california state capitol

California’s Consumer Privacy Act Affects How Companies Will Store Data Nationwide

CCPA (officially called AB-375) incorporates some of the elements of GDPR and takes a broader view of private data and protecting PII. The storage, transportation, and management of sensitive consumer and company information have become critical issues for companies of all sizes to lock down and secure.

Privacy laws are expanding in the U.S. and abroad. With the enactment of HIPAA, CCPA and GDPR, data breaches have serious liabilities for any company that holds sensitive consumer information including Personally Identifiable Information (PII) of consumers and or any other confidential information. California’s Consumer Privacy Act (CCPA) came into effect on January 1, 2020, and affects not only companies in California, but also companies nationwide doing business in California. The European Union’s GDPR regulation is already in effect, where non-complying organizations can be fined up to 4 percent of annual global turnover or €20 million (about $20+ million USD), whichever is greater. Additionally, under GDPR, companies can be fined 2 percent for not having their records in order, not conducting an impact assessment, or not notifying the supervising authority and the people affected by a breach.

CCPA (officially called AB-375) incorporates some of the elements of GDPR and takes a broader view of private data and protecting PII. The storage, transportation, and management of sensitive consumer and company information have become critical issues for companies of all sizes to lock down and secure.

How Does the California Consumer Privacy Act (CCPA) Affect Businesses?

Put simply, AB-375 levies specific penalties when there is “unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices.” While CCPA is meant to enhance privacy rights and consumer protection for the residents of California in the United States, as with many laws enacted in the state, it will impact most businesses across the country and the rest of the world. Any company that has customers who are based in California could be affected by this new law. CCPA can apply to businesses even if they do not have offices or employees in California. The criteria to determine if this law will affect your business are (any one of the three make the law applicable to your business):

  • Do you have gross revenue of over $25 million, or
  • Do you possess the personal information of 50,000 or more consumers, households or devices, or
  • Do you earn more than half your annual revenue from selling consumers’ personal information?

If the new CCPA applies to your company, the intentions of the law are to provide California residents (defined broadly enough to cover consumers, employees, business contacts and others) with the ability to know what personal data is collected about them (and have access to this information); how that data is used, sold or disclosed; ability to say no to the sale of personal data; request their data to be deleted; and more. They also have the right not to be discriminated against for exercising their right to privacy, e.g., for opting out of having their data used by the business in order to use a benefit provided by the business. Companies that do not comply with CCPA are subject to both civil class action lawsuits in the state of California and can be assessed with damages of $100 to $750 per California resident and incident, or actual damages, whichever is greater. Companies are also subject to fines from the state as the California Attorney General can sue them for non-compliance. Key to CCPA is the underlying assumption that companies protect the consumer or other Personally Identifiable Information against unauthorized disclosures.

BYOD: Bring Your Own Device

Companies are very focused on protecting data, especially PII behind the company firewall. The problem with this is that employees can take data they need and store it on unsecured devices so that they can take it home or elsewhere to work – outside the company firewall.

Many companies do not restrict employees bringing their own storage devices, such as USB drives, to take copies of data incorporating PII that should be protected – this is called Bring Your Own Device.

BYOD is a crucial threat to even the most robust cybersecurity plan that any business can put in place. The tremendous portability and exceptional convenience of USB drives have been proven to increase productivity for millions of companies. However, since most of these drives are unencrypted, they pose a significant security risk to the user when storing anything more valuable than public data.

The extreme portability of USB drives means they are very susceptible to being lost, accessed, or misappropriated. When that happens, there is a reasonably good chance that data stored on the device will end up in the wrong hands, risking the user’s or company’s privacy and security. This is not just a worst-case scenario – many USB drives have been lost and found, often with unprotected confidential information on them; when these drives are found and exposed, a breach occurs and a company can be exposed to legal and other consequences.

The safest, most reliable means to store and transfer personal, classified, sensitive data is to have a company policy of standardizing the use of hardware-based encrypted USB drives. Cybersecurity experts agree that the use of an encrypted USB flash drive is most effective for keeping confidential information what it was intended to be – confidential.

How Does a Company Effectively Manage Removable Storage Devices?

