Is My Company Responsible For Customer Data Protection?

Customer data is vital to running a successful business. Not only does customer data provide your business with helpful information, but it also makes transactions easier and more efficient, allowing you to expand your service offerings. 

This article will dive into why data protection is necessary within the U.S., how it should be applied, and other things to know. 

Am I Responsible for Customer Data Protection?

No matter how a business uses customer data, you are responsible for maintaining customer data protection. This means that if you interact with the data, collect it, and/or store it, then you are committing to protecting that data from hackers and other malicious actors.

In the U.S., businesses fall under standard data privacy laws. There is no central federal data privacy law like there is in the European Union (see: GDPR), but the U.S. Privacy Act was implemented in 1974 and this generally governs the privacy of all American citizens as they concern government agencies. 

Other laws in the U.S. protect consumer rights and privacy around sensitive personal data. These include the Gramm-Leach-Bliley Act (GLBA; 1999), which protects financial nonpublic personal information (NPI), the Health Insurance Portability and Accountability Act (HIPAA; 1996), which protects healthcare and health insurance personal data, and Children’s Online Privacy Protection Act (COPPA; 2000), which protects personal information of individuals under 12. 

The Federal Trade Commission (or FTC) also signed into law the FTC Act of 1914, which is another data protection law put in place to protect consumers against misleading representation. So while businesses cannot be sued under the FTC for selling consumer data, businesses are responsible for being open and honest about how consumer data is being treated and not providing misleading information.

And finally, we have the California Consumer Protection Act (CCPA). The CCPA is the newest law that protects consumer information and it is the most applicable law in the U.S. This law requires all businesses who collect data on California residents and offer their business to California residents, gain informed consent, and other data best practices.

Responsibilities That Businesses Have for Customer Data Protection

The CCPA is one of the biggest pieces of customer data protection laws that businesses have to be mindful of, but there are elements of the GLBA, NPI, HIPAA, COPPA, and the U.S. Privacy Act that influence all areas of the economy. On top of that, businesses that operate with EU citizens must also follow the GDPR or the General Data Protection Regulation.

So what exactly are the responsibilities of businesses for customer data protection?

The GDPR and CCPA are the most specific legislation for customer data protection, and they aim to protect:

• Basic identity information such as name, address, and ID numbers
• Web data such as location, IP address, cookie data, and RFID tags
• Health and genetic data
• Biometric data
• Racial or ethnic data
• Political opinions
• Sexual orientation

Under the CCPA, businesses must abide by the customers’ following rights:

• The right to know about the data processing from each company
• The right to know which information is being collected on them
• The right to know which service provider(s) have access to their data
• The right request that the sharing or selling of their personal information be stopped
• The right to hold a business legally responsible for a violation of their privacy

The GDPR enacts the following principles for data protection:

• Lawfulness, fairness, and transparency
• Purpose limitation 
• Data minimization
• Accuracy
• Storage limitation
• Integrity and confidentiality
• Accountability

Responsibilities for the GLBA, NPI, HIPAA, and COPPA are all niche, and the responsibilities for the U.S. Privacy Act are general. So here’s the brief on what to do:

• GLBA: The GLBA protects banking and financial data privacy law, so it’s only important for those within this sector (and the responsibilities are way beyond the scope of this blog). Businesses within the financial sector must abide by GLBA compliance, which improves upon the Fair Credit Reporting Act. The GLBA protects sensitive data that contains personally identifiable information (PII) and is collected about an individual (when connected to a financial product).
• HIPAA: HIPAA protects PII of health data. Again, if you’re in the health industry, then you’ll be regularly referring to HIPAA for data protection. You must have a legal basis for collecting health data on data subjects.
• COPPA: COPPA prohibits online companies from asking for PII from kids 12 and under without informed parental consent.
• U.S. Privacy Act: The FTC can regulate any claims that a business makes that are misleading around data protection. So here, businesses must be honest about how data is being treated. Even though the U.S. does not have data privacy laws, infractions against data privacy can be upheld under FTC.

What is Customer Data Protection?

Knowing and understanding privacy laws can be complex when you don’t understand their purpose. In general, customer data protection is a set of rules, practices, and processes that are either recommended or enforced to ensure that customer data or information about customers are kept safe. 

Customer data protection can also refer to software that categorizes, monitors, encrypts, and backs up PII and other sensitive information so that this data is not stolen. 

Customer data protection essentially ensures that there is an extra set of “eyes” watching more important information, especially since some malicious individuals might work harder to gain access and exploit this information.

Risks and Significance of Data Protection Plans

PII and customer data are vulnerable to hackers. If hackers get their hands on sensitive consumer data, then they can use this information against the company and the customer for financial gain. Therefore, data protection plans are vital to company success.

While customer data may be necessary for companies to operate seamlessly, this data can be exploited. It is therefore a risk that the company takes on. That risk, or the consumer data, has an added benefit for the company. And the customers are trusting that company to keep that data secure. 

With a strong data protection plan in place, then businesses can improve the trust of their customers. It can also save companies thousands if not millions of dollars in lost or compromised customer data.

Setting Up Your Data Protection Process

Each data protection plan that a company uses will depend on the type of data that the company keeps, its uses, and its industry. No matter what, each company will need multiple levels of data security to ensure that the data is kept safe. 

1. Work with a third party to set up a strong data protection policy and plan. This will include strategies for protecting data, data monitoring, and key stakeholders to this plan. It’ll also include a backup and recovery process, and a liaison for data collection compliance. 
2. Most companies will need a comprehensive data protection plan. This would include multiple security features, like data monitoring software, antivirus and antimalware software, encryption software, password and authentication software, and strong email clients.
3. Anyone who collects data on consumers (i.e., a data subject) is called a data controller. Be sure that your processes apply to data controller laws, and that these processes work within your company’s normal operations, scale, and market. You’ll have to consider the ways you inform your customers of your privacy policies, policy updates, and affected individuals of data breaches.
4. Test, audit, and reassess your plan regularly to ensure that it works even through privacy law changes and market changes. Also, train your employees for proper data security.

Data Monitoring Software and Data Loss Prevention Software

Overall, if you collect data on your customers, then you need to have some measures in place that protect that data. 

With data monitoring software and data loss prevention (DLP) software, businesses have an extra set of eyes continually monitoring data for unauthorized changes. 

This software:

• Can be accessed by an administrator from a secure remote console 
• Can monitor multiple workstations at a given time
• Provides key alerts for unauthorized data access or modification
• Can be configured to monitor data movement based on compliance or data privacy laws
• And track user behaviors and changes to user behavior trends to stop an insider threat attack or data breach 

Have strong data monitoring support on your side with the SoftActivity Monitor.

By SoftActivity Team.