Data rich and regulation heavy

Regulatory and policy focus

Rapid technological change and the digitalization of society has increased the amount of consumer data. The desire to move faster and be more customer oriented has made consumer data a more crucial resource to organizations. Businesses rich in data can leverage it to enhance customer insight, expand customer reach, personalize products and services, improve competitive position, and speed up technological innovation. To respond, regulators have advanced privacy policymaking at an unprecedented speed, attempting to keep pace with the rate of technological change and offer meaningful protection of consumer privacy in an increasingly digital society.

In the United States alone, a total of 60 data privacy bills were considered across 29 states in the 2022 legislative cycle1. The rate at which bills are being introduced is indicative of a widespread movement to better protect the consumer and their data across the US. Major legislative efforts have also been introduced across the globe. In 2022, the European Union (EU) passed two major laws: the Digital Markets Act and the Digital Services Act, both of which include data privacy requirements and are expected to significantly bolster the protections already provided by the General Data Protection Regulation (GDPR).

Other laws coming into force in 2023 include The Artificial Intelligence Act, The Data Act, and The Data Governance Act. Beyond the EU, regulatory change is occurring in the United Kingdom, Australia, Canada, India, and Hong Kong, among others.

While the rate of regulatory change is undeniable, the approach to privacy lawmaking varies by jurisdiction. Some legislatures, such as the EU and California, have established themselves as the trailblazers of privacy law, passing proactive, progressive regulations that have persuaded other, more reactive legislators to take action (albeit often lighter- touch action). Differing approaches to lawmaking have resulted in a highly complex, and sometimes contradictory, legislative landscape for organizations. International as well as national organizations find themselves caught in a patchwork of laws they must carefully navigate without slipping through the cracks and falling into privacy purgatory. Even for the largest of organizations with generous compliance resource budgets, developing a privacy program that successfully ebbs and flows with the rugged tide of international and national privacy regulations is no small feat.

As a result of the regulatory boom in this area, treatment of personal data by organizations has come under hyperscrutiny, not only by supervisory authorities enforcing these new regulations, but also by the consumer, who has a heightened awareness of and ability to exercise their rights. It is important, therefore, that organizations possess strong knowledge of how they are managing privacy and security risk around consumer personal data and how they can go beyond mere protection of their brand. As the focus on these issues increases, stakeholders should be comfortable explaining how they assess their data security and privacy risks, the controls they have in place, and additional efforts they would recommend to further shore up their compliance programs to mitigate regulatory and reputational risks. In doing so, organizations can capitalize on the opportunity provided by the burgeoning privacy law landscape to showcase respect for privacy, build consumer trust, and differentiate themselves from their competitors.

This article discusses the issues that organizations should consider as they evaluate their existing risk management activities around data privacy and security and identify opportunities for enhancement.