With all of these privacy regulations a part of business as usual in 2019 – and more coming down the pipeline – it’s important companies look at privacy best practices as more than just a nice-to-have. It could make or break your brand in the future.
Protecting consumer rights isn’t just the law anymore. It’s a way to prove your trustworthiness to consumers.
Because it’s such an important part of how brands will function and prosper in the future, we’re highlighting the ways big and small brands alike have embraced privacy best practices in 2019. Use these examples to shape your own strategy for privacy in 2020 and years to come.Read more
http://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.png00Joy Ugihttp://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.pngJoy Ugi2019-12-02 09:00:502019-11-20 19:01:022019 Year in Review: How to Win at Privacy Best Practices
Hailed by some to be a landmark law heralding the future of consumer privacy, the California Consumer Privacy Act (CCPA) will change the way we do business – across all industries – forever.
Nicknamed by some GDPR Lite because of how twin-like it is to the EU’s privacy law, the CCPA leverages a lot of the same strategies as GDPR. And just like its brother from across the pond, this U.S.-based, paradigm-shifting consumer privacy law is a gamechanger for everyone.
In fact, if your business is in the United States and collects information about California residents, the CCPA applies to you.
Small businesses who think they’re off the hook are in for a shock. If you have a contact form on your website, collect resumes from candidates for job openings, or operate a brick-and-mortar location, the CCPA probably applies to you.
Technically, the CCPA rules apply to a for-profit “business” that does business in California. It also conforms with one or more of the following:
Generates an annual gross revenue in excess of $25 million
Derives at least 50% of its annual revenue from selling California consumers’ personal information
Buys, sells, shares and/or receives the personal information of at least 50,000 California consumers, households or devices
Even if you think the CCPA doesn’t pertain to your business, you’d be wise to implement the requirements anyway. Although it’s the first state law of its kind, it most certainly won’t be the last. Consumers are growing more and more concerned about their private information, and there may be no going back.
The new individual rights requirements in the CCPA are so significant, the risk of non-compliance is an accident waiting to happen.
To help, we created this comprehensive field guide. It explains the CPPA individual rights requirements and provides step-by-step recommendations for implementation so U.S. businesses can comply with accuracy, timeliness, and confidence.
http://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.png00Joy Ugihttp://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.pngJoy Ugi2019-11-07 21:16:302019-11-07 21:16:32The CCPA Field Guide: Understanding Individual Rights Under the New Law
The first regulation to shake things up was the GDPR. The CCPA followed not long after and now other states such as Illinois, Maine and Nevada are setting up house.
It won’t be long before most states have privacy laws, and smart companies are taking the hint.
In fact, most organizations realize managing security and privacy compliance today is a full time job. Large companies with even larger budgets are supporting the increasing security threats by hiring Chief Information Security Officers (CISOs). These roles have been around for a while and are becoming more and more frequent thanks to the rise of cyberthreats like malware, which increased 54 percent in 2018.
And for the mid-market and SMBs who need the same help – but don’t have the budget to pay for it – Virtual Chief Information Security Officers (vCISOS) are the cost-effective answer. These top-tier security experts are paid on an as-needed basis.
What most people don’t know about vCISOS is that they’re only focused on protecting your data from bad characters and shady vendors. They aren’t responsible for privacy compliance, especially when it comes to the use and collection of data.
This is a completely different side of privacy compliance vCISOS aren’t able to address. In fact, you’ll need a dedicated privacy compliance person for these tasks.
https://redcloveradvisors.com/wp-content/uploads/2019/10/Fractional-Privacy-Officer-Blog.png4001000Jodi Danielshttp://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.pngJodi Daniels2019-10-03 12:12:222019-10-03 12:12:54The Era of the Fractional Privacy Officer and Why You Need One Now
http://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.png00Jodi Danielshttp://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.pngJodi Daniels2019-09-16 00:19:172019-10-17 15:33:23A Summary of the CCPA Amendments and the Impacts to Businesses
https://redcloveradvisors.com/wp-content/uploads/2019/09/Nevada-SB220-Blog.png4001000Jodi Danielshttp://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.pngJodi Daniels2019-09-09 16:20:532019-09-09 16:20:55FAQs: New 2019 Nevada Privacy Law
The recent Facebook data privacy scandal can teach businesses A LOT of important lessons about privacy.
