Magazine menu Close Magazine menu

Data and privacy

Latest stories

interconnected technologies ai, occupation, professionals, people wearing helmets, industrial

The next big business challenge: How organizations are preparing to secure AI

  • min read
    • Of all investments today, artificial intelligence (AI) is transforming enterprises, enabling them to provide improved services, automate processes and make better decisions. Business leaders must invest in the right tech at the right time, and have the people and systems in place that can guarantee success. AI will change most industries but also brings new risks and challenges in securing enterprises and safeguarding customers. Kaspersky's new research aims to help businesses stay ahead of the changes AI brings, published in this 2024 report, Connecting the future of business: How leaders should prepare for using and securing AI and interconnected technologies. About the interconnected tech research Kaspersky surveyed 560 IT security leaders in six regions – North America (US,) Latin America (LATAM: Brazil, Chile, Columbia and Mexico,) Europe (Austria, France, Germany and Switzerland,) Middle East and Africa (META: Saudi Arabia, South Africa, Turkey and United Arab Emirates,) Russia and Asia-Pacific (APAC: China, India and Indonesia.) Respondents were either aware of or involved in cybersecurity decisions about interconnected tech such as AI, web 3.0, data spaces, digital twins, augmented reality (AR,) virtual reality (VR,) 6G and internet of things (IoT.) They worked in organizations with at least 1,000 employees across many sectors. Kaspersky asked how they're introducing and securing AI and other interconnected technologies. Here's what the research revealed. AI is organizations' significant focus for the next two years AI is becoming a cornerstone for organizations striving to stay ahead thanks to its ability to foster innovation. In cybersecurity, AI offers predictive analytics and greater adaptability. Goldman Sachs says global investment in AI will reach 200 billion US dollars by 2025. AI is more than a technology. It's a strategy that lets organizations navigate today's complex business environment. AI adoption Nearly all organizations surveyed have already adopted (54 percent) or plan to adopt AI within two years (33 percent.) Respondents see Generative AI (GenAI) as valuable for improving security technologies' performance. Goldman Sachs economists Joseph Briggs and Devesh Kodnani say GenAI could boost global labor productivity by more than one percentage point yearly once its use becomes widespread. IT companies worldwide are upskilling their workforce and undertaking GenAI pilots to avoid falling behind. IT giants Accenture pledged three billion US dollars to data and AI investment, while French tech firm Capgemini is putting two billion Euros towards GenAI over the next three years. Securing AI 49 percent of organizations said they were extremely well, or well prepared, to secure AI. Almost 50 percent think AI is slightly or not at all hard to secure. Compared with securing other interconnected technologies, most organizations felt more prepared to secure AI. In responding to Kaspersky's survey, the head of cybersecurity at a Brazilian bank said, "I mostly don't find security problems with GenAI. We already understand how to run and train it." While many organizations feel confident in their ability to secure AI, a little over half felt less than well-prepared to secure AI. These businesses need to do more to prepare for the inevitable scale-up of AI-based technologies. AI makes digital trust and data compliance indispensable AI introduces new challenges and complexities in protecting sensitive data and maintaining digital trust. Digital trust is an aspect of customer trust. In Kaspersky podcast Insight Story, emerging tech security expert Malek Ben Salem described digital trust as, "Our confidence that our privacy is protected and secured, the reliability of digital transactions and how sure we are of the identities of those we engage with." Tech researchers McKinsey's 2022 Digital Trust report said 70 percent of people trust companies to protect their privacy, but most companies aren't meeting their expectations. Data breaches, unauthorized access and privacy violations can erode digital trust and lead to reputation damage, lost business and regulatory consequences. Building digital trust takes time but is essential to users' confidence in AI. How AI impacts digital trust AI lets organizations collect and store more data about customers, operations and interactions. This wealth of data helps gain insight but also means more risk of breaches. AI facilitates sharing data between devices, networks and organizations. Data sharing aids collaboration, efficiency and innovation but also means more opportunities for unauthorized access. As it is relatively new, organizations may struggle to be clear about their practices and security around AI. Without clear communication, trust may break down. Top ways organizations are improving digital trust and compliance Adopting zero-trust frameworks is organizations' top response to the need to improve digital trust, with 81 percent already using or planning to adopt zero-trust within two years. Other actions include pursuing data privacy and cyber resilience regulations (74 percent) and digital sovereignty initiatives (73 percent.) Kaspersky's research found companies introducing zero-trust frameworks are better prepared to secure AI and other interconnected technologies: 51 percent of zero-trust framework early adopters said they were extremely well-prepared or well-prepared to secure these technologies, compared with just 27 percent of the rest. The zero-trust canvas: Painting the future of cybersecurity The rise of AI is opening the door for organizations to break with all traditions that don't work for today's tech realities. Traditional cybersecurity is vulnerable to insider attack because it relies on trusting those within a network's perimeter while viewing outsiders as suspicious. Enter: Zero-trust frameworks. The head of IT at cloud provider Searce said, "The zero-trust security model is the only framework that works. The traditional security model can't do the job, especially for interconnected technologies." Under zero-trust frameworks, every user and device must undergo continuous multi-factor authentication (MFA) and authorization, regardless of their trust level. Users and devices get the minimum access needed for their tasks, with constant monitoring of user activity, device behavior and network traffic. Regulation and compliance With each territory having different data protection and privacy legislation, global organizations find it hard to achieve consistent standards around AI. 62 percent of leaders find compliance certification hard. They want to see standardized compliance processes across regulations and say online tools and platforms, with clear guidelines, would further simplify certification. Handling growing challenges and preparing to secure AI With the scale of change AI will likely bring, organizations must have a strategy to prepare themselves to adopt and secure it. Kaspersky research uncovered four effective strategies to ensure readiness to secure AI and other interconnected technologies: Adopting security by design principles, training and upskilling your workforce, upgrading your cybersecurity solutions and meeting regulation and standards. The full report, Connecting the future of business, details each strategy. Interconnected technologies like AI bring huge business opportunities but also a new era of vulnerability to serious cyberthreats. With more data collected and transmitted, cybersecurity measures must get stronger. Organizations can use effective strategies to safeguard critical assets and fortify customer trust amid a growing interconnected landscape. Leaders must also resource cybersecurity well enough to enable access to improved cybersecurity solutions that can meet oncoming challenges.
ransomware brazil, computer screen with code

