More Regulation, Enforcement Can Help Guide Compliance, Privacy Pros Say
Enforcement and increased state regulation of privacy may help companies since they offer explicit action as businesses seek compliance, privacy experts said during a panel hosted by Troutman Amin on Monday.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Strong enforcement “is actually helpful for us from a quantification standpoint, because now things aren't theoretical in terms of what's going to happen if we do this thing that's risky," said Anthony Witkowski, a privacy counsel at eXp Realty.
Troutman Amin attorney Jenniffer Cabrera predicted more state enforcement. “Attorney generals are not wasting time,” she said. “They are invested in ensuring that their consumers are protected, and they have no problem going after the big guys and sometimes even after the smaller companies, where they're able to collect some fees and really make known that they're here to stay.”
The easiest route is complying with the most comprehensive level of regulation, Witkowski said. For example, “I'd rather offer somebody -- who doesn't live in a state with a privacy law -- rights that they may actually not have by the virtue of their state legislation, then not respond correctly to an access request in a state that has legislation.”
Cabrera advised thinking about companies' partners, rather than just the data they have. “Onboarding your third parties, or just connecting with other third parties in any capacity, is so important because data crosses all channels,” she said. “The most important thing [is to] know who you're working with in order to maintain compliance.”
John Klapcik, vice president of compliance at Citizens Disability, said increased enforcement means companies must look differently at their privacy behavior. "It's gone past the point of ‘Is this defensible? Is it legal?’” he said. Additional questions include: "'What are the optics behind what I'm doing? And what is a regulator going to think? … What are they going to see, and are they going to like it?”
Witkowski agreed. “A lot of it is storytelling,” he said. “How are you building a good story around compliance?”