It seems like nearly every day there is some new word of a personal information data breach from a retailer, financial institution, hospital, or other entity. Privacy laws are designed to help protect personal data, and in past several years, there has been a new wave of laws enacted across the world.
According to Kevin Levy, a shareholder in GrayRobinson, examples of personal data include names, age, date of birth, job title, Social Security numbers, driver’s license, email address, phone number, address, financial information, etc.
There are general data protection regulations that can affect your business and certain rights that the people you collect data on have, including the right to access information and withdraw consent to collect and use personal data.
See also: Cybersecurity is a year-round priority
Speaking at a recent NationaLease meeting, Levy pointed out that a business needs justification to process personal information, including asking people to opt-in or opt-out depending on state statutes. Personal information can also be processed due to a contract, legal obligation, public authority, and legitimate business interest.
Levy believes the industry should be prepared for the new wave of privacy laws and shared a compliance checklist no matter what the privacy laws are in your state. It includes the following items:
- Review (and enhance) data mapping practices.
- Review update and adopt policies, processes, and procedures, including reasonable security measures.
- Create a detailed plan to promptly respond to data breaches and train your staff on how to respond to a data breach.
- Train all personnel on proper data processing and employee and consumer request practices.
- Regularly update your privacy policy, notices, website ad practices, and procedures.
- Review and address vendor and customer contact for security assessment and use of Data Protection Addendum.
- Review employee and customer contacts for express, written consent of use of personal information.
- Perform regular compliance audits.
See also: Are cybercriminals waiting for an opportune time to attack U.S. trucks?
To reduce the risk of a data breach, implement, enhance, and maintain a meaningful customer/vendor management program and get knowledgeable counsel involved in developing your data security efforts.
If you are notified of a data breach, gather a team to investigate it and develop a plan to deal with the breach. Provide notice and/or document files to those impacted by the breach. Failure to respond to a data breach could hurt your business, lead to warning notices and sanctions, and result in liability claims.
Jane Clark focuses on managing the member services operation at NationaLease as vice president of member services. She works to strengthen member relationships, reduce member costs, and improve collaboration within the NationaLease supporting groups.
