Tag: data collection

The California Consumer Privacy Act (CCPA) is a California data protection law that went into effect on January 1, 2020 and began enforcement on July 1, 2020. The goal of the regulation is to ensure that companies operating in California and processing the data of California citizens properly protect that data and provide certain rights to data subjects.

The requirements of the CCPA are fairly strict, and the California Privacy Rights Act (CPRA), a current ballot initiative scheduled to be voted on in November 2020, will build upon and expand the requirements of the CCPA if passed. Achieving, maintaining, and demonstrating compliance with the regulation can pose a significant challenge for affected businesses.

However, the requirements of the CCPA and CPRA only apply to data that can be used to uniquely identify an individual or household. Efforts to anonymize data, such as the use of tokenization, can help to reduce the burden that CCPA places upon businesses.

CCPA is More Than Just Subject Rights

With the CCPA – and similar privacy laws such as the EU’s General Data Protection Regulation (GDPR) – the main takeaway that people have is that these laws dramatically expand the rights of data subjects regarding their personal data.

In the past, companies could collect, store, and use their customers’ data more or less with impunity. Consumers largely lacked visibility into what data was being collected and how it was used. They also often lacked a means of pushing back against “inappropriate” use of their data.

CCPA (and GDPR before it) have changed this. Within their jurisdictions, data subjects have the right to be informed of data collection and process, to request a copy of their data, to withdraw consent for certain processing activities, and to instruct a company to delete all data that it has collected about them.

However, while this is a significant change from the status quo, it is not the only purpose of the GDPR and CCPA. Both of these laws are also designed to protect the privacy of customer data from external parties by forcing companies to properly protect this data. By requiring a company to put certain cybersecurity controls in place and reserving the right to levy significant fines for security incidents or regulatory noncompliance, these laws incentivize organizations to have strong cybersecurity and reduce the probability of a breach of sensitive consumer information.

The Challenges of CCPA Compliance

The CCPA is a step in the right direction and is generally a positive move for consumers. However, the need to comply with the requirements of the regulation places a significant burden upon affected businesses.

In order to maintain compliance with the CCPA, an organization must have:

• Complete Data Visibility: Companies must know where protected data is in order to respond to a subject’s rights requests or detect a potential data breach
• Full Data Control: Companies must be able to modify or delete customer data in order to comply with a subject’s rights requests
• Comprehensive Data Security: Companies must have compliant security controls in place to secure protected data wherever it is located

While achieving all of these requirements within an organization’s network is possible, it can be difficult. Also, even the best-designed security still carries the risk of a data breach. Minimizing this risk requires minimizing the footprint of sensitive and protected data on an organization’s network.

Tokenization Enables Effective Data Anonymization

The requirements associated with the CCPA only apply to data that can be uniquely identified as belonging to a particular individual or household. Data that has been properly anonymized or deidentified does not carry the same requirements, making it easier for organizations to manage without violating regulatory requirements.

Most applications within an organization do not require access to protected data. A unique identifier for a user is as effective as a name or email address and does not carry the same impacts if it is breached. Similarly, a user’s address and financial data are only required by shipping and billing departments.

Tokenization enables an organization to replace protected data with unique tokens that can be formatted to fit the needs of a particular application. Since the mapping from a token to the actual data is only stored in a single database, it is useless to an attacker without access to this database.

This enables an organization to focus their data protection efforts on a single location in the network, rather than everywhere that a user’s personal data could be stored or processed.

Leveraging Tokenization for CCPA Compliance

Compliance with the CCPA and other data protection laws requires organizations to reconsider how they implement data collection, processing, and storage in their networks. Under the new rules, consumers have many more rights regarding their personal data, and the stakes of failing to properly protect collected data are much higher with regulatory authorities actively investigating data breaches and reports of noncompliance and levying fines on offenders.

Scattering consumer data throughout the network and making it accessible to many applications expands an organization’s attack surface and makes managing subject rights requests much more difficult and complicated.

Taking advantage of tokenization enables an organization to minimize access to and use of sensitive and protected data to applications where it is required to perform their functions. This reduces an organization’s vulnerability to attack and simplifies the process of achieving, maintaining, and demonstrating compliance with the CCPA.

 

This new strategy is a part of a broader effort to greatly reduce the cost associated with data collection.

The federal government of Australia has now announced its intentions to roll out a new national geolocation technology based data framework, beginning in February 2016, which will be a large component of a new strategy to reduce the price tag associated with data collection in the country.

They have determined that duplicate data collection has become an expensive process.

The geolocation program is being called the Foundation Spatial Data Framework (FSDF), and this database will provide a free record of each Australian property in a format that has been standardized. This data will be available to end users for free, regardless of whether they are government or industry. This announcement follows one that had previously been made with regards to the massive amount of spending that the government was doing in order to collect data.

The Department of Communications’ announcement laid the foundation for the launch of this geolocation project.

According to the department’s announcement through Helen Owens, its assistant secretary of data policy, who spoke to a parliamentary committee, the amount currently spent every year on the collection of geospatial data is estimated to be about $200 million.

The reason that the figure is as high as it is, is that there are many duplications across the existing efforts that are in place for data collection. These duplications run across the efforts that are made by the territory, state, and federal governments, meaning that in essence, taxpayers are paying for the same data to be collected in multiple ways, said Owens.

Owens also pointed out that the $200 million spent on data collection does not include defense agencies, and if that total had been factored in, it would be notably higher. She explained that “If we started with a green sheet, and you had $200 million per year to spend on geospatial data, would you do it this way? And the answer is no.”

Now, the hope is that the geolocation based program will streamline the multiple efforts so that they are conducted only once in any given area, as opposed to duplicating themselves in a very expensive way.