GDPR Compliance and Significance of Securing PII

 

The Importance of Securing Personally Identifiable Information (PII)

In today’s data-driven business landscape, organizations frequently collect, store, process, and transmit Personally Identifiable Information (PII) from their customers. This increased usage of PII makes it a prime target for cybercriminals who exploit vulnerabilities to steal sensitive information and sell it on the dark web. Data breaches can result in significant financial losses and damage to an organization’s reputation.

The Threat Landscape and Data Breaches

The frequency of data breaches is a major concern, often making headlines. The shift to remote working has further exposed vulnerabilities, providing more opportunities for cybercriminals. For instance, a ransomware attack on the multinational IT service provider Cognizant, involving the Maze ransomware, affected its clients. In another case, a significant data breach in June 2020 compromised the sensitive information of over 7 million Indians through the BHIM e-payment app.

Defining Personally Identifiable Information (PII)

PII encompasses any data that can be used to identify or contact an individual. This includes names, email addresses, phone numbers, Social Security Numbers (SSNs), and credit card information. When such information is exposed, cybercriminals can misuse it for various fraudulent activities, making it crucial for organizations to protect PII from unauthorized access.

General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR), effective from May 2018, is a robust data protection law designed to ensure the secure and free movement of PII within and outside the European Union (EU) and European Economic Area (EEA). GDPR mandates that companies collecting PII from customers, employees, and third-party vendors protect this data from internal and external threats. Compliance with GDPR is required even for companies without a physical presence in the EU or EEA but who process data of European citizens.

Roles and Responsibilities under GDPR

GDPR outlines specific roles, including the Data Controller, the Processor, and the Data Protection Officer (DPO). The Data Controller and Processor manage the data processing purposes and ensure compliance with outsourcing contractors. The DPO oversees the implementation of security controls and GDPR compliance within the company.

Consequences of Non-Compliance

Failure to adhere to GDPR can result in significant fines. As per Article 83 of GDPR, fines are tiered based on the severity of the infringement:

1. Lesser infringements can lead to fines up to €10 million, or 2% of the firm’s global annual revenue, whichever is higher.
2. More severe infringements can incur fines up to €20 million, or 4% of the firm’s global annual revenue, whichever is higher.

Core Principles of GDPR

GDPR is built on seven key principles to manage and protect PII:

• Lawfulness, Fairness, and Transparency: PII must be processed lawfully, fairly, and transparently.
• Purpose Limitation: Data should be collected for specific, explicit, and legitimate purposes and retained only as long as necessary.
• Data Minimization: Only necessary and relevant data should be processed.
• Accuracy: Organizations must ensure data accuracy and update or delete incorrect data upon request.
• Storage Limitation: Inessential data should be deleted after use.
• Integrity and Confidentiality: Data must be safeguarded against unauthorized processing and accidental loss.
• Accountability: Data controllers are responsible for ensuring GDPR compliance.

Protecting PII in Practice

Often, PII is stored in plain text across various formats within an organization’s infrastructure, posing significant risks. Organizations must regularly locate and manage scattered PII to mitigate these risks. GDPR emphasizes data minimization and storage limitation, urging organizations to collect only necessary PII and promptly delete it after use.

Utilizing Automated Data Discovery Tools

Manually identifying and managing scattered data can be challenging. Automated data discovery tools, like SISA Tipper, can simplify this process by locating and managing PII across different file formats efficiently. These tools can scan organizational infrastructure, identify plain text PII, and help in encrypting, truncating, masking, or deleting the data as needed. This not only reduces the manual effort but also ensures compliance with GDPR and other regulatory requirements.

By leveraging automated tools, organizations can better protect PII and stay ahead of evolving cyber threats. Regular scans and proper data management practices are essential for maintaining data security and regulatory compliance.