Many feel Facebook got a slap on the wrist and didn’t learn its lesson after the Federal Trade Commission (FTC) penalized the social media giant $5 billion.
The fine came as punishment for deceitful privacy practices in the Cambridge Analytica/Facebook scandal and other privacy breaches. Facebook settled a similar charge in 2011 with the FTC. It paid the fine, but went about doing pretty much the same thing: Breaking its privacy promises to users and to the FTC.
Even though the fine is about 220 times larger than anything the FTC has imposed in similar cases, not everyone was impressed. The agency faced accusations of going light on Facebook. An irate FTC commissioner felt that this figure was so small that Facebook could still claim a profit on its crimes.
He was referring to Facebook’s stock that went up after news of the FTC’s record fine was announced.
The fine was only one part of the settlement that Facebook agreed to. The FTC “Order” also includes a new series of restrictions on the business to ensure compliance. These restrictions join a list of other procedures that provide privacy oversight.
Here’s a complete list:
A dedicated privacy team that reviews new products
A separate board level privacy committee
A privacy impact assessment for every new or updated product, service, or practice prior to implementation
These restrictions provide companies with a blueprint of what the FTC will be looking for in privacy policies and procedures. With new privacy laws more common than not, companies would be wise to follow these best practices.
Will the FACEBOOK data privacy scandal set a precedent?
Marc Groman, a privacy professional on the International Association of Privacy Professionals (IAPP) Board, used to work at the FTC.
In 2015, Groman wrote on the IAPP site that he felt even though “…(FTC) settlements do not act as binding precedent for other companies,” companies shouldn’t ignore best privacy practices if they want to avoid being investigated.
He recommends companies take a look at the FTC’s casebook which lists at least 180 privacy and data security enforcement actions taken by the FTC.
As the de facto U.S. privacy and data security regulator, the FTC has asked the House Energy and Commerce subcommittee during a May meeting for more resources. It would use these resources to police violations and to increase authority to impose penalties.
Privacy Laws Just Keep Coming
At the May meeting, the FTC also asked Congress to create a national privacy law that would regulate how tech giants like Facebook and Google gather, store, and share the personal data of users.
While the commission and the rest of the world waits for Congress to pass a comprehensive privacy law, many individual states are clamping down hard to protect their residents.
The number of states with these types of data security laws has doubled since 2016.
Nevada and Maine have followed in California’s 2018 footsteps by passing new privacy protections for consumers.
Vermont in 2018 enacted a law that requires businesses that collect and sell or license personal information to third parties to disclose to individuals which data is being collected and to permit them to opt out.
Maine passed a law placing restrictions on how Internet service providers share Mainers’ personal information.
Nevada passed an amendment to its online privacy law. Businesses have to offer consumers a right to opt-out of the sale of their personal information. It will take effect on October 1, 2019.
New York, Washington and Texas each introduced similar bills to CCPA.
Other states with tough privacy laws are Utah, Delaware and Illinois.
According to the National Conference of State Legislatures, more than 100 privacy bills are currently pending in the states.
Privacy. It’s a public concern. Don’t ignore it.
Privacy naysayers believe that the public has thrown up its hands in light of all the data breaches.
But in the wake of the Facebook gaffe, the public’s concern over data privacy is increasing. Believe it or not, Americans are more concerned about it than job creation and health care.
Here are a surveys and studies that indicate the public does care about privacy:
Another study done by Deloitte Insights found that 70% of consumers would be more likely to buy from a company that was verified by a third party as having high data privacy standards.
Data is a company’s most strategic and valuable asset. Protect it.
Know your data: you can’t protect what you don’t know.
That means create a data inventory. This should include every piece of information stored or processed by your company, both electronically and/or hard copies.
