Editorial
Recent high-profile data breaches have brought the issue of protecting confidential information to the forefront of the security industry and the public mind.
In October of this year, reports were issued revealing that the magnitude of the TJX data breach was far greater than previously indicated - with fraud-related losses on Visa accounts alone ranging from $68 million to $83 million, spread across 13 countries.
With the Privacy Rights Clearinghouse reporting that over the last two years data leaks have comprised more than 150 million personal data records in the U.S. alone, it is clear that the problem of data breaches won't be going away any time soon. As such, it is no surprise that governments in many countries, including Canada, are considering laws that will mandate how sensitive data is handled by large enterprises and small and medium-sized businesses (SMBs).
Now a litigious discussion across the country, the question has been raised as to whether it is the government's responsibility to implement standardized data breach laws - particularly in the U.S., United Kingdom and in Canada.
Critics of Canada's privacy legislation, specifically PIPEDA, are calling for stricter rules and harsher penalties that would be similar to legislation being introduced in the U.S. However, in the US, recent attempts to introduce farther-reaching data breach laws (like the California Assembly Bill 779) have been vetoed with the reasoning that the private sector is better equipped to manage data security than the government.
Governments, whether in Canada, the U.S. or the UK, will face a monumental challenge if they try to prescribe what exactly constitutes "confidential information" and how that data should be protected. Rather than the government creating standardized measures that would dictate what actions should take place after a data breach, the onus should be on the businesses themselves to protect confidential data proactively.
Across different industries and organizations, the definition of 'sensitive information' varies greatly. It may be patient forms at a hospital, patent applications at a research facility or credit card numbers at a retail store. There are some common threads among all industries, but the nuances from one business to the next will make it nearly impossible for any government to make an overarching definition of sensitive information.
Even within each organization, many different types of sensitive information exist and each must be treated with varying levels of security appropriate to its specific requirements.
Whether it is consumers' personal information or corporate intellectual property such as trade secrets and financial data, it's important that all organizational stakeholders - employees, partners, customers - are promptly notified when confidential information has been breached.
The government must compel businesses to notify stakeholders when a breach has occurred, but the onus is on the business itself to determine what data it needs to protect and to implement the right policies and technology to ensure it's secure.
In addition to the difficulty of standardizing definitions and regulations for sensitive data, it's logical to expect that compliance with standardized data protection laws would have significant financial implications.
Proposed legislation would likely require a combination of technology and processes, which are ultimately going to have hard costs and could take time to implement across the board (similar to what the U.S. experienced with Sarbanes-Oxley compliance).
Such legislation can be seen as a good catalyst for businesses to re-examine their business practices, but enforcing a one-size-fits-all approach to data protection simply won't work. Protecting financial information for a small retail chain will not be the same as what's required for an international bank.
The business itself is in the best position to identify the company's "crown jewels" - from employee and customer data to trade secrets. When considering what information is most important to protect, anything deemed "material" to the organization and subject to indemnity disclosure is often a good benchmark for setting internal content protection policies.
Most companies will realize that if they have an indemnity disclosure and financial risk associated with a data breach, it is in their best interest to protect their sensitive data or potentially face costly intellectual property loss and legal damages associated with a breach.
Once sensitive data is identified, technology can be employed that acts as a digital content guardian, controlling who accesses the data and how it's accessed, as well as where and how it's shared. The right technology can help create a behavioral change that will minimize accidental data loss by employees, as well as protect data from malicious attacks.
(Fiaaz Walji is the country manager for Internet security provider Websense Inc. in Canada)
Related content:
Management practices critical to information privacy, says Stoddart
ID theft on the rise in Canada, reveals survey
Eight security tips that every CIO should know