The Invisible Threat: Why Every Organisation Must Confront Its Privacy Risk

Today, data is sometimes referred to as the 'new oil' in a digital world. Data represents an asset to business that has both great potential — and also a significant, often underestimated, risk associated with it, in the form of ‘privacy risk’. In my role as a Data Protection Officer, I encounter the risks of privacy every day, seeing how they erode customer trust without being detected by an organisation, result in enormous financial penalties from regulation, and result in loss of integrity in the organisation.

So, what do we mean by ‘privacy risk’? In its essence, privacy risk is the possibility of a negative outcome for individuals from the use of their personal data by a third party for commercial purposes. These possible negative outcomes are not just abstract concepts; they can result in real, tangible harm. This includes financial losses as a result of fraud or discrimination; companies can suffer reputational damage as a result of sensitive personal information being exposed to hackers; and individuals can suffer both physical and psychological harm as a result of data collection through surveillance, manipulation or unauthorised access.

Privacy risk is a combination of the probability of these various harms occurring and the very real possibility of serious consequences to an organisation if regulatory action is taken against it, including: massive fines from regulation (in accordance with laws such as the General Data Protection Regulation, or GD Parikot), and devastating litigation. Moreover, the loss of public confidence can result in irreversible damage to an organisation's credibility in the marketplace. Therefore, it is crucial that organisations understand their particular privacy risk profile, because if they do not know what is potentially at risk, they cannot adequately protect that information from unauthorised access. Unfortunately, many organisations have a false sense of security and might believe that because they do not have a large data collection, or because they are not a large technology organisation, that they are not targets. However, these assumptions are incorrect.All organizations process data, whether employee records, customer contact information, website analytics, or video surveillance (CCTV) footage. Understanding your risk is key to being proactive in defending against it. Knowing your risk allows you to allocate your resources wisely, build a transparent relationship of trust, and move away from a reactive posture of managing crises after a breach to the more forward thinking and strategic position of ethically stewarding that information.

The Privacy Risk Assessment (PRA) aligned with the Data Protection Impact Assessment (DPIA) is the fundamental starting point for clarity in this area. It is not simply a check box exercise; it is a systematic investigative approach to the evidence. Here are steps for creating a PRA in an effective manner.

Step One: Identify the need - A PRA is required when processing activities pose a high risk to the rights of an individual. This situation typically arises when the organization uses sensitive information on a large scale; routinely monitors public places; or has an innovative technology application. While not every project is required to have a PRA; Following best practices, Any new product, service, or process involving personal data should have a PRA.

Step Two: Describe the processing - Include aspect of the Process including, what data is being collected (categories) and how long will it be used. What’s the lawful basis for the Processing? Who will have access to this information both internally and externally? Creating diagrams and mapping your data flows will help identify locations or Processing of Your data that You did not expect.

Step Three: The businesses need to engage stakeholders in discussion about possibly compromised personal information; this means not just interviewing business personnel but also speaking directly with those whose information will be affected as well as those representing them. Without their input on what is likely harmful or negative about the situation, there is no other way to gain a complete picture of risk. Moving forward from here, businesses should view the process (both conceptually and physically) as something that centers around the human being.

Step Four is to measure necessity and proportionality. This phase represents the highest point of decision-making within the PRA process. This includes determining if the activity being conducted is "necessary" for its original intended purpose (of processing), whether or not it can still meet that purpose by alternative means (less intrusiveness), and if there is a commitment from the start to keeping data to a minimum. Decisions made at this stage of the assessment challenge "business as usual" thinking and optimally encourage ways of innovating to accomplish goals through data minimisation.

Step five is identify and evaluate risks. This step requires us to consider and categorise two primary areas of risk:

* Individual Risk: Will the individual experience any sort of exclusion, discrimination, or economic harm? For example, a recruitment algorithm influenced by bias or a database known to be insecure and likely to be hacked.

* Organisational Risk: What is the potential for regulatory fines/sanctions, reputational impact, or the risk of operational disruption (resulting from a significant data breach)?

In the sixth step we negotiate to limit risk. The goal of this step is to reduce every area of identified risk to the lowest acceptable level possible. Examples of ways that can be accomplished include implementing stronger encryption technologies, implementing stronger access control mechanisms, reducing retention period and providing better privacy notices. Should the residual risk remain high, the business should seek consultation with the regulatory authority prior to moving forward.

The final step to managing privacy risk is to integrate and review. It is critical to understand that the PRA is not a one-time document that can be put away after submission. The results from the PRA assessments must be incorporated into project plans, contracts, and operational processes and policies. The assessment must also be re-evaluated periodically, and at any time that there is a change to the processing activities.

Managing privacy risk is an ongoing process; organisations should adopt a new mindset that considers privacy protection to be the fundamental building block of ethically managed, sustainable innovation. As consumers continue to become more vigilant and the regulatory framework becomes increasingly powerful, organisations that will thrive will be those that are willing to look at the invisible threat of data breaches, determine the seriousness of this threat through an exhaustive review process, and develop a resilient, respectful, and trusting relationship with customers' personal information. The privacy risk you don't see today is likely to become the catalyst for unraveling your organisation's success tomorrow; so now is the time for organisations to begin to identify the risk and build a true foundation of confidence and trust.