Remember, you can’t comply with any law if you don’t know what data you have.
You should also make sure you know who has access to your collected data. And tell third-party organizations they will be monitored and held responsible for how they use the data.
Finally, complete a gap assessment to show you how likely you are to have an information breach. If you do this annually, you’ll be able to identify any business activities that are in non-compliance to privacy regulations.
Be the company that respects personal data
Customers will know you respect them when they see how transparent you are.
Twenty-page terms and conditions statements with data usage hidden for a single app download don’t cut it anymore.
Don’t hide security and privacy settings behind complex menus or bury them in Terms and Conditions. It looks suspicious. And more importantly, it frustrates customers.
Allow your customers the option of opting out anytime they feel uncomfortable.
Be open with customers on how their data can potentially be used.
Inform customers if you’re considering selling their data.
Get explicit customer consent when applicable.
Put the customers in control. Provide flexibility in the types of data they are able to share.
Conclusion: Be Proactive
The Facebook scandal has been so troubling because it highlights a massive transparency issue.
The lesson is to be proactive.
Reevaluate your data practices. Communicate them clearly and transparently to your customers. Stick to your word. You’ll come out stronger on the other side.
http://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.png00Jodi Danielshttp://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.pngJodi Daniels2019-08-26 09:00:422019-08-26 13:12:58Key Lessons from the Facebook Data Privacy Scandal: Be Transparent
OneTrust’s powerful suite of privacy management technology allows Red Clover Advisors to bring best in class technology and advisory services to serve small and middle market businesses
Red Clover Advisors, a national consulting firm advising businesses on operationalizing privacy as a competitive advantage, today announced a partnership with OneTrust, the largest and most widely used dedicated privacy management technology company. Red Clover Advisors can now provide further value to its clients through this partnership with OneTrust.
privacy compliance especially under the California Consumer Privacy Act (CCPA)
and the General Data Protection Regulation (GDPR) should be a key priority for
organizations today,” said Red Clover Advisors CEO and Privacy Consultant Jodi
Daniels. “Understanding how to start complying with privacy laws, building a
sustainable foundation, and extracting value through good privacy practices are
essential especially for small and middle market businesses. Our partnership
with OneTrust enhances the services we provide to our clients.”
Advisors’ relationship with OneTrust will enable consultants to leverage the
full OneTrust software platform including Assessment Automation (PIAs/DPIAs), Data
Inventory Mapping, Cookie Consent and Website Scanning, Data Subject
Requests/Consumer Rights Requests, Universal Consent Management and Incident
& Breach Response..
is coming in six months, now is the time for companies to get started
understanding their readiness and begin their data mapping activities. “Red Clover Advisors can use the
OneTrust Assessment Automation to create a baseline for what a client’s next
steps are per the law’s requirements. The Data Mapping tool will help companies
document in a central repository the data elements, flow of data through the
organization, security measures and any identified risks” said Ms. Daniels.
“Compliance with CCPA and GDPR also requires ongoing maintenance such as
updates to the data inventories. OneTrust’s software makes it simple to use
assessments to identify any updates necessary and changes can easily be made in
the data mapping module.”
“Together with Red Clover Advisors we can help their clients
address challenges, mitigate risks and create a foundation for privacy
compliance,” said Alex Anderson, Business Development at OneTrust. “This
partnership will provide small and medium sized businesses deeper understanding
about their privacy compliance needs and develops a right-sized practical
approach to serve them. Bringing
together OneTrust technology and Red Clover advisory supports these businesses as
they develop a dynamic privacy program that adapts to the changing privacy
For more information about how Red Clover Advisors’ can
support your company complying with GDPR, CCPA, or other US privacy laws,
please visit www.redcloveradvisors.com
Red Clover Advisors
Red Clover Advisors creates customized and affordable privacy
programs to fit the size and diversity of each business. Red Clover Advisors, a
certified Women’s Business Enterprise, is a privacy consultancy dedicated to
understanding the ins and outs of balancing customer data collection and
use, GDPR, CCPA, and US privacy law compliance, operationalizing privacy,
digital governance, online data strategy, and much more. Red Clover Advisors
makes the most complicated data privacy practices simple, helping businesses build
trust with their customers. Red Clover
Advisors believes privacy is just good business.
