Privacy considerations and ISO 27701

ISO 27701 is an international standard that helps organisations manage and protect personally identifiable information (PII). It builds upon ISO 27001 – Information Security Management Systems (ISMS) by providing specific guidance on implementing, maintaining, and continually improving a Privacy Information Management System (PIMS).

Having recently reviewed the standard and the options to update an ISMS to include PIMS and considering working towards obtaining the ISACA Certified Data Privacy Solutions Engineer (CDPSE) qualification, this article contains a selection of issues that could severely impact privacy. I don’t intend this article to be exhaustive but rather to provide a good overview of things to consider when implementing this standard, conducting privacy-related audits, or complying with other legislation such as the General Data Protection Regulation (GDPR).

Inadequate incident response

A poorly defined or inadequate incident response plan can lead to delayed or improper handling of privacy breaches, escalating the damage and complicating recovery efforts. An ineffective response can erode trust and result in significant legal and financial repercussions. Swift and efficient incident response is critical for mitigating the impact of privacy breaches. Countermeasures include:

• Create and maintain an adequate incident response plan.

• Conduct regular drills to ensure all employees understand their roles and responsibilities.

• Update the incident response plan to reflect current threats.

Third-party risks

Failing to conduct third-party due diligence properly can lead to privacy breaches. If third parties do not adhere to the same privacy standards, they can become a weak link in data protection. Uncontrolled third-party access can expose sensitive information to significant risks. Countermeasures include:

• Conduct thorough due diligence and regular audits of third-party vendors.

• Include strong privacy and data protection clauses in contracts with third parties.

• Continuously monitor and assess third-party practices.

Insufficient access controls

Granting employees unnecessary access to sensitive information increases the risk of data breaches. Excessive permissions can lead to both accidental and malicious data misuse. Unrestricted access can result in significant vulnerabilities and data privacy issues. Countermeasures include:

• Implement the principle of least privilege, ensuring employees have access only to the data necessary for their role.

• Regularly review and adjust access controls based on changes in employee roles.

• Use role-based access control (RBAC) to manage permissions.

Unsecured transmission

Employees might bypass encryption and other data protection measures to complete urgent tasks. This oversight often stems from cumbersome technology, recipients unable to handle encrypted messages, or insufficient training on secure data transmission. Unsecured data transmission increases the risk of interception by unauthorised parties, potentially leading to data breaches. Countermeasures include:

• Conduct regular training and support.

• Ensure privacy protection technologies are user-friendly.

• Provide comprehensive support documentation to help resolve common problems.

• Clearly defined responsibilities and accountabilities.

Weak password practices

Using weak or shared passwords among team members increases the risk of unauthorised access. Password reuse across multiple platforms exacerbates this vulnerability. Weak password practices are a common entry point for cyberattacks, compromising data security. Countermeasures include:

• Implement a policy that requires complex passwords.

• Use multi-factor authentication (MFA) to add an extra layer of security.

• Provide training on password practices.

Lack of regular audits

Businesses may fail to identify vulnerabilities or comply with privacy policies without regular audits of privacy practices and data handling processes. This oversight can lead to significant privacy breaches and regulatory penalties. Regular audits are essential for maintaining data security and compliance. Countermeasures include:

• Perform regular audits of privacy practices and data handling processes.

• Use audits to ensure compliance with privacy policies and regulations.

• Proactively identify and address potential risks through audits.

Neglecting data retention and disposal policies

Failing to comply with retention policies will increase exposure in a data breach. Employees might leave sensitive documents unsecured or neglect to wipe data from old devices, leading to significant privacy breaches if the data falls into the wrong hands.

Countermeasures include:

• Develop and enforce policies for secure data disposal.

• Ensure that you shred, wipe, or render irretrievable all sensitive information before disposal of equipment.

• Conduct regular audits and provide training on proper data disposal practices.

Sending files to incorrect recipients

One of the most prevalent issues is the accidental transmission of sensitive data to the wrong email addresses. Email software that auto-adds addresses from previous contacts increases the likelihood of such errors, usually discovered only after the fact. This mistake can result in unauthorised individuals accessing sensitive information, leading to significant privacy breaches. Countermeasures include:

• Encourage employees to double-check recipient addresses.

