be erased (or to be forgotten), limit processing, get to export, and object to processing. 

• Lawful basis for processing – organisations that wish to process personal data must have a legitimate reason for doing so. For example, contract fulfilment, legal duty, public tasks, etc. 

• Data protection by design and default – interested parties should include information protection safeguards from the beginning when business processes and systems are developed. 

• Breach notification – any data breaches that could jeopardise people’s rights and liberties must be disclosed to the appropriate supervisory authority and the impacted parties as soon as possible. This should happen in 72 hours.  

• Data protection officer (DPO) – to ensure compliance, organisations processing large amounts of personal data are required to designate a DPO. 

 National data protection authorities (DPAs) are responsible for enforcing the GDPR in every EU member state. They can do audits, investigate complaints, and levy administrative penalties. Non-compliance leads to serious consequences, including fines of up to €20 million or 4% of an organization’s yearly worldwide sales, whichever is greater. 

How does this affect the IT industry? 

Well: 

Companies must maintain comprehensive records of information processing activities. This requires detailed data mapping and inventory management. Also, IT systems and software must be developed with data protection principles integrated from the outset. 

All businesses must implement various security measures to protect sensitive information from breaches. Those include but are not limited to encryption, pseudonymization, and regular security audits. Last but not least, IT companies must ensure that third-party vendors and partners also comply with GDPR standards. 

California Consumer Privacy Act (CCPA)  

The CCPA is a historic data privacy law in the United States that primarily affects enterprises that operate in California. However, it’s important to mention that regardless of its location, any organisation that gathers information about Californians may be liable to the CCPA. The regulation went into effect on January 1, 2020. 

 It ensures: 

• Consumer rights – citizens have the right to view and seek the deletion of their personal data, to know what information is being collected, and to choose not to have it sold. 

• Data disclosure – companies must provide information about the types of personal data they collect, how they use it, and which categories of third parties they share it with. 

• Opt-out rights – customers can choose not to have sensitive data sold, so businesses need to include a “Do Not Sell My Personal Information” option on their websites. 

• Non-discrimination – companies are not allowed to treat customers unfairly for exercising their CCPA rights, for example by withholding services or imposing different fees. 

For IT businesses that means that systems must be capable of providing consumers with access to their data in a portable format. Also, they should enable users to delete personal information and forbid companies to sell it. This requires robust data management and deletion protocols. IT firms need to provide clear and comprehensive privacy policies to all their customers. 

The penalties range from up to $2,500 for unintentional violations and $7,500 for intentional ones. 

Australian Data Privacy Regulations 

The main piece of legislation controlling data privacy in Australia is the Privacy Act 1988. Its goal is to uphold and safeguard people’s right to privacy and to control the handling of personal data by Australian government agencies and businesses with yearly sales above AUD $3 million. In order to address new privacy issues, the Act has been changed multiple times.  

Currently, it features 13 Principles (APPs) that delineate expectations, privileges, and liabilities pertaining to the gathering, utilisation, and handling of personal data. They cover both public and private sector entities. 

The Principles focus on the following topics: 

• Collection of personal data – organisations are only permitted to obtain personal information from individuals directly when necessary and only through fair and legal procedures.  

• Use and disclosure – people need to know why their data is being collected and what will be done with it; data must only be used or disclosed for the primary purpose for which it was collected. 

• Data security – companies must implement appropriate measures to safeguard personal data against any unauthorised access, alteration, misuse, loss, interference, or disclosure; individuals must be notified in case of breaches.  

• Access and correction – people can see the information that businesses have on file and can ask that any erroneous, outdated, incomplete, irrelevant, or misleading data be corrected. 

• Oversea data transfers – the exchange of personal data with entities outside of Australia is restricted; companies need to make sure that the person receiving the information offers a similar degree of protection as the Privacy Act. 

As a result: 

IT companies must adopt comprehensive security measures to protect personal information. Those can include encryption, access controls, regular security testing, and incident response plans. Also, IT firms must be prepared to respond to data breaches promptly and effectively. This includes ensuring that the notification requirements under the NDB scheme are met.  Businesses that work with third-party service providers must ensure that they comply with the Privacy Act. 

The maximum penalties can reach the greater of A$50 million as of 2022. 

Health Insurance Portability and Accountability Act (HIPAA) 

The Health Insurance Portability and Accountability Act (HIPAA) was passed into law in 1996 in the US. The goal was to increase the efficacy and efficiency of the healthcare system. HIPAA contains regulations to safeguard the confidentiality and integrity of personal health information. 

It includes a: 

• Privacy rule – creates nationwide guidelines to safeguard patient medical records and other private health data. It covers health plans, clearinghouses for information, and healthcare providers who employ electronic means for some medical transactions. 

• Security rule – establishes guidelines for safeguarding electronic protected health information (ePHI), guaranteeing its availability, confidentiality, and integrity. It mandates that administrative, physical, and technical security measures be put in place by covered entities. 

• Breach notification rule – mandates notice from business partners and covered entities if unsecured protected health information is compromised. 

• Enforcement rule – includes clauses about penalties for infractions, hearing procedures, compliance, and investigations. 

As there are plenty of IT companies developing software for medical purposes, they should abide by several HIPPA regulations. First and foremost, they must implement robust security measures to protect ePHI. Business associate agreements (BAAs) must be in place with third-party vendors that handle ePHI. This ensures they also comply with HIPAA standards. Mechanisms must be in place to detect, respond to, and report data breaches involving ePHI promptly and in accordance with the provided requirements. 

Depending on the degree of responsibility, HIPPAA civil monetary penalties can range from $137 to $68,928 per infraction. Intentional violations may also result in criminal sanctions, which include fines and sometimes even jail time. 

Payment Card Industry Data Security Standard (PCI-DSS) 

The purpose of the PCI-DSS is to guarantee that all businesses that receive, handle, store, or transfer credit card data do so in a secure manner. It was released on December 15, 2004, and applies globally.  Several major credit card companies, including Visa, MasterCard, American Express, etc., were involved in the creation of the PCI Security Standards Council.  

To ensure compliance, businesses should: 

• Build and maintain a secure network – accomplished by not using the default system passwords and other security variables supplied by the vendor; also by installing and maintaining a firewall configuration to safeguard cardholder data. 

• Protect cardholder data – making certain that sensitive information is encrypted and securely stored before being transmitted over open, public networks. 

• Maintain a vulnerability management program – creating and maintaining safe systems and applications, as well as utilising and upgrading antivirus software on a regular basis. 

• Implement strong access control measures – limiting physical and virtual access to cardholder data; granting a unique ID to every individual so that they can only see the information they actually need. 

• Regularly monitor and test networks – tracking and keeping an eye on all network resource and cardholder data access, as well as routinely evaluating security procedures and systems. 

• Maintain an information security policy – keeping an information security policy in place for all employees. 

PCI-DSS compliance is critical for all IT companies that handle credit card information. So, they must implement stringent network security measures, including firewalls, encryption, and intrusion detection systems. To ensure safety, they must schedule regular vulnerability assessments. In addition, they must set strict access control measures with secure authentication methods.  

The PCI-DSS penalties range from $5,000 to $100,000 per month. It entirely depends on the severity and duration of the non-compliance.