The day ransomware nearly stole thousands of young people’s data in São Paulo

  • min read
    • There's an awesome purpose behind São Paulo, Brazil's 121 youth justice centers, Fundação CASA: Every day, they work with teenagers who have committed offenses and been given a court-ordered chance to learn to change their ways. But with 5,000 teenagers accessing a network of some 10,000 devices, Fundação CASA's information security and cybernetics team must manage a tinderbox of cybersecurity risk daily. 24 hours to escape a ransomware attack is the latest film in Tomorrow Unlocked's hacker:HUNTER Behind the Screens series. Fundação CASA's cybercrime fighters tell how they foiled a ransomware attack in a day, successfully safeguarding their young clients' personal data. There's much any organization or business can learn from their winning formula. Young people sentenced to learning When young people commit a criminal offense in São Paulo, the courts may sentence them to rehabilitation through learning how to escape criminal behavior patterns. That's where Fundação CASA comes in: They deliver that education on behalf of the Department of Justice and Citizenship. Meanwhile, the private data of the 5,000 teens who attend one of Fundação CASA's 121 centers must be kept secure. Julio Signorini has worked for Fundação CASA for over 20 years. He says, "As they're taught by the state, the teens' data comes under the Child and Adolescent Statute (ECA.) There's always a risk their data may be leaked." What is ransomware? There are many ways the young people's data could be leaked, including deliberate cyberattacks. Julio says, "A constant threat for us is ransomware: Malicious software that encrypts your data and demands you pay to recover it." To spread ransomware, attackers use social engineering to find users' vulnerabilities. Then the malware can spread across the network, eventually encrypting files and demanding a ransom. Ransomware is a growing threat. Kaspersky software detected over 21,000 ransomware strains and saw attacks rise 63 percent between 2021 and 2022 as a proportion of total attacks. Rapid response foils attack Julio explains how Fundação CASA's most recent ransomware incident began. "A young person brought in a compromised USB flash drive from home." Alex Christy Rogatti, Fundação CASA's Head of Security, remembers the day well. "It was a tense time because it was our first experience with ransomware, but we addressed it in one day." Julio says their fast response started with their young client's good decision to report something unusual. "The young person noticed his device behaving strangely and contacted our service desk, who quickly escalated the case to our information security and cybernetics team." Alex explains what happened next: "We isolated the infected device and recovered encrypted data on that device and our network. We isolated the malware so it couldn't spread further." Should you pay the ransom? Not every organization responds so fast and effectively as Fundação CASA. Proving there's no low cybercriminals won't sink to, 2023 saw some particularly vicious ransomware attacks, like a ransomware gang breaching Lehigh Valley Health Network in Pennsylvania, US, then leaking stolen photos and personal details of breast cancer patients. It's the severity of cases like these that tempts some victims of ransomware to pay their captors. Fundação CASA's Chief Information Security Officer (CISO) Odenilson Dos Santos Bonfim says, "Paying the ransom should be the last option. First, there's no guarantee they'll let you unencrypt your data when you pay. Second, paying the ransom encourages more ransomware. Third, you'd share financial information they may use in a scam or financial crime in future." To help ransomware victims and deter these kinds of attacks, Kaspersky is a found partner of the No More Ransom initiative. It offers free ransomware decryption tools and advice on how to prevent and deal with ransomware attacks. Reducing business vulnerability to ransomware Odenilson thinks there's much business can do to prevent more cyberattacks of all kinds. "We maintain an always up-to-date environment, with effective solutions for monitoring data and preventing any type of attack." That a user first raised the alarm about this attack shows the importance of a cyber-aware organizational culture. Odenilson says, "It's fundamental to encourage awareness, good market practices and publicize information security and cybersecurity information to your whole team and organization." How the ransomware attack on Fundação CASA was stopped echoes the importance of their work showing young people alternatives to a life of crime. By doing the right thing thanks to knowing what to do, one young person kickstarted the process that safeguarded their peers' precious personal data. The quick thinking and coordinated action of the service desk and information security and cybernetics teams shows how strong relationships make strong cybersecurity.
insight story digital sovereignty

Digital sovereignty and the rise of data spaces: What does it mean for business?

