Privacy Assessments - Gesmer Updegrove LLP

By Dallas Mosier

Why Conduct a Privacy Assessment?

In today’s digital age, where personal data (also called personally identifiable information, is generally any information that relates to an identified or identifiable living individual) traverses global networks in milliseconds, privacy has emerged as a cornerstone of consumer trust and legal compliance. Conducting a privacy assessment is not merely an exercise in regulatory adherence but a strategic imperative for businesses aiming to safeguard personal information, mitigate risks, and foster consumer confidence.

Privacy assessments enable organizations to identify and evaluate how personal data is collected, stored, used, and shared. This process is crucial for identifying potential privacy risks and vulnerabilities, ensuring compliance with the evolving patchwork of privacy and data protection laws including, in the United States, the California Consumer Privacy Act of 2018, as amended and expanded by the California Privacy Rights Act of 2020, Colorado Privacy Act, Connecticut Data Privacy Act, Oregon Consumer Privacy Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act, Virginia Consumer Data Protection Act, Illinois Biometric Information Privacy Act, together with national laws that may apply generally or more specifically to your organization such as the Children’s Online Privacy Protection Act, Health Insurance Portability and Accountability Act of 1996, Health Information Technology for Economic and Clinical Health Act, Family Educational Rights and Privacy Act, or Gramm-Leach-Bliley Act.

For organizations with an international presence, a privacy assessment is also imperative for compliance with the more commonly encountered EU & UK General Data Protection Regulations, along with data privacy and security laws in Australia, Brazil, Canada, China, EU, India, Israel, Japan, New Zealand, Saudi Arabia, Singapore, South Korea, and United Arab Emirates.

To the extent an organization is subject to any of the laws and regulations mentioned above, such an assessment may also be required by law (See, the Oregon Consumer Privacy Act).

Contact us below:

What Stakeholders Should Be Included in the Privacy Assessment?

A comprehensive privacy assessment requires the collaboration of various stakeholders, each bringing a unique perspective and expertise. Key stakeholders include:

Legal and Compliance Teams: To provide insights into legal requirements and compliance obligations.
Information Technology and Security Teams: To assess technical controls, data security measures, and breach mitigation strategies.
Data Governance Teams: To oversee data collection, processing, and management practices.
Marketing and Customer Relations Teams: To ensure that customer data is collected and used in accordance with privacy policies. Often, the marketing team is responsible for implementing technologies that implicate privacy concerns (e.g., contextual ads and tracking technologies).
Human Resources: To address employee data protection and privacy training needs.
Senior Management and the Board of Directors: To ensure organizational commitment and allocate necessary resources.

Involving a broad range of stakeholders ensures a holistic view of the organization’s data practices and helps in identifying and addressing privacy risks effectively.

How Do You Define the Scope of a Privacy Assessment?

Defining the scope of a privacy assessment is critical to its effectiveness. The scope should be tailored to the organization’s size, complexity, and the nature of its data processing activities. Key considerations include:

Types of Data Collected and Sources: Identifying the categories of personal data the organization collects (e.g., customer, employee, vendor data) and sources and channels in which the personal data is collected (e.g., provided directly by an individual, their employer, or other third party).
Data Processing Activities: Understanding the purposes for which data is collected, processed, and stored to ensure that such activities are permitted by applicable laws or if disclosure of such activities is required by applicable laws.
Data Sharing Practices: Evaluating whether and how data is shared with third parties. Note, certain sharing activities may also be considered data sales for which additional evaluation and compliance would be necessary.
Geographical Considerations: Considering the jurisdictions in which the organization operates and the applicable data protection laws.
Technology Infrastructure: Assessing the technologies used to collect, store, and process personal data.
Data Mapping. Have a comprehensive map of how personal data flows through an organization is critical to responding to data security incidents and responding to exercises of consumer rights under applicable law, including their right to know what is data collected about them, correct that data, access and move that data, to have the data deleted, and to opt-out of further collection of data.

By clearly defining the scope, organizations can focus their assessment efforts on areas of highest risk and importance.

How Do You Translate the Assessment’s Final Product into Action?

Translating the findings of a privacy assessment into action is pivotal for enhancing privacy practices and achieving compliance goals. This involves:

Prioritizing Findings: Based on the assessment, prioritize actions based on risk severity and compliance requirements in conjunction with legal counsel and often with an organization’s insurance broker.
Developing an Action Plan: Create a detailed plan outlining steps to address identified risks and compliance gaps. This plan should include timelines, responsible parties, and resource requirements.
Implementing Changes: Execute the action plan, which may involve revising data collection practices, enhancing data security measures, updating privacy policies, or conducting training sessions for employees.
Monitoring and Review: Establish ongoing monitoring mechanisms to ensure the effectiveness of implemented measures and compliance with privacy regulations. Regular reviews of privacy practices help in adapting to new legal requirements and evolving data processing activities.
Documentation and Reporting: Maintain comprehensive documentation of the assessment process, findings, action plans, and implemented changes. This documentation serves as evidence of compliance efforts and can be crucial for demonstrating accountability to regulators and stakeholders.

Conclusion

Conducting a privacy assessment is a proactive, and potentially required, step toward understanding and managing the risks associated with data privacy. By involving key stakeholders, defining a clear scope, and translating findings into actionable steps, organizations can not only comply with legal requirements but also build trust with customers and protect their reputations. Remember, while this post provides a broad overview, privacy is a complex field, and specific legal advice should be sought to address particular circumstances or challenges.

In summary, privacy assessments are not a one-time task but an ongoing process of reflection, improvement, and adaptation to the changing landscape of data protection.

Click below to read more about Dallas Mosier.

Dallas K. Mosier

Check out some of our latest publications: