How to Help Ensure Compliance with Data Privacy Laws
If complying with data privacy laws like the GDPR, PDPA, CPA, HIPAA, PCI DSS, PIPEDA, and more sometimes feels like swimming in alphabet soup, there is a life preserver that can simplify, secure, and automate the processes involved. Managed file transfer can proactively help organizations meet strict industry requirements to ensure the data your customers and employees entrust you with stays secure both in transit and at rest.
No organization wants to be hit with the large fines or sanctions for non-compliance of data security laws. Nor do the negative PR and reputation ramifications sound appetizing. Deploying a robust file transfer system can help ensure compliance, with the least risk of human error.
Everyone has rights when it comes to the personal data they choose to share. The various data privacy laws enacted globally help govern and provide oversight into how organizations “borrow” this data with permission, and how they protect it while in their possession.
What Are Some Key Data Privacy Laws?
The European Union’s General Data Protection Regulation (GDPR)
This regulation governs the personal data that organizations have gathered with, and from, anyone else. It also rules how data is transferred between other EU member states and between other EU and non-EU locales. It determines what happens if such data is breached and provides the rights for EU citizens to:
- Request details about how their personal data is processed
- Have their personal data erased
- Withdraw previously given consent
- Request/receive their personal data in a common format
- Send their requested data to another organization
Even though the GDPR deals with the personal data of citizens in the EU, its requirements affect any company that controls or processes their data, including those in the United States, the United Kingdom, Asia, and beyond. Companies found noncompliant face strict fines and penalties.
Related Reading: GDPR and Data Privacy After Brexit: What's Next?
Australia’s Consumer Data Right (CDR)
This measure provides consumers with the ability to efficiently and conveniently access their personal data held by businesses, and to authorize the secure sharing of that data to trusted and accredited third parties. It gives individuals the right to access their personal information, and the right of data portability found in the European General Data Protection Right (GDPR).
Businesses under the CDR protocols should consider:
- Reviewing their policies and processes for privacy and data handling
- Training staff on their CDR obligations and how to manage the risks involved with handling consumer data
- Establishing breach notification procedures
- Ensuring the technology to ensure security measures is in place
Related Reading: Australia’s CDR: What it is and Why Does it Matter
The United States’ Health Insurance Portability and Accountability Act (HIPAA) and HITECH Act
The HIPAA act protects sensitive patient data and applies to any company that deals with protected health information (PHI). HIPAA naturally has a close relationship to the HITECH Act, which was designed to encourage the adoption of electronic health and medical records, although HIPAA’s primary concern is with the portability of health insurance and protecting the rights of workers between jobs to ensure health insurance coverage is maintained. The HITECH Act adds heft to HIPAA’s rules, outlining the technological aspects of protecting data of patients.
Any organization that exchanges PHI or ePHI must be HIPAA compliant. As healthcare organizations adopt health information technology like electronic health records (EHRs), PHI is subject to risk when transferred between hospitals, clinics, pharmacies and insurers using traditional, unsecure file transfer methods like FTP. It’s critical for organizations to secure this data at rest and in motion and ensure the security standards of HIPAA.
Related Reading: How GoAnywhere MFT Helps the Healthcare Industry Thrive
Singapore’s Personal Data Protection Act (PDPA)
This act governs the collection, use, disclosure, and care of personal data. Organizations are obligated to protect personal data in their possession or under their control by making reasonable security measures to prevent unauthorized access, collection, use, disclosure, copying, modification of data, or similar risks.
Specific measures include regular audits, implementation of an authentication method for accessing personal data, definition of user roles or groups and their access rights, setting appropriate password requirements and using anti-malware software.
Noncompliance can result in the oversight commission (PDPC) ordering an organization to stop any business activities which use personal data and issuing fines of $10,000 per offense.
Related Reading: PDPA in Singapore Helps Protect Personal Data
Global - Payment Card Industry Data Security Standard (PCI DSS)
This compliance regulation is mandated by credit card companies to help ensure the security of credit card transactions in the payments industry.
The set of industry requirements is intended to ensure that all companies that process, store, or transmit credit card information maintain a secure environment. Key requirements include firewalls, password protection, and encryption for data at rest and in transit.
Related Reading: PCI DSS Compliance for File Transfers
Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA)
This privacy law applies to private-sector organizations and businesses throughout Canada. The goal of PIPEDA is to ensure that all provinces and territories protect personal data. This includes:
- Asking for and obtaining consent when an individual’s information is initially gathered, used, or shared
- Allowing individuals to view or correct their personal information
- Appropriately storing and disposing of personal data
The core idea of PIPEDA is that businesses should act in good faith when collecting and using personal information. It applies to most businesses in Canada that handle personal information, exempting only provinces and territories where similar laws were put into place prior to PIPEDA. Commercial organizations that collect personal data – including names, addresses, demographics, financial information, and medical information, among others – must comply with PIPEDA unless specifically exempt.
Related Reading: What is PIPEDA?
California Consumer Privacy Act (CCPA)
The CCPA is intended to protect individuals’ private data by making data collection and usage more transparent between consumers and companies, giving Californians ownership over personal data that is collected by businesses. The CCPA adds new rights to Californians’ data privacy protections, specifically:
- The right to know what data a business collects and why, as well as any personal data they use, share, or sell
- The right to delete information a business has, if asked (within reason)
- The right to opt out or withdraw consent from having data sold
If your organization collects California residents’ information, it’s possible that you must adhere to the CCPA, even if your business is not physically located in California.
Related Reading: What is the California Consumer Privacy Act?
How Managed File Transfer Helps to Ensure Data Privacy Compliance
Organizations need technical, administrative, and managerial controls in place, as well as organizational polices, to fully enforce and ensure compliance from the top down. Your business can comply by:
- Developing a procedure to quickly locate and delete personal data about a person
- Simplifying your method of safely disposing of customer information when requested to do so
- Ensuring you can appropriately audit your records to find all personal data, including any external companies you’ve shared information with
One simple way to meet several data privacy requirements is to secure file transfers, both at rest and in transit, using a managed file transfer (MFT) solution. With MFT, you can eliminate the cumbersome custom programming and scripting normally required for data transfers. MFT can also improve the quality and security of files you send in-house or to remote locations, trading partners, other businesses, or the cloud.
GoAnywhere Managed File Transfer, helps organizations meet data privacy requirements, like those noted above, by providing an auditable solution with secure file transfers, secure email, separation of permissions by user roles, and at rest encryption.
The benefits of using GoAnywhere for compliance needs include (but aren’t limited to):
- Role-based administration and permissions: Keeps access privileges with the right users, controls password complexity requirements and sets expiration dates.
- Secure connections for transmitting sensitive data
- Strong encryption key management that you control
- Centralized control of file transfers
- Secure mail module for sending files using email with HTTPS download links
- Detailed auditing and reporting of all transfer activity, drastically simplifying the reporting burden during an audit
- Cloud solutions that conform to guidelines
Every data privacy law has unique requirements and repercussions. To find the best solution for your organization and help avoid fines and sanctions, schedule a live, customized demonstration of GoAnywhere today.