  • min read
    • Data. It seems businesses can't live with it – without big friction – and can't live without it. Cory Doctorow wrote for Secure Futures in 2020 that data – rather than being the 'new oil' – can fast become toxic waste, without due attention to minimization and proper management. Now data fuels almost every business, it's critical leaders understand the next evolution of data regulation – digital sovereignty – and how it applies to their work. It's not just about complying with the law, but an opportunity for competitive advantage with the bonus of enhancing customer trust. In our podcast Insight Story, experts Ben Farrand (UK,) Professor in Law and Emerging Technologies at Newcastle University and Sille Sepp (Finland,) Director of Operations at MyData Global, explore how business can do better in an increasingly interconnected world. Dr. Amin Hasbini of Kaspersky's Global Research and Analysis Team talks about the role of transparency in digital sovereignty, and why sharing intelligence makes good business sense. What is digital sovereignty, and what does it mean for business? Ben says, "Digital sovereignty is about geopolitics. We're seeing increasing tensions between states and concern over the power of big market players like Google, Amazon and Facebook in the US and Chinese companies like Baidu, Alibaba and Tencent. When data moves between countries, there may be detrimental impacts from geopolitics and national regimes, regulations or policies." Against this backdrop, the EU introduced its General Data Protection Regulation (GDPR) in 2016, providing that identifying, personal or sensitive data about EU citizens kept anywhere in the world is governed by EU law. GDPR and digital sovereignty more broadly mean companies must think about the legal implications of their cross-border interactions. Ben recommends firms wanting to trade more internationally have people dedicated to data security and digital sovereignty. "Companies handling EU citizens' personal data need someone aware of how to comply with GDPR's requirements. In the EU and UK, they're often called data protection officers. They must know data security protocols, and how data can and can't be used." Can state concerns and business interests align? Businesses often don't have the same priorities as nations. Is digital sovereignty making it harder to trade internationally? Ben says, "Digital sovereignty covers the whole supply chain from raw materials to cybersecurity services. For example, when supply chains for semiconductors collapsed during the pandemic, shutting some car manufacturers, the EU, China and the US started seeking more control of resources." But he questions the merit of attempts at strategic autonomy in today's world. Getting ahead of compliance with data ethics Digital sovereignty is on the radar for many businesses, but those who go the extra mile to do the right thing, rather than simply comply, may see advantages. Ben says, "We'll see both 'stick' and 'carrot' regulation. There's much legislation about investment, like the US CHIPS and Science Act, around how companies can cooperate and seek funding to diversify supply chains, for improving trade relations with third parties in ways that build resilience." Businesses should also note a growing focus on regulating social media platforms, given its role in communicating with customers. "The EU recently passed the Digital Services Act. It applies to content on social media platforms and search engines that may be illegal in member states, such as hate speech or trade in prohibited goods," says Ben. The legislation isn't concerned with individual instances of illegal content but requires social media platforms and search engines to have transparency, accountability and oversight systems. Ben sees benefits for business. "Companies don't want to be associated with illegal or immoral things. They already manage this by pulling advertising or moving over to other platforms. Digital sovereignty isn't just coming from regulation, but market-based decisions." AI and digital sovereignty The explosion of AI systems has made it even more important that organizations are clear on data ownership. Ben sees regulation in this field coming soon. "The EU is talking about regulating high-risk systems because they believe AI shouldn't be doing some things." And it's not just the EU. "At the AI Safety Summit hosted by UK Prime Minister Rishi Sunak in November 2023, there was an agreement between the EU, US, China and others to take a united approach in managing high-risk systems." Again, there are business opportunities. "New technologies arise from regulation like the 'federated computing' approach, where you train AI on data sets remotely then communicate only the outcomes centrally, minimizing data privacy risks," explains Ben. Making space for data security and data power All businesses want to use their data better for innovation and growth. But it may be challenging to do so securely, fairly and in ways customers trust. Data spaces are one tool for addressing safe and ethical data use while leveraging its power for better business. Sille Sepp is Director of Operations at human-centered data non-profit MyDataGlobal. She explains data spaces: "They're a systemic approach to increasing trust and sovereignty in sharing and using data across organizations and sectors. It's not just technological infrastructure but includes business, legal and operational layers for trustworthy data sharing." Examples include the Smart Connected Supplier Network for manufacturing supply chains and Catena-X for automotive supply chains. MyData is involved in a cross-data space project, Data Spaces Support Center, and preparing for the Data Space for Skills. Businesses can join projects as a data provider, data user or enabling service, or look at creating their own data space with collaborators. Sille recommends how to start: "As a partner in the Data Spaces Support Center, I recommend exploring the website, the repositories of initiatives and the contributing partners. Associations like International Data Spaces, Gaia-X and FIWARE have long mapped data space work." Data spaces go beyond EU-based businesses. "Many initiatives collaborate with international partners and look at business cases that will bring global benefits," says Sille. Sille highlights the need to put customer control of their data at the heart of developing data spaces. "When developing design principles and architecture for data spaces, we must embed human-centric principles. There are ways to empower people through design choices. Businesses can get involved as enabling services – intermediaries that serve the interests of individuals, managing permissions and returning value to them." Transparency's role in digital sovereignty Dr. Amin Hasbini of Kaspersky's Global Research and Analysis Team explains how tech businesses can use transparency centers to uphold different states' digital sovereignty worldwide. "Digital sovereignty means companies, especially multinationals operating in digital, need tools that comply with regulation in countries where they operate. As an example, Kaspersky operates transparency centers in several countries. These let entities check code to ensure it complies with their laws." But he thinks international firms can go further in building regulators' trust. Sharing also benefits the industry as a whole. "We publish many of our threat intelligence findings, which means better threat visibility for everyone. The cybersecurity community can build on our findings," says Amin. Taking the first steps into digital sovereignty Ben advises businesses to consider the basics as they start exploring digital sovereignty. "What data are you collecting and where does it go? Once you know that, you can think through the implications: Security provisions you may need to protect data within your company and outside. Think first about why you need this data, and that will help you define every step of the process." Let's be super clear: Digital sovereignty, like all matters of global trade, is complex. It's not an off-the-shelf charter or compliance checklist. Enterprises should grasp the opportunity now to get involved with data spaces and other cooperation projects to shape the new international standards for data. Digital sovereignty regulation will only grow – particularly around the use of AI. Businesses should think through how they use data and what security should be in place to safeguard it. Digital sovereignty also presents opportunities for better business, such as through data spaces and transparency initiatives.
lighting up dark web, fraud, low enforcement

How police identify criminals selling data on the dark web

  • min read
    • In the north of England, a team of officers are getting creative. They're finding ways to identify criminals selling personal data, fake COVID-19 vaccines and child sexual abuse images on the dark web. Tomorrow Unlocked's film Lighting up the Dark Web follows the UK's Yorkshire and Humber Regional Cybercrime Unit (RCCU) in their quest to unmask a crime ring selling personal data for fraud. What is the dark web? The dark web is a network of computers where web traffic is anonymized. Many use it to access marketplaces and other sites to commit crime. The dark web can also be used for good. Dissidents, whistleblowers and investigative journalists use it to communicate anonymously online, and others use it to avoid online data collection. The sale of personal data is big business on the dark web. The US's Federal Trade Commission reported consumers lost nearly $8.8 billion US dollars to scams in 2022. Linking dark web identities and real-world people In 2014, a trader called Data Pro was selling National Insurance numbers, dates of birth, credit card numbers and more on the dark web marketplace Evolution. RCCU suspected the source was a UK-based business. RCCU used 'slips' – when Data Pro occasionally used identifiable information – to link his clear web and dark web identities. How businesses can protect themselves from dark web criminals While the dark web seemed impossible to control in the past, law enforcement is now getting ahead. Businesses can also act to give fraudsters less opportunity to make dark web profits out of their data. First and foremost, protect your business's data from being stolen with strong data security practices, including encrypting your data and educating employees on how to avoid accidentally giving cybercriminals access. Your people are your most important security feature because most breaches start with basic errors like clicking a link in a rogue email or giving login details to someone who isn't who they said they were. If your data is already stolen and ends up on the dark web, dark web monitoring services like Have I Been Pwned may help you identify a breach and alert those whose information was stolen faster. As law enforcement becomes more cyber savvy, there are fewer places for cybercriminals to hide. Increasing international cooperation is also helping light up the darkest parts of the web. Businesses also have a part to play by reducing the opportunities for their data to be stolen and sold.
insight story, employer uses generative ai