The secure management, transfer, or distribution of non-Cloud storage of private/personal data should always be front and center whether you are a financial services firm or a manufacturing company. A company should standardize their best practices for what’s known as data “at-rest” or “in-transit.” While the most common storage medium is the use of inexpensive USB drives, the best practice is to standardize on hardware-based encrypted USB drives which protect the data “at rest” as well as “in transit” – the data is always password or PIN protected. This practice will provide efficiency and security to mobile data for anyone.

Even accessing Cloud storage can be risky – while you access the internet at a coffee shop, someone else may be spying on your system. If you carry your data on a hardware-encrypted drive, you can work on your data and keep your internet turned off while in an untrusted open Wi-Fi area.

From a cost perspective, hardware-based encrypted USBs are not much more expensive than non-encrypted devices – and they are like insurance against the unthinkable – the loss and breach of private data that could be exposed otherwise. There is a range of easy-to-use, cost-effective, encrypted USB flash-drive solutions to choose from that can go a long way toward mitigating your privacy and security risks, and, quite possibly, save you money and stress.

An example of a cost-effective and easy to use encrypted USB drive is Kingston’s DataTraveler® Vault Privacy 3.0 USB Flash drive that provides affordable business-grade security. This encrypted solution features military-grade 256-bit AES hardware-based encryption in XTS mode. It protects 100-percent of data stored and enforces complex password protocol with minimum characteristics to prevent unauthorized access. For additional peace of mind, the drive locks down after 10-incorrect password attempts. It also features a read-only access mode to avoid potential malware risks.

Companies can take it a step further should they deploy encrypted USB drives in the field as a matter of practice. Some drives can be managed via software that is on-premises or Cloud-based where an IT architect can white list access to the drive, disable it if it’s lost, enforce password characteristics and much more.

Consumer privacy and data security are concerns for businesses of all sizes and identifying cost-effective ways to mitigate the risk is paramount in 2020 and beyond. Customer information and other sensitive data need to be stored on encrypted USB drives whenever you need to take the data with you to mitigate any risk of a data breach, data loss, and liability.

Featured

  • Progressing in Capabilities

    Progressing in Capabilities

    Hazardous areas within industries like oil and gas, manufacturing, agriculture and the like, have long-sought reliable video surveillance cameras and equipment that can operate safely in these harsh and unpredictable environments. Read Now

  • A Comprehensive Nationwide Solution

    A Comprehensive Nationwide Solution

    Across the United States, manufacturing facilities, distribution centers, truck yards, parking lots and car dealerships all have a common concern. They are targets for catalytic converters. In nearly every region, cases of catalytic converter thefts have skyrocketed. Read Now

  • Planning for Your Perimeter

    Planning for Your Perimeter

    The perimeter is an organization’s first line of defense and a critical element of any security and surveillance program. Even if a building’s interior or exterior security is strong, without a solid perimeter surveillance approach any company or business is vulnerable. Read Now

  • The Key Issue

    The Key Issue

    It is February 2014. A woman is getting ready in her room on a cruise ship when she hears a knock on the door; it is a crewmember delivering breakfast. She is not presentable so she tells him to leave it by the door. Read Now

Featured Cybersecurity

New Products

  • VideoEdge 2U High Capacity Network Video Recorder

    VideoEdge 2U High Capacity Network Video Recorder

    Johnson Controls announces a powerful recording solution to meet demanding requirements with its VideoEdge 2U High Capacity Network Video Recorder. This solution combines the powerful capabilities of victor with the intelligence of VideoEdge NVRs, fueled by Tyco Artificial Intelligence, for video management that provides actionable insights to save time, money and lives. 3

  • CyberAudit Introduced to Manage Systems, Intuitive Interface

    CyberAudit Web

    CyberLock, Inc. announces the release of CyberAudit Web 9.4! CyberAudit-Web (CAW), the software suite for managing CyberLock systems, provides an intuitive interface to assign keys, set expirations, monitor staff and configure access schedules. 3

  • HID Signo Readers

    HID Signo Readers

    HID Global has announced its HID® Signo™ Biometric Reader 25B that is designed to capture and read fingerprints in real-world applications and conditions. 3