df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

The software’s latest features will help users bolster their data security.



If you happened to catch Apple’s initial June 4, 2018 announcement of iOS 12, you might have noticed that it was lacking the “big splash” that we’ve seen from other iOS announcements. That’s partially because Apple was so busy focusing on new iOS 12 data security features.

Though more is to be unveiled at the September 12, 2018 Apple Keynote event, many of the features of iOS 12 that have been revealed likely won’t catch the average consumer’s attention. That’s intentional. Good data security features are relatively unnoticeable to most users. If anything, those features in Apple’s newest mobile OS will make life a little bit easier for the average iPhone user.

But, if you happen to be an IT or security pro, the new iOS 12 probably piqued your interest.

This emphasis on personal data privacy and security from Apple prompts one question: is iOS 12 the most secure operating system Apple has ever released?

In a word, yes. Let’s dig into what makes it so secure.

## Better Anti-Hacking Technology for Data Privacy

One of the biggest changes Apple is making to the new iOS’s security is the introduction of USB Restricted Mode. 

On iOS 11 and earlier iOS versions, USB-based communications stay active for up to seven days after the phone is locked. This means that if an iPhone is stolen, the would-be hackers have seven days to plug a brute force device, such as GrayKey, into the phone and force it to unlock.

_[The New York Times](https://www.nytimes.com/2018/06/13/technology/apple-iphone-police.html)_ calls this seven-day window a massive security vulnerability in iOS 11.

The good news is that Apple is closing this window. With USB Restricted Mode on iOS 12, Apple is reducing the time for USB-based communications to just one hour after the phone is locked. 

That makes a brute force attack on iOS 12 nearly impossible. According to one app developer we talked to, “USB Restricted Mode essentially turns the phone into a battery-powered brick after one hour.” Unless the phone is unlocked by an authorized user in that hour timeframe, it’s useless to would-be hackers.

To illustrate this further, if an employee at your company has their iPhone stolen with iOS 11 on it, there’s a very good chance the thief will be able to gain access to the phone within seven days. However if iOS 12 is installed, the thief will only have one hour to attempt a brute force attack. The chances of that being accomplished in an hour are very unlikely. 

This data privacy feature is automatically turned on in the new OS, but Apple does give you the option of disabling it:

![Turn USB Restricted Mode Off in iOS 12](https://images.ctfassets.net/23aumh6u8s0i/43Cy7OyrsRaEn2felz1YVf/dce0db81be1260e1be29ba15fad941c2/ios12-usb-restricted-mode-off)

_[Image Source](https://www.macrumors.com/how-to/access-controls-usb-restricted-mode-ios-12/)_

We're excited by both the strength and flexibility of this for greater personal data security.

## Password Reuse Auditing

As is the case with any data security system, humans are the weakest link. If you develop the best tools in the world but the actual human operators aren’t using it, then it’s worthless.

That’s why Apple is trying to make password management as simple as possible in iOS 12. One of the features that makes this easier is Password Reuse Auditing. This feature monitors the passwords that iPhone owners use for different services. When it catches someone [using the same password on different websites](https://www.godaddy.com/garage/10-best-practices-for-creating-and-securing-stronger-passwords/), it flags the duplicate, offers a more secure password, and then saves it to the iCloud Keychain.

![iOS 12 Password Autofill - Password Reuse Auditing flag present on online service](https://images.ctfassets.net/23aumh6u8s0i/4xFwJwR593h6HlGI5SjAo/59a1d22b1766872c1ecc233dcf3a8cac/ios-12-password-reuse-auditing-flag-present-on-online-service)

_[Image Source](https://www.macrumors.com/how-to/automatic-passwords-and-auditing-in-ios-12/)_

The issues with using one password across different websites are well documented. Security experts have been trying to get around these issues for years and Apple is doing their best to help. Auth0 offers secure authentication using [token-based, passwordless authentication](https://auth0.com/passwordless) that features a brute-force protection system.

### iCloud: The Elephant in the Room

At first glance, this iOS 12 security feature seems slightly less secure. For this feature to work, Apple has to record your current passwords and be able to crawl them for matches. While at the same time, Apple stores everything in the iCloud. 

