Much discussed today, data protection laws are regulations developed by governments and have come into force to protect the personal and confidential information of data subjects.
However, many companies have not yet adapted to these laws and may be impacted by millionaire sanctions in case of information leaks.
Do you want to learn more on the subject? Follow our article to the end!
By 2023, 75% of the world’s population will be covered by data protection laws, according to Gartner estimates. These laws are intended to define guidelines for the collection, processing, and storage of personal data, preserving the privacy of data subjects.
Currently, 71% of countries already have privacy laws, 80% have laws related to cybercrime, 49% have consumer protection laws, and 81% have electronic transaction laws.
Given this scenario, organizations must comply with the terms established by these laws, avoiding the loss of revenue with millionaire sanctions.
In this article, we show you everything you need to know about data protection laws, which are in place in different countries. Our content explores the following topics:
1. Data Protection Laws: What Are They, How Do They Work and How Important Are They?
2. Data Protection Laws by Country
3. GDPR: Important European Data Protection Law
4. LGPD: Brazilian Data Protection Law
5. Main Data Protection Laws
6. Iconic Cases of Data Leaks
7. Basic Practices for Complying with Data Protection Laws
8. About senhasegura
9. How Does senhasegura PAM Enable Compliance with Data Protection Laws?
10. Conclusion
Enjoy the read!
1. Data Protection Laws: What Are They, How Do They Work and How Important Are They?
Data protection laws regulate personal data protection and privacy policies, directly impacting the way companies handle information relating to their employees, customers, and business partners.
In practice, they are sets of rules applied in the collection, processing, and storage of data used by individuals, companies, and governmental organizations.
It is important to note that countries that want to maintain negotiations between themselves must comply with the laws in force in both nations.
Many countries still do not have strict and well-established laws when it comes to data protection, but some already have them, and that will be the subject of the next topic.
2. Data Protection Laws by Country
Now you will know the context of data protection laws around the world. Check it out:
When it comes to privacy and data protection regulations, Germany is ahead of many countries. Its Federal Data Protection Act (Bundesdatenschutzgesetz ? BDSG) was made official in 2017 to replace the legislation with the same name created in 2001 and complement the GDPR.
Germany’s data protection law addresses the rights and duties of public and private institutions regarding the collection and processing of data. It also presents specific guidelines on how companies should handle their employees’ data.
In practice, this legislation offers guidance on specific topics, such as data processing in the context of employment, the stipulation of a data protection officer, profiling, and credit checks.
Moreover, several German laws set strict privacy standards for certain topics, such as television and telecommunications providers, banks, and energy.
Argentina’s Data Protection Law must be complied with by any person or institution dealing with personal data. In addition, this legislation requires the consent of the user for the collection of information.
Another right provided by Argentine law is that the data subjects can access, correct, delete, and request the deletion of their data whenever deemed necessary.
The Australian Privacy Act of 1988 imposes rules aimed at the public and private sectors. Issues such as data subject rights, transparency, and use and disclosure of information stand out among the 13 Australian Privacy Principles addressed in the legislation.
In addition to the law in force throughout the country, Australian states also have their own regulations, aimed at certain segments.
In Brazil, the General Data Protection Law (LGPD) came into force in 2020, but the topic had already been explored before in the Federal Constitution and the Consumer Protection Code.
In addition, in 2014, the Internet Civil Framework was approved, which addresses the rights and duties of network users, such as privacy, freedom of expression, and civil liability.
Between provincial and federal laws, Canada has a total of 28 data protection regulations. Its federal law is the Personal Information Protection and Electronic Documents Act (Pipeda), which regulates the collection, processing, and disclosure of personal information.
Pipeda addresses 10 principles to be followed by organizations and has similar and complementary legislation used in Alberta, British Columbia, and Quebec.
Also known as The Standard, the Information Security Technology ? Personal Information Security Specification law is Chinese legislation on data privacy.
It is a set of rules that addresses things such as the rights of the subject, transparency, and consent. This law came to replace several separate regulations on these matters.
GDPR is the data protection law in force in Europe, which is based on seven principles for data processing. They are: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.
By following these principles, companies can remain compliant with the regulation. Moreover, data controllers also assume responsibility for their processing and must comply with European legislation.