How businesses can use generative AI to empower employees

  • min read
    • Headlines about the power of generative artificial intelligence (gen AI) are everywhere. But business leaders are asking, is it really that game-changing, or just a fad? And if it is a game-changer, how can you make the most of it? In the first episode of our second season of Kaspersky's podcast Insight Story, I speak with experts Shagun Sachdeva (India,) Project Manager for Disruptive Tech at business intelligence service GlobalData Plc and Karen Quinn (UK,) Senior Director, Brand and Corporate Communications at financial software providers, Finastra. What is generative AI? TechTarget defines gen AI as any "artificial intelligence technology that can produce various types of content, including text, imagery, audio and synthetic data." Some applications rely on Natural Language Processing so users can ask for outputs using everyday speech. Well-known examples of gen AI include OpenAI's chatbot ChatGPT and Google Bard, but current and potential business uses are near endless. Shagun thinks many businesses already understand its importance. "A recent GlobalData Plc survey found more than 50 percent of businesses expect gen AI will tangibly disrupt their industry in the next five years. 30 percent are already using gen AI tools." How are businesses using gen AI? "Business leaders are having more sophisticated conversations about how gen AI can go from an experiment to giving strong returns on investment," says Shagun. "Whether it's chatbots engaging with customers, sharing financial tips and customizing financial plans based on individual spending habits. It's also generating loan options based on a user's credit profile." Finastra plans to develop gen AI tools for customers in future, but they've started in-house with GENAI (X,) a gen AI-based system now rolled out to their 8,000 employees. "We use it for things like understanding and reviewing contracts, predicting behaviors and optimizing workflows," says Karen. She believes that although only being used internally so far, their gen AI tools are benefiting customers. "We can only work with the data we have to make financial decisions. Anything that can generate new scenarios, pull in more data sources or enable federated learning can only benefit." Is gen AI a threat to jobs? Shagun acknowledges employees worry AI might replace them. "Some of that anxiety may be justified – a Goldman Sachs report in March 2023 said AI could replace 300 million full-time jobs." But getting to know gen AI better may help overcome that concern. "Lean in to the technology. Education and training is key. Start with courses like prompt engineering." Karen refers to a quote from economist and professor Richard Baldwin, "AI won't take your job. It's somebody using AI that will take your job." In other words, it's not the technology itself that's a threat to jobs but failing to explore it and take full advantage of it. She advises looking at the benefits of gen AI broadly. "This is not an efficiency play. People will become more productive, but hopefully that means work is more rewarding." Getting gen AI right While generative AI offers much possibility, it also raises concerns around ethics, bias and data privacy. It is largely unregulated today and developing AI models can be resource-intensive. Karen highlights Finastra's caution. "We rigorously tested the products, then launched a full-scale training program and disabled other tools. They're still going through testing, like panels to try and break them and make sure no sensitive data gets shared with the wrong audiences." She continues, "In brand and communications, there are copyright issues. If you're using text-to-image prompts, where is it drawing data from? We need to be very careful." Materials used to train AI are often copyrighted, and whether people or businesses can copyright outputs of gen AI is subject to legal challenges in many countries, with some courts – including in the US and Italy – ruling no, at least in the case of visual arts. Balancing gen AI optimism with realism Shagun feels misinformation is the