If one were to describe the state of privacy in 2019, the argument could easily be made that the industry is both in a state of reflection and anticipation.
On one hand, the EU General Data Protection Regulation is weeks away from its first birthday. On the other, privacy professionals are counting down the days until the California Consumer Privacy Act makes its debut.
However, a group of privacy professionals who has worked in the financial industry discussed both laws in a session here at the IAPP Global Privacy Summit 2019 in Washington.
SunTrust Senior Vice President and Chief Privacy Officer Ron Whitworth moderated the breakout session titled "Financial Forum 2.0: Bank CPOs Discuss Hot Topics in Financial Privacy." The panel featured Bank of America Senior Vice President and Chief Privacy Officer Christine Fyre, CIPP/US, CIPM, FIP, Ally Bank Chief Privacy Officer Kimberly Genobles, CIPP/US, CIPM, FIP, and former JPMorgan Chase Managing Director and Global Chief Privacy Officer Zoe Strickland, CIPP/G, CIPP/US, CIPT, who is currently the vice president of global privacy and U.S. commercial compliance for Cigna.
Discussions about lessons learned from the first year of the GDPR kicked off the conversation. Strickland said even though the world knew about the GDPR years before May 25, 2018, it was not until just before its implementation date that financial companies began to ponder its effects.
She said the GDPR forced those companies to think about privacy in a more principle-based manner, while also opening eyes in the process.
The GDPR turned on lightbulbs for some businesses to think about what data they have and what they are processing it for. "There have been laws all over the globe, but I think a lot of it was new for the senior leadership," Strickland said.
Fyre agreed with Strickland's assessment that the GDPR started conversations among financial companies. One of the major reasons for this, Fyre said, was due to the tough penalties regulators can doll out for GDPR violations, a trait the EU Data Protection Directive lacked.
Whitworth built on Strickland's point about senior leadership's attention toward privacy laws. Whitworth notes their concerns were not one of compliance, but rather how data violations could hurt their businesses. Now that the CCPA is months away, Whitworth expects the noise around these issues to become louder.
For the financial services industry, the Gramm-Leach-Bliley Act exemption found within the law was one that was met with praise. Even with the exemption, privacy professionals should not take their foot off the pedal.
Strickland said with the CCPA — or any new law, for that matter — privacy professionals should conduct a scoping exercise to determine what information they will continue to handle and what information will fall by the wayside. This can help organizations as they make decisions about sharing data.
"CCPA definitions are not as clear cut about whether you sell information," Fyre said. "I do think as part of the scoping exercise and risk assessments, we are looking at how we share information outside of the company that may be considered personal information, but also aggregated information."
Both the CCPA and GDPR have expanded the definition of personal data, and with those shifts, Whitworth said financial organizations will need to adjust their data classification standards. Genobles said her organization has begun to do just that; however, she discussed the challenges of such a task.
Genobles said her company has to know where all its information is, as well as ensure they do not "cut themselves off at the knees in our ability to operate, while also protecting data."
"We are trying to create a data classification standard that is more fluid, less rigid and really takes the guessing out of it from our employees that are using it every day," Genobles said.
Plenty of obligations financial organizations had to tackle for the GDPR will once again reappear with the CCPA, including data subject access rights.
Fyre said her company established a centralized individual rights team as part of its GDPR prep to help smooth out the process. As for whether the volume of data subject access requests will increase with the CCPA, Fyre said it is hard to predict, but she did offer some advice for companies who may see a surge next year.
"It’s hard to predict so that’s why it's important when you set up your CCPA program; if you want to extend these rights broadly, you have to make sure you can handle it on the back end," Fyre said. "Sustainability is an important question, and we haven’t answered it yet."
There are plenty of questions that have yet to be answered for the CCPA, and privacy professionals are still working their way around GDPR requirements. Regardless of what happens in the upcoming months, the panelists agreed there will be plenty to talk about at next year's Summit with the CCPA, GDPR and the privacy laws that have not yet seen the light of day.
Photo by Ryan Chiavetta