In practice, personal data should be:
- Processed in a lawful, fair, and transparent manner;
- Collected for specific, legitimate, and explicit purposes, and processed in a manner compatible with the explanations offered. In the case of further processing for purposes of public interest, they should not be considered incompatible with the initial purposes;
- Appropriate, relevant, and limited to what is essential for the proposed purposes;
- Accurate, updated, erased, and rectified immediately after use;
- The data must allow the identification of its subjects only for the time necessary for their use. However, they can be stored for longer periods if they are processed exclusively for purposes of public interest, scientific research, historical, or statistical purposes related to the implementation of technical measures and organizations required by the GDPR.
- Its processing must also ensure the security of personal data, which includes protection against unlawful processing, accidental loss, destruction, or damage.
Four laws regulate data privacy in Colombia. They are: Decree 1,377/13, Law 1,581/12, Law 1,273/09, and Law 1,266/08.
The first addresses issues such as consent, personal data processing policies, and international transfers of information.
The other laws address, respectively, how the collection, storage, and processing of data should be performed; cybercrimes and commercial and financial data, among other topics.
The United States has several laws governing data privacy, depending on the industry or state. All in all, there are about 20 laws related to a single area, in addition to approximately 100 state laws.
The state of California alone has 25 laws, with the California Consumer Privacy Act (CCPA) being the main one.
Despite these state laws and legislation such as the Privacy Act, the Privacy Protection Act, the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, and the Fair Credit Reporting Act, the United States still does not have specific legislation for the protection of its citizens’ data.
The main legislation on the protection of personal information in the Philippines is the Data Privacy Act, drafted in 2012 and implemented in 2016.
According to this regulation, individuals have the right to know which companies access their data, for what purpose, who will have access to the information, and by whom it will be processed.
Like Finland, France has also replaced its old regulations in order to more faithfully contemplate the aspects addressed in the GDPR: its Data Protection Law (Law 78-17) was replaced by the 2nd French Data Protection Act (2016-1321).
Under the new legislation, companies must specify the purposes of data processing and ensure only information essential to those purposes is collected.
Currently, India has several complementary laws on data security, but the Information Technology Act and the list of Information Technology Rules are the most important ones.
In addition, the country published the Digital Personal Data Protection Act in 2019, which is being analyzed by a parliamentary committee.
Indonesia has a set of data protection rules, which focus on the Electronic Information and Transactions Law, its amendment, and two other regulations.
Soon, its rules should also be gathered around a single piece of legislation, formulated along the lines of GDPR.
Data protection in Japan was governed by the Act on the Protection of Personal Information until 2003, however, in 2017, the country adopted the APPI Amendment, which includes aspects such as sharing information with third parties, information held in databases, and leaks.
In place since 2010, Malaysia’s first data protection legislation is based on seven principles: generality, notification and choice, disclosure, security, retention, data integrity, and access.
According to this regulation, it is necessary to inform the holder in writing of their rights, the purpose of the collection and processing of the data, and who will access them.
In 2010, the Federal Law on Protection of Personal Data Held by Individuals was established in Mexico, which includes data collected and processed by private organizations.
These companies are also governed by the rules of the list of Regulations of the Federal Law on the Protection of Personal Data Held by Individuals, the Privacy Notice Guidelines, and the Self-Regulation Parameters.
Also, Mexico relies on the Federal Institute for Access to Information and Data Protection (IFAI) to manage all these rules.
In New Zealand, data protection is controlled through the country’s Privacy Act, which has 12 Information Privacy Principles, established in 1993. In addition, the country has regulations directed at certain industries.
What’s more, the Data Privacy Act 2018 should soon be approved, which will replace 1993’s legislation.
3. GDPR: Important European Data Protection Law
The General Data Protection Regulation (GDPR) is a set of European rules governing the use of data in electronic environments. It aims to strengthen the concept of digital citizenship and protect users in aspects such as financial services and social media interactions.
In practice, this regulation proposes individuals and legal entities should use personal data responsibly, preserving the privacy of the information holders.
Its mass spread is still recent, so not all countries in Europe have their virtual environment activities in a regulated manner.
In addition, despite being European legislation, the GDPR impacts other countries that perform commercial transactions with European nations and need to comply with its standards.
The General Data Protection Regulation addresses the collection, use, sharing, and security of personal data in the 28 countries that make up the European Union.
Therefore, organizations that do not comply with its rules are subject to fines of up to 20 million Euros or 4% of their turnover. Here are some important GDPR criteria:
Before companies begin collecting personal data, they need to obtain the express consent of the information holders.
However, it is important to keep in mind some data that is not protected by the laws of the United States and not considered personal in Europe must be preserved. This is the case with IP addresses.
Notification of Data Breaches to Authorities
Another obligation of companies, according to GDPR, is to notify data subjects and authorities within 72 hours if there is a breach that affects the privacy of users.
Under GDPR, data subjects must be guaranteed certain rights related to their personal information. Among them, we can highlight:
- Be informed about the collection and use of their data;
- Request a copy of their personal information and receive explanations about the means of collection, what is being collected, and with whom it will be shared;
- Request rectification of data that may be incomplete or incorrect;
- Have their personal data deleted within 30 days if they make such a request;
- Request the restriction of their personal information;
- Transfer personal data from one electronic system to another securely; and
- Oppose the way the data is used, (unless the information is in the possession of a legal authority), for purposes of public interest or by a company that needs to process the data in order to offer a service that the data subject has contracted.
New Perspectives for the General Data Protection Regulation
The European Union is expected to update its rules on digital services soon through two new laws: the Digital Services Act and the Digital Markets Act.
The purpose of these laws is to keep what is legal online and what is illegal offline, causing websites like Google to quickly remove content deemed illegal or harmful.
The Digital Services Act and the Digital Markets Act will target very large online platforms and search engines with over 45 million monthly users.
In practice, the Digital Services Act deals with any service delivered through the internet, covering hosting services, intermediary services, and online platforms, and obligations vary according to the size of the company.
The Digital Markets Act, in turn, affects large organizations such as Apple and Facebook. Its goal is to level companies by preventing large organizations from imposing unfair conditions on companies and the public.
In the coming years, the Electronic Privacy Regulation will also enter into force, which will establish privacy guidelines for electronic communication services and institutions, which were not governed by previous legislation.
This law should also simplify consent or denial of tracking cookies, allowing users to withdraw their consent at least once a year.
Finally, there is the AI Law, which should be applied to all organizations that use programs based on artificial intelligence. The legislation has already been introduced and is in the process of being revised. It applies to any organization with customers in the European Union, regardless of where it is located.
4. LGPD: Brazilian Data Protection Law
The Brazilian Data Protection Law (LGPD) is a Brazilian regulation that aims to preserve the personal and private data of people residing in Brazil. This legislation describes what personal data is, further explaining what type of information deserves more attention.
Also, according to the LGPD, regardless of whether the company is located outside the country, its requirements must be respected.
5. US Data Protection Laws
CCPA
As we have already mentioned in this article, the United States has a series of data protection laws divided by segments and areas. One of the states where these regulations have solidified is California, which is governed by the California Consumer Privacy Act (CCPA).
This legislation gives consumers more control over the information collected by companies, as well as the right to know how this data is used and shared, and to delete and refuse to sell that information.
Moreover, clauses in contracts that include the waiver of rights guaranteed by the CCPA are unenforceable.
NY Shield
New York also has its own data protection law, the NY Shield, in place since 2020. This regulation requires security and accountability from organizations that handle the personal data of residents of the state.
NY Shield emerged through the expansion of other laws that previously existed in New York: the General Business Law and the Warn Act.
US Federal Laws
We will now mention some US federal laws, which, although not specific to data protection, have the function of protecting certain types of information in specific circumstances. One of them is the Health Insurance Portability and Accountability Act (HIPAA), which protects user communication with health entities such as hospitals and pharmacies.
The United States also has, as a federal law, the Family Educational Rights and Privacy Act (Ferpa), with the function of detailing who is authorized to request students’ educational records.
The Gramm-Leach-Bliley Act (GLBA) includes banking services and requires financial institutions to explain how they share data and respect the right of customers who do not wish to provide their information.
6. Iconic Cases of Data Leaks
Here are some known cases of data leaks:
In 2012, LinkedIn was hacked by malicious actors who exposed the personal information of more than 117 million users. At the time, data such as names, email addresses, and passwords were leaked.
The following year, it was Evernote’s turn to become a target for attackers, who accessed usernames, email addresses, and account passwords on the platform.
Also in 2013, Yahoo announced it was the target of a data breach that exposed the names, phones, birthdates, and passwords of 3 billion users.
Also in 2013, Adobe customers had their data leaked. It is estimated that 152 million names and passwords were exposed at the time, as well as 2.8 million credit card numbers. However, only 38 million pieces of data have been confirmed.
Adobe was sued by several US states and had to pay a $1 million fine.
In 2014, Cambridge Analytica used personal data from Facebook users to conduct unauthorized behavioral tests that would later be used in the presidential campaign of Donald Trump.
More than 57 million users of the Uber app, including 200,000 Brazilians, had their data exposed in a data breach that occurred in 2016, but it was only released the following year.
As a result, the government of California, in the United States, fined the company R$150 million.
The social network MySpace was also targeted by malicious agents in 2013, with 360 million users impacted. However, the information did not become public until three years later, through a notification that users’ personal data had been exposed and could be for sale.
The 330 million people who used Twitter in 2018 had to change their passwords after the social network discovered a vulnerability in its database. A few years earlier, Twitter users’ personal data had already been exposed twice due to security flaws.
In 2019, more than 2 million McDonald’s records with the personal information of its employees were leaked. The data included the full name, age, time of experience, position, and salary of the employees.
In 2021, the company was fined by the Luxembourg National Commission for Data Protection for failing to comply with data protection law requirements in its advertising system. The fine resulted in a loss of 746 millions of Euros.
7. Basic Practices for Complying with Data Protection Laws
Data protection experts recommend that companies redefine their organizational management, taking into account certain factors.
Among them, we can highlight:
- The need to have a professional in charge of data security;
- Execution of a complete audit of the information;
- Definition of the data lifecycle;
- Re-elaboration of contracts with suppliers and partners;
- Review of security policies; and
- Preparation of privacy impact reports.
For this, one can count on the services of a legal office specialized in data protection laws, in addition to technological solutions that favor digital security.
8. About senhasegura
We, from senhasegura, are part of the MT4 Tecnologia group, created in 2001, to promote the cybersecurity of the companies that hire us.
We serve organizations from 54 countries, offering our customers control of insider actions and information in order to prevent threats such as malicious attackers and data leaks.
For us, digital sovereignty is everyone’s right and this goal can only be achieved using applied technology.
Therefore, we follow the lifecycle of privileged access management, before, during, and after access. Our commitments include:
- To ensure more efficiency and productivity for businesses, as we avoid interruptions due to expiration;
- To perform automatic audits on the use of privileges;
- To automatically audit privileged changes to detect abuses;
- To ensure customer satisfaction;
- To perform successful deployments;
- To provide advanced PAM capabilities;
- To reduce risks;
- To bring companies into compliance with audit criteria and standards such as PCI DSS, Sarbanes-Oxley, ISO 27001, and HIPAA.
9. How Does senhasegura PAM Enable Compliance with Data Protection Laws?
senhasegura PAM is a solution that allows companies to comply with data protection laws through tools that provide security to the digital environment.
It also proposes the implementation of policies, processes, and procedures, in addition to increasing the level of cyber awareness of users.
One of the main capabilities of this feature is the protection of privileged credentials through the Principle of Least Privilege, which guarantees each user only indispensable access to perform their functions.
10. Conclusion
In this article, you saw that:
- Data protection laws affect the way companies handle sensitive information from their customers, employees, and business partners;
- Many countries do not have well-established laws on the subject yet, but several nations are already concerned about it;
- We showed data protection laws in force in different countries;
- We also covered the main data laws today;
- We presented emblematic cases of data leaks, such as Facebook, Uber, and Twitter;
- We listed good practices for companies that need to comply with data protection laws;
- Finally, we presented senhasegura PAM as an effective solution for these organizations to achieve their goal.