More than 2,500 customers,
both big and small and across 100 countries, use OneTrust to
implement their privacy, security and third-party risk programs, automatically
generating the specific record keeping needed to demonstrate compliance with
privacy regulations including the EU GDPR, California Consumer Privacy Act
(CCPA), Brazil LGPD, and hundreds of the world’s privacy laws.
OneTrust’s 700 employees
are located across co-headquarters in Atlanta and
in London with additional locations
in Bangalore, Melbourne, Munich and Hong Kong. To
learn more, visit OneTrust.com or connect on LinkedIn, Twitter and Facebook.
Just a few shortcuts and you’re the envy of your fellow entrepreneurs. A few things that aren’t quite playing by the rules, but no one has to know that. For now, anyway.
If you want to be more than a one-hit wonder, you already know what to do. Just because you can, doesn’t mean you should.
I know, privacy came in and messed up the marketing campaign you so meticulously designed. That list you worked so hard to build? Whether it was 50 or 50,000 deep, each and every one of those people had to opt in again before you could contact them.
You grumble about the hassle of it, but we both know that isn’t really the problem.
It’s how vulnerable we are when we have to ask that question. Again.
Yes means we’ve done well and held our subscriber’s interest. We’ve sent engaging material and offered more value than we’ve asked for sales.
No? Not the end of the world, but a reminder to do better.
This is your chance to do it and stop praying for a shortcut. Don’t tell me that’s all you’ve got.
The new privacy laws meant rethinking all of our campaign strategies. We had to pull back and re-evaluate how to maintain our reach and consider new ways to grow it. And while you might hate me for saying it, this is actually a good thing.
Emailing people who don’t want to hear from you is a waste of money. If you lost half your list, consider it a chance to invest in a more compelling campaign, language that will engage your subscribers and encourage new ones. Getting kicked out of your comfort zone is going to be the best thing that’s ever happened to you.
It means you’ll finally stop doing the same old song and dance everyone is doing.
How many times have you cringed at yet another email from someone whose list you never remember signing up for? How frustrated were you when, after scanning the email, there was no obvious way to unsubscribe?
We want to be treated like more than a piece of data and so do our customers. This all-too-familiar scenario is a lose-lose for both parties. Trust me, you don’t want to be that guy.
Ad tracking helps us learn about what our customers are interested in, but it is the equivalent of online stalking. I owe it to you to at least let you know that every step you take, every move you make, I’ll be watching you (couldn’t resist that Police song reference!).
And if I don’t? The real life equivalent would look something like this:
I follow you from your house to your job taking note of everything you do along the way.
I peer in through the window while you work to watch what you look up on your laptop and phone. Devious cackle optional.
I hang out at the coffeeshop across the street that you go to on your lunch break so I can pretend to run into you and take note of what you eat and drink so when I do it tomorrow it looks like a coincidence that we like the same things.
I show up at the gym you hit after work and write down what brand of trainers you’ve got on, what kind of bottled water you drink, and what you’re listening to on your headphones.
When you get home, you open your mailbox to find ploys to buy things exactly like everything you ate, drank, watched, listened to, or wore throughout the day in language similar to how you speak.
How awesome is that?
Rather than turn your nose up at privacy, you have the chance to see the value in boundaries, rise to the challenge and let it make you more innovative. Build trust with each customer that continues to grow with your business.
“Are you someone I can trust?” is the question every potential customer has as they scroll through your website.
It’s time you make sure your yes is loud enough they can hear it.
http://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.png00Jodi Danielshttp://redcloveradvisors.com/wp-content/uploads/2019/08/red-clover-logo.pngJodi Daniels2019-04-09 01:25:222019-04-12 13:40:19More than a Sweet Piece of Data: Marketing in the New Age of Doing Business