That concern caused Apple to make this system as secure as possible. This feature uses a highly secure 256-bit AES for encryption. 256-bit AES is nearly impossible to crack. It’s actually the same encryption standard that the US government uses to transmit top secret data. It seems that Apple is pretty serious about security. 

In addition to using the uncrackable 256-bit AES, Apple also recommends users enable two-factor authentication for their iCloud Keychain. That combination makes it extremely unlikely that some nefarious individual would be able to compromise the iCloud. 

Speaking of two-factor authentication…

## Making Two-Factor Authentication Easier

_[Two-Factor Authentication](https://auth0.com/learn/two-factor-authentication/)_ (2FA) is the next big security feature in iOS 12. 

For years, data privacy experts have been begging and pleading with website users to set up 2FA. It's one of the best ways to [protect individuals and small teams from cyber attacks](http://blog.idonethis.com/security-ringcaptcha/). Adoption has still been relatively low because 2FA adds an extra step for users.

The most common type of Two-Factor Authentication is SMS text message 2FA. This authentication protocol sends users a text with a passcode before they are granted access to a system.

The problem is, it requires a lot of switching back and forth between apps to get the code, memorize the code, and then plug it into the app. And, if the user mistypes or misremembers the code, then it's back to square one.

Luckily, Apple is coming to the rescue. With iOS 12, SMS security codes will autofill without the user having to switch from app to app. No memorization, either. It does this by making specific API calls to the messaging app. When iOS 12 recognizes an SMS 2FA security code, it will automatically pull it into autofill for the user. 

![iOS 12 SMS 2FA security code and autofill example](https://images.ctfassets.net/23aumh6u8s0i/5fZy2u7OvyQocoyZ7jLsLh/225753ebf85204d06fa4e6ddc2ad7feb/ios-12-recognizes-an-sms-2fa-code-and-autofills-it-for-user)

There is one downside here. It has been well established that SMS 2FA can be compromised. We recently mentioned this _[in a post about a Reddit data breach](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/)_. Even still, any 2FA is better than no 2FA. With Apple including this feature in iOS 12’s security, they’ve made users significantly less prone to hacking.

## What Else is New in Data Security for iOS 12?

There are a few other security features worth mentioning in iOS 12. First up is group video chat. What makes this a security feature? Facetime is fully encrypted and extremely secure. Adding group chat to Facetime simply means that Apple is now supporting fully encrypted group chats. 

Apple also introduced a new Face ID feature. The tech company is giving iPhone owners the ability to add a “second face.” This allows two different users to unlock an iPhone using Face ID. We’ve covered the _[security of Face ID](https://auth0.com/blog/is-faceid-really-secure/)_ is another blog post. It’s good to see Apple improving upon this feature.

## Final Thoughts iOS 12 Release

We’re really impressed with Apple’s new iOS 12 security features. Not only are they making the operating system more secure, they’re making security easier to use. That combination is one that security experts are always after. Be looking for "A new iOS update is now available" as iOS 12 will be released soon.

<include src="asides/AboutAuth0" />


Apple iOS 12: Is it the Most Secure iOS Ever?

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The essential tools for managing user identity and how they impact your bottom line

Customer Identity and Access Management (CIAM) is how companies give their end users access to their digital properties as well as how they govern, collect, analyze, and securely store data for those users.

CIAM sits at the intersection of security, customer experience, and analytics. Providing an easy, frictionless way for users to onboard and log in is critical for driving conversions and building customer loyalty. Protecting sensitive data from malicious intrusion and taking steps to prevent data breaches is central to a sound security policy and compliance with data privacy laws. And compiling user data into a single source of truth is essential to understanding your customers.

Given CIAM’s complexity and dynamism, many organizations choose to engage a third-party [Identity-as-a-Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider rather than build a solution in-house.

Below, we’ll discuss the elements of a modern CIAM solution and how your company’s approach to customer identity can impact top-line revenue as well as mediate bottom-line security risk.

<iframe width="560" height="315"" src="https://www.youtube.com/embed/belLEwjr9zQ" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## Essential Elements of CIAM

Organizations need Identity and Access Management (IAM) solutions for several classes of end-users: employees, enterprise customers, and customers. But each type of user requires a different balance of security and user experience (UX). That’s why CIAM solutions provide a unique set of features distinct from B2B or workforce identity solutions.

