The enactment of recent data privacy regulations like the Virginia Consumer Data Protection Act and Colorado Privacy Act highlight how U.S. states are working to extend additional rights to consumers. Amid rising rights requests, such as the right to request the deletion of personal data, enterprises impacted by developing and current data protection laws must ensure the user making the request is the true data owner. As fraudsters are continuing to exploit remote businesses, enterprises must be able to properly verify consumers making rights requests. If an enterprise unknowingly hands data to a fraudster, the consumer is likely to face account takeover attacks and be subjected to other forms of fraud.
This article will explore key considerations and best practices for organizations to remain compliant with data regulations and to ensure consumers’ personal data is secure and out of the hands of fraudsters.
How to prevent non-compliance penalties
With enterprises facing greater scrutiny for mishandling consumers’ personal data, they must know which regulations apply to them and how they can securely perform new rights requests. Organizations must realize the gravity of consumer data privacy and recognize their rights under new laws, including the right to opt out of data sharing, the right to erase or correct their data and the right to be informed about what data has been captured and stored about them.
To prevent non-compliance fines that can surpass hundreds of thousands of dollars, organizations must know the enforcement dates and ensure they have everything ready to streamline secure rights requests prior to that date.
Tips for performing secure rights requests
While new state data protection laws are likely to emerge, a federal privacy regulation is also in the works that would hold every state in the U.S. accountable for misusing consumer data. Organizations must ensure they are adhering to the most rigorous regulations that pertain to them so that their data management processes are in compliance with regulations that are less strict in nature. Due to the amount of sensitive data involved with rights requests, enterprises must confirm the individual who is making the rights request is who they truly say they are.
The dark web holds an abundance of sensitive data, with 36 billion records exposed just in 2020. Cybercriminals can easily pose as the account holder by leveraging compromised credentials to log in or previously breached information to respond to security questions. Such traditional methods of authentication don’t provide real proof of identity and may lead organizations to mistakenly expose sensitive information that can be leveraged to take over more user accounts and engage in fraud.
Companies must implement digital identity verification tools that provide data security, compliance, transparency and retention policies to adhere to new regulations and prevent the repercussions that may arise for failing to comply. By verifying a user is who they claim to be online, digital identity verification can ensure companies are complying with consumer rights requests. For instance, document-centric identity proofing compares a government-issued ID to a real-time selfie to confirm a user is who they are claiming to be. In fact, Gartner predicts that 80% of enterprises will be leveraging document-centric identity proofing in their onboarding process by 2022, up from nearly 30% today. With digital identity verification solutions, organizations can ensure they know and trust their remote customers, while preventing their business and customers from falling victim to fraud.
How emerging privacy legislation will impact business processes
The responsibilities of enterprises will continue to expand as long as consumer rights are increasing. Emerging data protection regulations will keep companies responsible for properly managing consumer information. As such, organizations must implement a strong security posture to protect consumer rights and avoid the costly consequences of non-compliance. Enterprises can preserve user trust, perform secure rights requests and fight fraud by confirming that the consumers making rights requests are who they are claiming to be, understanding which regulations concern them and implementing the right security capabilities to adhere to rigorous privacy regulations.
Source: https://www.securitymagazine.com/articles/96114-considerations-for-enterprises-amid-new-privacy-regulations
