california state capitol

California’s Consumer Privacy Act Affects How Companies Will Store Data Nationwide

CCPA (officially called AB-375) incorporates some of the elements of GDPR and takes a broader view of private data and protecting PII. The storage, transportation, and management of sensitive consumer and company information have become critical issues for companies of all sizes to lock down and secure.

  • By Richard Kanadjian
  • Feb 24, 2020

Privacy laws are expanding in the U.S. and abroad. With the enactment of HIPAA, CCPA and GDPR, data breaches have serious liabilities for any company that holds sensitive consumer information including Personally Identifiable Information (PII) of consumers and or any other confidential information. California’s Consumer Privacy Act (CCPA) came into effect on January 1, 2020, and affects not only companies in California, but also companies nationwide doing business in California. The European Union’s GDPR regulation is already in effect, where non-complying organizations can be fined up to 4 percent of annual global turnover or €20 million (about $20+ million USD), whichever is greater. Additionally, under GDPR, companies can be fined 2 percent for not having their records in order, not conducting an impact assessment, or not notifying the supervising authority and the people affected by a breach.

CCPA (officially called AB-375) incorporates some of the elements of GDPR and takes a broader view of private data and protecting PII. The storage, transportation, and management of sensitive consumer and company information have become critical issues for companies of all sizes to lock down and secure.

How Does the California Consumer Privacy Act (CCPA) Affect Businesses?

Put simply, AB-375 levies specific penalties when there is “unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices.” While CCPA is meant to enhance privacy rights and consumer protection for the residents of California in the United States, as with many laws enacted in the state, it will impact most businesses across the country and the rest of the world. Any company that has customers who are based in California could be affected by this new law. CCPA can apply to businesses even if they do not have offices or employees in California. The criteria to determine if this law will affect your business are (any one of the three make the law applicable to your business):

  • Do you have gross revenue of over $25 million, or
  • Do you possess the personal information of 50,000 or more consumers, households or devices, or
  • Do you earn more than half your annual revenue from selling consumers’ personal information?

If the new CCPA applies to your company, the intentions of the law are to provide California residents (defined broadly enough to cover consumers, employees, business contacts and others) with the ability to know what personal data is collected about them (and have access to this information); how that data is used, sold or disclosed; ability to say no to the sale of personal data; request their data to be deleted; and more. They also have the right not to be discriminated against for exercising their right to privacy, e.g., for opting out of having their data used by the business in order to use a benefit provided by the business. Companies that do not comply with CCPA are subject to both civil class action lawsuits in the state of California and can be assessed with damages of $100 to $750 per California resident and incident, or actual damages, whichever is greater. Companies are also subject to fines from the state as the California Attorney General can sue them for non-compliance. Key to CCPA is the underlying assumption that companies protect the consumer or other Personally Identifiable Information against unauthorized disclosures.

BYOD: Bring Your Own Device

Companies are very focused on protecting data, especially PII behind the company firewall. The problem with this is that employees can take data they need and store it on unsecured devices so that they can take it home or elsewhere to work – outside the company firewall.

Many companies do not restrict employees bringing their own storage devices, such as USB drives, to take copies of data incorporating PII that should be protected – this is called Bring Your Own Device.

BYOD is a crucial threat to even the most robust cybersecurity plan that any business can put in place. The tremendous portability and exceptional convenience of USB drives have been proven to increase productivity for millions of companies. However, since most of these drives are unencrypted, they pose a significant security risk to the user when storing anything more valuable than public data.

The extreme portability of USB drives means they are very susceptible to being lost, accessed, or misappropriated. When that happens, there is a reasonably good chance that data stored on the device will end up in the wrong hands, risking the user’s or company’s privacy and security. This is not just a worst-case scenario – many USB drives have been lost and found, often with unprotected confidential information on them; when these drives are found and exposed, a breach occurs and a company can be exposed to legal and other consequences.

The safest, most reliable means to store and transfer personal, classified, sensitive data is to have a company policy of standardizing the use of hardware-based encrypted USB drives. Cybersecurity experts agree that the use of an encrypted USB flash drive is most effective for keeping confidential information what it was intended to be – confidential.