• Implement email verification steps before sending to unfamiliar addresses.

• Use email prompts for confirmation.

Social engineering attacks

Employees may become victims of social engineering attacks, such as phishing, which can lead to the inadvertent disclosure of sensitive information. Social engineering exploits human psychology to bypass technical security measures. These attacks can significantly compromise data privacy. Countermeasures include:

• Provide regular training on recognising and responding to social engineering threats.

• Implement multi-factor authentication and email filtering.

• Improve awareness and vigilance among employees to defend against social engineering.

Lack of privacy by design

Not incorporating privacy considerations into designing new systems, products, or processes can lead to vulnerabilities and compliance issues. Overlooking privacy in the development stage can result in significant risks and challenges. Privacy should be a foundational element in all business systems. Countermeasures include:

• Integrate privacy by design principles into project management and development processes.

• Conduct privacy impact assessments during the early stages of any new initiative.

• Ensure privacy is built into systems and processes to prevent future issues.

Collecting too much data

Despite clear privacy policies, employees may forget the specifics amidst their busy schedules. If employees collect more data than necessary, it risks privacy incidents and potential legal repercussions for not adhering to the company’s privacy commitments. Over-collection can lead to storing unnecessary data, increasing the risk if this data is compromised. Countermeasures include:

• Educate employees on the principle of data minimisation.

• Encourage the use of internal identifiers instead of government IDs.

• Implement techniques like truncating, masking, or scrambling data.

• Provide regular reminders and training on data minimisation.

I have lost count of the number of firms that have asked me for my date of birth when there is no legitimate need for them to know or store such information. Some businesses even ask people to confirm their date of birth when they don’t already have it so they can add it to their records.

Inconsistent business processes

Rapid business responses can lead to changes not being communicated, resulting in processes not aligning with documented privacy policies and exposing the company to legal and civil actions and operational risks. Unvetted changes can lead to significant vulnerabilities and compliance issues. Countermeasures include:

• Establish a robust change control process, including privacy impact assessments.

• Document all changes in a central repository.

• Ensure all changes are vetted and documented to maintain alignment with privacy policies.

Being overly helpful

Employees often go above and beyond to meet clients’ needs, sometimes sharing more personal information than necessary. This well-meaning behaviour can expose sensitive data to unauthorised individuals. Without proper guidelines, employees might not recognise the limits of information sharing, inadvertently causing privacy breaches. Countermeasures include:

• Provide continuous and targeted privacy training.

• Conduct follow-up sessions and periodic knowledge checks.

• Ensure employees are aware of what information is appropriate to share.

Multitasking

Juggling multiple system windows heightens the risk of privacy incidents. Employees might enter data into the wrong screen, leading to incorrect data transmissions. This error is often due to distraction or confusion, increasing the likelihood of privacy breaches. Countermeasures include:

• Encourage focused work practices and limit multitasking.

• Implement system controls that highlight or lock fields for sensitive data.

• Establish mindful data handling.

Employee turnover and onboarding

High employee turnover can lead to lapses in privacy training and knowledge transfer. This gap can result in an increased risk of privacy incidents and non-compliance. Countermeasures include:

• Ensure comprehensive privacy training during staff onboarding.

• Conduct regular refresher courses to maintain knowledge continuity.

• Maintain up-to-date documentation and resources for employees to reference.

Building a privacy culture

Addressing privacy risks is a continuous effort that requires a team-wide commitment across the business. Collaboration among various business units is essential to build strong relationships, identify privacy challenges, and develop training and practical resources. In response to incidents, it is critical to assess control failures to minimise the likelihood of future occurrences. Please remember that improving privacy controls is a continuous journey, not a destination.

Although I am currently focusing on integrating ISO 42001 into ISO 27001, I see a more long-term strategy that includes ISO 27001, ISO 42001, and ISO 27701 working together as a combined management system.