What Is Personal Information?
At its most basic level, personal information simply means information about a person. Some types of personal information identify, or can be used to identify, a person – for example, a name, password or social security number. Other types of personal information help describe the person – for example, religious beliefs or location information.
Privacy and data breach laws take this basic definition and modify it, frequently to focus on more sensitive types of personal information. How your company handles customer personal information – and sensitive personal information in particular – can make a difference in everything from legal risk to customer trust.
The Importance of Protecting Data
A company that fails to safeguard and responsibly use its customers’ personal information faces the potential for fines or legal damages under federal, state, or even foreign laws, such as certain Unfair and Deceptive Acts and Practices laws, the recently enacted California Consumer Privacy Act of 2018, and European Union General Data Protection Regulation.
It's important to know and understand what these laws say and whether they apply to your business. With the multitude of laws that may apply, it’s always a good idea to consult with a legal professional specializing in privacy law.
Protect Your Customers
The United States Federal Trade Commission which is the chief federal data privacy and security regulator in the United States, recommends the following steps to protect personal information, whether paper or digital, from unauthorized use or disclosure:
- Take Stock – assess the personal information you have and identify who has access to it.
- Scale Down – only keep personal information that you legitimately need to conduct your business, and then for only as long as it’s necessary.
- Lock It – put appropriate protections and safeguards in place to protect the personal information you need to keep.
- Pitch It – properly dispose of personal information to ensure that it cannot be read or reconstructed.
- Plan Ahead – create a plan for responding to data security incidents.
In addition to appropriately securing personal information, it is important to have proper governance in place – a privacy policy – to help ensure that your use of your customers’ personal information is appropriate. It’s also a good idea to have a privacy notice to let your customers know about your privacy practices. These documents are a promise to your customers and can be quite detailed. If your business does not have one in place, it’s a good idea consult with a legal professional.
Any time you change or update your policy or notice, it’s important to let your customers know of any significant changes. When you change things without notification, you risk breaking your promise. This creates legal exposure and potentially harms your customers.
Protect Your Business
Cybersecurity breaches can happen at any time. One way to reduce your company’s risk in the event of a cybersecurity breach is by purchasing appropriate insurance coverage. For instance, Selective offers Cyber Liability Insurance cover to mitigate loss and help your business recover.