A new study suggests that many American companies haven’t absorbed the lessons taught by their botched compliance with the EU’s GDPR last year. Procrastination and the lack of a unified and clear strategy to deal with the issues of data privacy over multiple systems and services are once again hampering efforts at compliance, this time for Calfornia’s Consumer Privacy Act.
Philip Bantz reports that many US companies stumbling in their preparation for the Calfornia law’s deadline in this article published in Law.com:
About half of the survey respondents whose companies are affected by GDPR revealed they had failed to meet last May’s deadline to comply with the regulations—and 70% said the data privacy compliance systems they established or plan to have in place are incapable of adapting to new regulations.
“The interesting thing here was that, in preparing to become GDPR ready, a lot of the companies tried to build something in-house to try to scramble, if you will, to become GDPR ready,” said Daniel Barber, co-founder and CEO of DataGrail.
The San Mateo, California-based data privacy management software company surveyed 301 U.S.-based privacy professionals in information technology, operations, legal, and risk and compliance in April for its report, “The Age of Privacy: The Cost of Continuous Compliance.”
While most respondents reported it took them at least seven months to prepare for GDPR, 71% believed they could be ready for the California Consumer Privacy Act compliance deadline in less than six months. The CCPA deadline is Jan. 1, 2020.
The majority of companies are still approaching privacy regulations on a case-by-case basis, and half are using manual processes to manage GDPR privacy rights requests, which often involves a couple dozen employees and “thousands of touch points with the potential to introduce human error,” the report states.
Barber said the study’s findings show that “most companies still rely on piecemeal technology solutions and manual processes, when they should be turning to privacy management solutions purpose-built for privacy regulations.”