How Does a Company Effectively Manage Removable Storage Devices?

The secure management, transfer, or distribution of non-Cloud storage of private/personal data should always be front and center whether you are a financial services firm or a manufacturing company. A company should standardize their best practices for what’s known as data “at-rest” or “in-transit.” While the most common storage medium is the use of inexpensive USB drives, the best practice is to standardize on hardware-based encrypted USB drives which protect the data “at rest” as well as “in transit” – the data is always password or PIN protected. This practice will provide efficiency and security to mobile data for anyone.

Even accessing Cloud storage can be risky – while you access the internet at a coffee shop, someone else may be spying on your system. If you carry your data on a hardware-encrypted drive, you can work on your data and keep your internet turned off while in an untrusted open Wi-Fi area.

From a cost perspective, hardware-based encrypted USBs are not much more expensive than non-encrypted devices – and they are like insurance against the unthinkable – the loss and breach of private data that could be exposed otherwise. There is a range of easy-to-use, cost-effective, encrypted USB flash-drive solutions to choose from that can go a long way toward mitigating your privacy and security risks, and, quite possibly, save you money and stress.

An example of a cost-effective and easy to use encrypted USB drive is Kingston’s DataTraveler® Vault Privacy 3.0 USB Flash drive that provides affordable business-grade security. This encrypted solution features military-grade 256-bit AES hardware-based encryption in XTS mode. It protects 100-percent of data stored and enforces complex password protocol with minimum characteristics to prevent unauthorized access. For additional peace of mind, the drive locks down after 10-incorrect password attempts. It also features a read-only access mode to avoid potential malware risks.

Companies can take it a step further should they deploy encrypted USB drives in the field as a matter of practice. Some drives can be managed via software that is on-premises or Cloud-based where an IT architect can white list access to the drive, disable it if it’s lost, enforce password characteristics and much more.

Consumer privacy and data security are concerns for businesses of all sizes and identifying cost-effective ways to mitigate the risk is paramount in 2020 and beyond. Customer information and other sensitive data need to be stored on encrypted USB drives whenever you need to take the data with you to mitigate any risk of a data breach, data loss, and liability.

Featured

  • From Surveillance to Intelligence

    Years ago, it would have been significantly more expensive to run an analytic like that — requiring a custom-built solution with burdensome infrastructure demands — but modern edge devices have made it accessible to everyone. It also saves time, which is a critical factor if a missing child is involved. Video compression technology has played a critical role as well. Over the years, significant advancements have been made in video coding standards — including H.263, MPEG formats, and H.264—alongside compression optimization technologies developed by IP video manufacturers to improve efficiency without sacrificing quality. The open-source AV1 codec developed by the Alliance for Open Media—a consortium including Google, Netflix, Microsoft, Amazon and others — is already the preferred decoder for cloud-based applications, and is quickly becoming the standard for video compression of all types. Read Now

  • Cost: Reactive vs. Proactive Security

    Security breaches often happen despite the availability of tools to prevent them. To combat this problem, the industry is shifting from reactive correction to proactive protection. This article will examine why so many security leaders have realized they must “lead before the breach” – not after. Read Now

  • Achieving Clear Audio

    In today’s ever-changing world of security and risk management, effective communication via an intercom and door entry communication system is a critical communication tool to keep a facility’s staff, visitors and vendors safe. Read Now

  • Beyond Apps: Access Control for Today’s Residents

    The modern resident lives in an app-saturated world. From banking to grocery delivery, fitness tracking to ridesharing, nearly every service demands another download. But when it comes to accessing the place you live, most people do not want to clutter their phone with yet another app, especially if its only purpose is to open a door. Read Now

  • Survey: 48 Percent of Worshippers Feel Less Safe Attending In-Person Services

    Almost half (48%) of those who attend religious services say they feel less safe attending in-person due to rising acts of violence at places of worship. In fact, 39% report these safety concerns have led them to change how often they attend in-person services, according to new research from Verkada conducted online by The Harris Poll among 1,123 U.S. adults who attend a religious service or event at least once a month. Read Now

Most   Popular

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.