When we think of “data privacy,” it’s often in the context of an ever-increasing combination of consumer data: information about peoples’ health, education, purchasing activities, location, finances, etc. The right to privacy — to protecting that data from third parties that may use it for unauthorized purposes — has been made explicit by emerging laws and regulations such as the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the United States. Since many office workers moved to remote status, it’s become clear how much data is being generated through virtual communications platforms like Slack, Microsoft Teams and Zoom. The privacy and security of our daily work chats are just as important as our browser history. Somewhat paradoxically, financial industry regulations imposed by the SEC, FCA and FINRA require firms to collect and store all business-related electronic communications data. Outside of the regulatory obligation, enterprises in a variety of other industries proactively collect and preserve employee and client communications data. This information can serve as a valuable source of truth in the case of potential legal and security risks, which many large companies consistently face. When analyzed, communications data can elicit patterns, trends and business opportunities as well. The scope of that data has expanded widely and sometimes collides with tools commonly used by individuals for personal purposes. As more data is collected, companies must find innovative ways to discern between work-related and personal communications. Data privacy laws are expanding throughout the world and will be increasingly important as more of our lives take place online. The initial thrust of many data protection laws is to protect the rights of personal data. And companies that preserve and monitor employee and client communications are not exempt. According to a Gartner 2018 survey “The Future of Employee Monitoring,” more than half of large enterprises surveyed use “some type of nontraditional monitoring techniques,” including “analyzing emails and social media, gathering biometric data, and understanding how employees are using their workspace.” In a June 2020 blog post on the future of work trends, Gartner noted that 16% are using these approaches more frequently since the start of the pandemic. Applying supervisory practices beyond the industry-mandated domain means opening the aperture to view policy violations and vulnerabilities across multiple functions and business processes. Legal, HR, infosec, audit and investigative teams are all engaged in spotting red flags that range from loss of intellectual property, security exposures and privacy violations, to a variety of workplace policy infractions. Before the pandemic, each of these departments typically held their own budgets, risk priorities and tools. The result is a plethora of siloed approaches to managing risk and massive duplication of stored data and associated costs. As we’ve seen from some widely publicized communications snafus, digital communications are changing that dynamic: Consider that these examples arose while, on average, less than 25% of employees were working remotely. Similar mishaps will increase in frequency, variety and potential severity now that nearly everyone is working remotely. From every mobile device, on every downloadable app, and likely in many virtual meetings, individuals could be violating company policies at this very minute. Distributed work environments elevate the need to understand the behaviors of employees to a level never seen before. The result has been more firms acting in unison to share resources, tools and business practices to identify and mitigate risk. How can enterprises reconcile evolving privacy laws with risk management processes and regulatory obligations? To prepare for increasing data volume and variety while also focusing on data privacy, we recommend: Understand your data: the sources, features, users Update policies to reflect all sources used for business purposes Train employees on GDPR, CCPA and other applicable requirements Tune oversight processes to reflect higher risk areas Leverage AI/surveillance to uncover dark data locations Employ a scalable, content-agnostic solution for communications preservation and monitoring Share this post! Our internal subject matter experts and our network of external industry experts are featured with insights into the technology and industry trends that affect your electronic communications compliance initiatives. Sign up to benefit from their deep understanding, tips and best practices regarding how your company can manage compliance risk while unlocking the business value of your communications data.How to Manage Information Risk and Protect Data Privacy in the Enterprise
Addressing the risks in employee communications
Managing risk and protecting data privacy
How does your company engage with customers? What are the tools being used by frontline staff? What personal data can staff collect using those communications tools? Consider analyzing network traffic and scanning corporate devices to uncover what is actually in use as employees are often not forthcoming about the fact that they may be using “unapproved” communications platforms for business conversations. Interactions and engagement now take place across a complex web of channels and devices. You should be aware of all the locations where personal information might ultimately reside and the various dimensions included within that data.
In addition to consent policies, ensuring that internal communications policies are current and reflect how personal data should be managed is central to any privacy mandate.
Training programs should be built out specific to privacy regulations. Related to CCPA, providing users and data managers with an overview of requirements can remove ambiguity when it comes to the consequences of potential policy violations.
Business conversations are happening in a multitude of places. Like traditional email or chat, collaboration and conferencing platforms and encrypted messaging applications should be centrally managed so IT can monitor and protect personal information across all channels.
Without AI-enabled surveillance and compliance tools, companies may find it difficult to address the risks that lie within new and various communications channels. Advanced analytics, language models and surveillance technology can help extend oversight processes with precision — so that only the most relevant information is surfaced.
Without access to your communications data, it will be increasingly harder to manage and protect it. An end-to-end solution for capturing, archiving, supervising and analyzing today’s mixture and volume of communications that makes that data available to myriad applications via APIs is a critical tool for a modern, global enterprise. An organization with those capabilities can use data to safeguard the privacy of its customers and employees, prevent costly fines, and protect the company’s reputation.
Smarsh
Scalable for organizations of all sizes, the Smarsh platform provides customers with compliance built on confidence. It enables them to strategically future-proof as new communication channels are adopted, and to realize more insight and value from the data in their archive. Customers strengthen their compliance and e-discovery initiatives and benefit from the productive use of email, social media, mobile/text messaging, instant messaging and collaboration, web, and voice channels.
Smarsh serves a global client base that spans the top banks in North America and Europe, along with leading brokerage firms, insurers, and registered investment advisors. Smarsh also enables state and local government agencies to meet their public records and e-discovery requirements. For more information, visit www.smarsh.com.Latest posts by Smarsh (see all)
Smarsh Blog
FEATURED CONTENT
More Resources
Watch it Work
Contact Us
Chat
Subscribe to the Smarsh Blog Digest
Subscribe to receive a monthly digest of articles exploring regulatory updates, news, trends and best practices in electronic communications capture and archiving.
Smarsh handles information you submit to Smarsh in accordance with its Privacy Policy. By clicking "submit", you consent to Smarsh processing your information and storing it in accordance with the Privacy Policy and agree to receive communications from Smarsh and its third-party partners regarding products and services that may be of interest to you. You may withdraw your consent at any time by emailing privacy@smarsh.com.
FOLLOW US