biggest business risk from gen AI. "It can fabricate 'facts' – what Google researchers call hallucinations." She also recommends businesses pay attention to copyright. "Disputes have arisen between artists and AI companies over the value of human creativity." Data privacy and security also rate highly for Shagun. "Large language models are trained on vast swathes of internet data. There's no data protection embedded in these systems by design or default. Training data can fail to include women, older people or marginalized groups – that's an ethical challenge." Security and generative AI Amin Hasbini is Kaspersky's Head of Research Center for its Global Research and Analysis Team (GReAT,) Middle East, Turkey and Africa. He says many employees are already using freely available AI tools, potentially without their employers knowing. "In a 2023 Kaspersky study, we found 57 percent of workers are using generative AI to save time. This raises many security questions. What kind of data are they putting into it? Is it intellectual property, code or documents to summarize? That's a major concern." Cybercriminals are also using generative AI to help them fool people with more realistic fake websites. In 2022, Kaspersky's anti-phishing system blocked more than 500 million attempts to access fraudulent websites – a doubling of attempts in the previous year. It's likely cybercriminals are already using generative AI chatbot ChatGPT's ability to produce convincing texts to create automated spearphishing attacks – phishing targeted at specific people. To protect against generative AI-based threats, Amin advises, "It starts with awareness. Employees need to know their organization's boundaries around putting data into AI websites. Businesses need enterprise cybersecurity solutions that allow monitoring and control of devices, systems and data used within the organization." Leading employee cybersecurity awareness approaches include implementing a cyber champions program or targeted education as used by Heathrow Airport. Gen AI's future potential What kinds of applications for gen AI will we see businesses pursuing in the near future? Shagun believes what businesses do today will decide the future of gen AI. "The world will look completely different by 2030. Global Data Plc estimates the AI market will be worth around 900 billion by 2030. But that doesn't mean carelessly diving in. "Gen AI is no magic bullet. While the enthusiasm around it is justified, prudence is imperative. We need responsible innovation," says Shagun. Karen imagines gen AI helping to make markets fairer. "Gen AI has incredible potential to overcome inefficiencies, like small-to-medium business (SMB) access to trade finance. Gen AI might be able to generate or automate some of the processes for onboarding smaller companies into global trade, opening them up to a wider audience." She also thinks gen AI could help solve some of the problems it's been known to introduce. "It can help identify bias through explainability and ensure we close feedback loops that cause biases. It could also look at efficiencies in supply chains, contracts and communications and marketing. It can take out some of the drudgery and enrich the processes." "We're on the cusp of understanding what gen AI can do," Karen says. "Who knows what the future brings? This could be game-changing in ways we can't even imagine." Like Karen and Shagun, as a creative marketer, I'm drawn between mostly optimism and a little fear about what gen AI will bring. As I wrote following a gen AI talk for marketers where I heard about Karen's exceptional AI program at Finastra, I'm optimistic we can do it right. Having the training, technologies and policies to bring the whole organization on the journey, we can use this tech to free us by shifting mundane tasks down to these somewhat smart bots. But in that shift, we may narrow opportunities – particularly for talent entering our industries – to refine their craft and learn the difference between average and distinctive output. Refined talent that generative AI lacks. For now, anyway.
unexpected data collection, GDPR, regulations

