Wave of privacy regulations increasing worldwide
With the rapid development of digitalization and data businesses, laws and regulations aimed at protecting individual privacy are being strengthened around the world. Strict regulations have been introduced one after another, starting with Europe’s GDPR (General Data Protection Regulation), which came into effect in 2018, and California’s CCPA (Consumer Privacy Act) and its enhanced version, CPRA.
In Japan, the revised Personal Information Protection Act has been gradually implemented, making companies’ responsibilities regarding data handling heavier than ever. Violations may not only result in large fines, but also lead to serious situations that threaten business continuity, such as loss of trust in the company and damage to the brand. Privacy issues are no longer just an issue for the legal department, but must be positioned as a top management issue (compliance risk).
Specific measures required of companies
In order to comply with the latest laws and regulations, companies need to take measures centered on data transparency and guaranteeing control rights. The first step is to take inventory of the data your company owns (data mapping). It all starts with knowing exactly what personal information is acquired, where it comes from, what systems it is stored in, and with whom it is shared.
Next, we will revise our privacy policy and introduce consent management tools. Websites and apps must include a process that clearly explains to users the purpose for which their data will be used and obtains explicit consent (opt-in). Restricting the use of cookies (elimination of third-party cookies) is also an urgent issue, and an increasing number of companies are introducing consent management platforms (CMPs).
Furthermore, it is necessary to establish a system (incident response system) that can quickly respond in the event of an information leak, and to thoroughly implement “privacy by design” (the philosophy of incorporating privacy protection from the initial stage of system design). Constantly monitoring regulatory updates and having a flexible governance system in place are the prerequisites for safely driving a data-driven business.