Can technology innovation – coupled with the boldest kind of leadership – work together to start fixing the most intractable problems facing America? On July 21 – we’re going to find out. The countdown to MerITocracy 2022: American Innovation Forum is on.
In the lead-up to the July 21 forum, we are table-setting a host of big issues that will get serious attention at MerITocracy 2022.
In today’s edition of Countdown to MerITocracy, John Holmes, Chief Legal Officer at Forcepoint, talks about the intertwining of cybersecurity and privacy, and how that creates the privacy-by-design imperative.
The in-person forum – at the Marriott Marquis in Washington, D.C., from 8:00 a.m. to 6:00 p.m. – will host bipartisan leaders from Congress, the Biden administration, and America’s tech industry to examine the most pressing problems facing citizens in our democracy, and map out creative solutions from the nexus of policy and technology. Register today.
Understanding the Interconnectedness of Cybersecurity and Privacy – and the Imperative of Privacy by Design
By John Holmes, Chief Legal Officer, Forcepoint
On April 6, 2022, the U.S. government announced that it had secretly removed malware from organizations around the world to preemptively prevent a Russia-backed cyberattack. It was just the latest move by the Biden administration to protect critical infrastructure, as well as business and government operations, against cyber spillover from the military conflict in Ukraine.
However, it doesn’t take a cyberwar to cause a data breach, as news headlines regularly attest. Any individual’s data is at risk of being exposed. As only one recent example, in mid-2021, a hack of a major telecom provider leaked records of nearly eight million customers – plus another 40 million noncustomers.
These events are reminders of how globally interconnected our networks, supply chains, and daily lives have become. More than one-half of the world’s population – approximately four billion people – own a smartphone. Individuals and businesses generate an estimated 97 trillion gigabytes of data a year. In this data economy, social media content, personal fitness stats, web searches, and more can be captured, shared, sold – and hacked – at a dizzying pace.
It’s no wonder people feel they have less and less control over what happens to their information. Privacy must become a priority for all enterprises and agencies. First among them are providers of technology solutions and services. In particular, these organizations must embrace the concept of “privacy by design.”
Drivers of Data Privacy
Privacy issues revolve around personal data or personally identifiable information (PII). Definitions of PII vary, but in general, it refers to any data that permits the identity of an individual to be directly or indirectly determined. That could include name, location, IP addresses, medical details, financial or other account data, government identifiers (e.g. driver’s license, social security number), and biometrics.
Beyond geopolitics and the ever-growing scourge of cybercrime, a number of factors are escalating the need for stronger privacy:
U.S. regulations – The United States lacks a comprehensive, federal-level privacy law. Instead, the Federal government of the United States takes a sectoral approach, with laws directed to specific industries – from the Health Insurance Portability and Accountability Act (HIPAA) to the Fair Credit Reporting Act (FCRA) – to address aspects of privacy. But California, Colorado, Virginia, and Utah have enacted comprehensive state-level privacy laws, and several other states have privacy laws in committee.
EU regulations – The General Data Protection Regulation (GDPR) is the world’s most prominent privacy law, granting individuals significant rights and control over their PII. Most notably, it restricts the transfer of personal data about Europeans to destinations outside the EU unless a valid international transfer mechanism is in place.
COVID-19 – The COVID-19 pandemic raised the stakes on cybersecurity and, by extension, privacy when it transformed how organizations function. Businesses suddenly had to field a remote workforce, connected through dispersed endpoints and cloud applications. They also required new, digitally enabled ways of interacting with customers. Enterprises now need more effective means of securing their perimeters, reducing their attack surfaces, and preventing data loss.
Customer demands – Cyberattacks, regulations, and a global pandemic aside, a primary driver of stronger privacy is simple: customer demands. In a recent KPMG survey, 86 percent of respondents said data privacy is a growing concern, and 68 percent said they’re concerned about the level of data being collected by businesses. Customers want to know who has their information, how they’re using it, whom they’re sharing it with, where it’s stored, where it flows to, and how it’s being protected. Enterprises that fail to recognize the importance of and respond to these concerns risk losing business to those that do.
Best Practices for Privacy by Design
To better ensure privacy and retain customer trust, providers of digital solutions and services must embrace privacy by design. Privacy by design calls for privacy to be considered in every aspect and phase of a company’s operations, solution design, and engineering. The goal is to make strong privacy a corporate priority and ensure it is the default position in any operations, technology, product, or practice, allowing an organization to make privacy efforts proactive rather than reactive.
A key reason privacy by design must be central to digital solutions and services is that these products typically process personal data of employees and customers. That could be HR data in a central enterprise resource planning system or customer information in a customer relationship management system. Cybersecurity solutions could involve employee behavior monitoring to look for anomalous network usage. But it can even show up in places we might not immediately consider, like customer PII flowing through a coffee retailer’s WiFi network.
When assessing a high-tech provider’s privacy-by-design maturity, look for these qualities:
Privacy impact assessments – Privacy-by-design begins with a thorough privacy assessment to identify potential cybersecurity issues as well as what personal data might be gathered and how it will be handled, protected, and stored. Choices should be made at the outset of application development or onboarding of a provider about which data is needed for the product to function effectively. No personal data should be captured or provided to a third party that isn’t absolutely necessary.
Data anonymization – Data anonymization is a form of data sanitation that removes PII from a dataset so that any individual associated with it is obfuscated. That can be achieved in a number of ways, but in general, it means replacing personal data with a random number in such a way that the dataset can’t be de-anonymized. The data is completely de-associated from individuals, and there’s no achievable way of ever re-associating it.
Pseudo-anonymization – There are situations when anonymization isn’t possible to fulfill the organization’s needs or is an effective approach, such as when monitoring network traffic for anomalous behavior. In these cases, pseudo-anonymization offers a solution. A cybersecurity provider processing PII on a client’s behalf, for instance, can use encryption to de-associate data from individuals but allow the client to hold a cypher key to re-associate the data if necessary. An effective solution would enable the client to custom-configure the service to conform to privacy laws in various jurisdictions. It’s worth noting that pseudo-anonymization is highly recommended within the GDPR and the European Data Protection Board’s Recommendations on Supplementary Measures as an appropriate data management technique.
Data governance – Privacy-by-design dictates that digital solutions distinguish between the data processor – the vendor providing the software or service – and the data controller – the enterprise or individual who owns the data. Whenever possible, digital solutions should allow data owners to retain full control and manage their own data in their own environment, encrypting or otherwise restricting access to maintain the highest level of privacy.
Proof of privacy – Digital solutions should also demonstrate that they enable the customer to implement privacy controls. This can involve business rules that limit the number of administrators who have access to data or that establish a super-administrator who has control over admin rights, such as who has permission to unmask pseudo-anonymized data.
Processes and partners – Privacy by design doesn’t just involve application development and engineering. The approach is effective only if privacy concepts and controls are baked into the organization’s business-wide practices and processes. Every line of business must adopt a privacy mindset to ensure that all aspects of the business are geared to preserving privacy. Likewise, privacy expectations must extend to the provider’s contractors, suppliers, and partners.
Building a Privacy Ecosystem
Ultimately, the approaches and actions that achieve strong privacy won’t be achieved by any one organization alone. Rather, effective privacy requires the commitment from all organizations, especially providers of digital products and services, in an ecosystem of data privacy. In this way, privacy by design will become less a product or vendor feature and more an industry mindset and methodology.
Our networks, data, cybersecurity, and supply chains are simply too interconnected today to ignore the privacy imperative. But with strong commitments and effective practices, we can ensure data privacy and continue to build privacy trust.