The one data privacy principle no one talks about

  • min read
    • Let's say there's a short form on your organization's website visitors use to sign up to receive company news. They're asked to give their name and email address. One day, you hear colleagues in marketing are going to add something to the regular company news email those sign-ups receive: Promotions of partner companies' products. Are your data protection alarm bells ringing? They should be, but if they're not, you're not alone. Purpose limitation is a data security principle many are unfamiliar with. Understanding it will help you reduce data security and data privacy risks and show your customers you respect their data. What is purpose limitation? Purpose limitation has two parts. First, when you gather anyone's personal information, your organization must be clear about how it will use the information from the start. Second, you must not use the data for another purpose. Much data protection regulation around the world includes some kind of purpose limitation requirements, notably the EU's General Data Protection Regulation (GDPR.) Under GDPR, organizations must document the data's purposes and specify the purposes in the privacy information they supply. But why does purpose limitation matter? Surely if someone chooses to give their data, your organization can use it without limit as long as you keep it private? Not so fast. This is one tin of spaghetti that fast turns into a can of worms. The young woman, the chaplain and the hospital Some privacy trainers tell a story about a young woman who was asked to fill in a form when she was admitted to hospital. One question on the form is asking for her religion. Perhaps this information is important in medical care and she's been asked this question on forms before, so she dutifully fills in her religion as she always has. Why the question? This hospital uses the information to tell the hospital chaplain there's a patient who may appreciate a visit, but they don't tell the patient this. Small world – the hospital chaplain is a friend of the young woman's family. She is unmarried and is in hospital for a pregnancy-related issue. Her family doesn't know she's pregnant and she has no intention of telling them. Now, the young woman and the chaplain are in an awkward position. Apart from infringement of data use regulation, some might say the woman had free choice over whether to give the information, so the results are her responsibility. On the other hand, the trust patients place in hospitals is crucial to the hospital being able to achieve its purpose: To help patients get well. Can organizations live up to the trust customers need to place in them? Data recycling happens all too often Several incidents around customers surprised how companies used or sold their data, given why they provided it, have hit headlines recently. Take for example, the period-tracker app that fed customer data to Facebook, where it was used to market products for expectant Moms. One user found herself suddenly marketed to as though she were pregnant, when she'd only forgotten to use the app to log her period. It's easy to imagine how this kind of sensitive information re-use could emotionally harm some customers. In 2017 Uber settled a complaint from the Federal Trade Commission out of court. Part of the complaint included that some employees had used the software's 'God View' function to track the movements of politicians, celebrities and even ex-partners. Although Uber hadn't sanctioned these misuses, it had no effective processes to prevent it. Do companies, and their employees, understand their responsibilities in limiting how they use customer data? Can you recycle personal data? What the law says GDPR is up front on purpose limitation being a core principle of data protection. Article 5 section 1b outlines how personal data must only be collected when its use is specified and explicit. The data cannot be further used in ways that don't match the original purpose. There's exceptions for historic, scientific and statistical uses, and "if the legitimate interests of that controller or a third party override the interests of the data subject." The European Commission gives guidance to help organizations know if what they're planning to do with data is consistent or inconsistent with its purpose. They suggest considering for example, whether the data is sensitive (including health information, political beliefs and more) and how further use could affect the person who gave the data. While penalties for breaching the purpose limitation principle so far haven't been huge, there's been a steady stream of reputation-damaging prosecutions. Norway's data protection authority fined the Norwegian Public Roads Administration the equivalent of 50,000 US dollars for using 'security' cameras to monitor contractors' work. Breaching the principle with just one customer's data doesn't mean lesser fines – Spanish authorities fined bank Bankia the equivalent of 50,000 US dollars for retaining and reusing one customers' data 16 years after they'd stopped being a customer. When considering fines, regulators punish not for violation of principle, but for the consequences. For example, if companies don't comply with data processing purpose limitation, they may also violate other GDPR requirements, such as having a legitimate reason to process the data. It's not just Europe that has enshrined purpose limitation in data use law. California added a purpose limitation clause to their California Consumer Privacy Act (CCPA) in 2018. The clause says businesses must, before collecting personal information, inform consumers how it will be used and need consumer agreement to use the data for another purpose. What do businesses do to meet purpose limitation obligations? "Every organization processes different kinds of personal data, in different ways, for different purposes," says Kaspersky's Head of Data Protection and Privacy for Europe, Alexey Testsov. "GDPR requires data controllers and processors keep records of what data the organization gathers, why they're gathering it and how long it's kept for. Alongside information auditing and data mapping, these records are vital in complying with purpose limitation responsibilities. "Employees must know how to collect, store and use personal data within the law. Given the high risks of data processing, it's more reliable to discuss changes in processes with a security officer or legal department. Employees should know how to consult internal experts and not be afraid to do so." Here are two examples of identified problems that can lead to failures to control data use purposes. Systems to keep data separate Effective safeguards to prevent any set of data being used for other purposes might have avoided some recent cases of data recycling. In the UK, the Information Commissioners' Office (ICO) fined a political campaigning organization and an insurance company 120,000 UK pounds (around 165,000 US dollars.) The ICO found personal information given for political campaigning had been used to market insurance. It highlighted ineffective data protection systems within the two organizations. "Systems for segregating the personal data of insurance customers' from that of political subscribers' were ineffective." Look for changes in how upgraded software uses data Hunter Nelson, President of Tortoise and Hare Software, says software developers should realize the potential privacy impacts of 'function creep.' He advises, "Controllers and processors must use care when developing systems not to breach privacy law as new features are released. A process checkpoint should be included in the release to review new features with a privacy lens." Regardless of the privacy legislation your organization operates under, knowing the importance of purpose limitation will help you uphold high data privacy standards. Ensure that when you ask customers for personal information, they understand how you will use it. Put in place systems to ensure their data cannot be used for other purposes. These actions will show your respect for customers' privacy and help build the trust that every organization needs.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries