Handle personal data: What we forget is as important as what we remember
This spring, Facebook addressed the issue of permanence across its messaging platforms – from Instagram to Messenger to WhatsApp – with the aim to “set a new standard” for consumers’ private communication platforms. Shortly after, Telegram took it further, announcing new capabilities that enable users to delete any message in both ends of any private chat, at any time.
While these announcements focus on the consumer audience, global businesses have been grappling with the same challenges when it comes to data compliance and retention over the past year due to the introduction of the GDPR. Whether it’s a client’s archived emails, payment details, or personal information, it’s been a mission-critical concern for businesses.
When the GDPR was introduced last year, it was groundbreaking – but it’s only the tip of the iceberg. This historic set of regulations was the first of its kind and resonated with leaders, businesses and consumers around the world. Now, countries like the US, Brazil and India are breaking new ground with privacy laws, with legislation taking place even at the state level to protect the privacy of citizens.
Proper data compliance regulations aren’t just a fad, and companies need to get serious about cooperating, or else pay the price in terms of fines and customer trust. In the past year alone, the European Commission has levied nearly €56B in fines against 91 companies.
As companies continue to grapple with compliance, they face one of the most challenging aspects of the GDPR – the right to erasure (often referred to as the right to be forgotten). Many companies do not store data in a way that makes it easy to delete, or search for that matter, particularly when it comes to secondary copies of data like snapshots, backups, and archives. As we enter the next era of the GDPR and forthcoming privacy legislation, here are a few things companies can do to avoid the harsh penalties that are starting to get issued.
Know where personal data is
There should never be a question about where personal data lives, and how long it will be there, but legacy data techniques aren’t always equipped to provide these answers. But when you get a right to access request, you must be able to show a data subject all of their personal data and describe how it is being used.
Knowing the location of all personal data is also necessary to comply with a right to erasure request. You will need to ensure that all personal data of a given subject is deleted, assuming that you do not have a business reason to keep said data. For example, you have a business reason to keep employee and customer records for a certain period of time, but it would be hard to justify a business reason for keeping the personal data of a marketing prospect that is not a customer.
You should also have conversations with your secondary storage vendors, such as snapshot, backup, and archive products, to find out if and how they can support right to erasure requests of data within their systems. The best most of them will be able to provide is the ability to erase files from a backup, and some will not even be able to do that. As of this writing, no secondary storage vendor is able to selectively delete a record from the backup of a database, which is what would be required to delete a user from the marketing database – and that is unlikely to change any time soon.
Encryption
Backup archives should always be stored using strong encryption. That way, in case the system is ever breached, all the cyber criminals would come away with is encrypted, unusable data. This not only saves the consumer of a potential identity leak, but also saves the company publicly (not to mention from likely legal action). Encryption should be a no-brainer for all personal data.
Data autonomy
The main tenet of the GDPR is to give people privacy and control of their personal data in the digital age, primarily that the subject of the data gets to decide which companies can store their personal data and what data they can store. Before making such a decision, the subject should know why the company needs it, what they’re going to do with it, and have assurances it will be stored properly.
Among other things, “properly” storing personal data means ensuring only those who need to see it will be able to see it, and that they will only be able to see it when needed.
Transparency
Your company will make a lot of decisions about personal data. You will need to decide what personal data you will store, how you will store it, how you will comply with right to access and right to erasure requests, and more. Regardless of how you decide to do things, it’s incredibly important that you are very transparent with consumers regarding those decisions.
Not being transparent enough is what cost Google €50B. In addition to being transparent about what data you are storing and how you are using it, you must also be transparent about your right to access and right to erasure processes. If your process takes 30 days, communicate that. If you are able to delete the requested data from your primary storage but not backups, communicate that – and explain why. You should also explain whatever process you have for ensuring that deleted data doesn’t come back after a restore, and how those backups will not be used in a way that accesses their personal data. (The latter is going to become more challenging as backup systems are learning to leverage backup data for other purposes.)
The overriding idea should be transparency. You may run afoul of the commission if they don’t like your erasure process, but that process can be explained and refined as you work with the commission. But you will run afoul of the commission if they find that you are not being upfront about your process. Based on fines so far, that’s the way to get a huge fine. So transparency is the key.
If actions and legislation being considered by various countries are any indication, privacy regulations are only going to become more stringent, and for good reason. It seems every day there is another report about data being used incorrectly, without permission, or stolen by bad actors. With this constant commentary, consumers are becoming more and more wary about how companies are using their data, and the right to be forgotten provides personal autonomy when it comes to one’s own data. The request for erasure will only increase, and companies need to be prepared.