Here are four features that form the bedrock of modern CIAM solutions. No two CIAM solutions offer exactly the features in the same way, but if you’re purchasing a CIAM platform, it should include the following:

### Scalability

Unlike workforce identity solutions that support thousands of employees and vendors who require fairly static access to a pre-assigned list of applications, CIAM has to scale to millions of users — often in response to short-term events like peak holiday seasons or major sporting events.

Although not traditionally described as a software “feature,” scalability is a unique element of CIAM that requires third-party, cloud-scale stability.

### Single sign-on
Single Sign-On (SSO) allows users to log in to one application and automatically be logged into a set of other applications. The most widely known SSO example is Google G Suite, where logging into your Gmail means you’re automatically logged into YouTube, Google Drive, and other Google platforms.

SSO is a basic element of federated identity, and there are SSO options for B2B and workforce IAM solutions. The type of SSO that’s specifically designed for end-users is [social login](https://auth0.com/learn/social-login/), which allows users to verify their identity with their credentials from a separate provider, like Facebook, Google, or Apple.

![Enabling Social Connections](https://images.ctfassets.net/23aumh6u8s0i/3q11XLTm7JG97Zui0NdS83/69c34978d5b60a9fbfaceb42459b0334/enabling-social-connections)

Social logins greatly simplify the registration process for users, which can lead to increased conversions and fewer customers abandoning their shopping carts because they got tired of filling out a form. (More on the advantages of SSO later.)

### Multi-factor authentication

Multi-Factor Authentication (MFA) is a more secure means of authenticating user identity than the traditional username/password combination. Passwords are distressingly easy for hackers to steal or guess, so MFA demands an extra credential for users to prove their identity. This could take the form of a one-time PIN sent to the user’s mobile device, an email, or a biometric credential like a fingerprint or face recognition. Auth0 is even releasing a feature in which users can receive a phone call with a voice message of their one-time PIN.

![MFA Voice Recognition 1](https://images.ctfassets.net/23aumh6u8s0i/4uESmkHbV2FMThLWcAvqsi/90e5f72b2eca085e8bae37d60179c2b6/mfa-voice-recognition-1)

![MFA Voice Recognition 2](https://images.ctfassets.net/23aumh6u8s0i/3BLSbVxpLMYbflpxDk3FSb/2c52471683ca8c9b763ca4138504f829/mfa-voice-recognition-2)

![MFA Voice Recognition 3](https://images.ctfassets.net/23aumh6u8s0i/3F0G4n8bUa3BIAUQg7xuHm/7a770f40b2b958f1001a1c932408d119/mfa-voice-recognition-3)

MFA is increasingly regarded as a basic requirement for security, and data privacy laws are beginning to explicitly demand it. However, it’s critical to implement MFA for end-users in a way that doesn’t introduce unnecessary friction. MFA should only be triggered based on the assessed risk, such as when a customer signs in with a new device or makes a suspicious transaction. That’s another reason why it’s critical to have the deep insight into your customers that CIAM provides. So you can assess in context when a transaction requires a higher level of authentication.

### Centralized user management

Your insights into your users can be a major competitive advantage, but only if your data is organized, accessible, and accurate. A CIAM solution helps achieve the goal of centralized, data-rich customer profiles that function as a single source of truth about users. That’s because a CIAM solution is essentially an API that mediates between different applications and components, compiling heterogeneous data in one place.

Centralized user management eliminates data silos and duplicate data. Everything you know about a user is together in one place from which admins can quickly grant and revoke permissions. This single view of customers is an obvious advantage for analytics, but it also helps companies meet the reporting requirements of data privacy laws because all profile data is accessible and portable. Knowledge about the user is also critical for building more personalized experiences, which drives higher retention rates.

![Centralized User Management](https://images.ctfassets.net/23aumh6u8s0i/okSReaVDL4OSDzKC20Kiv/db01bde2e4bfef2b6c5eb85f8b7000fa/logins)

## How CIAM Impacts Business

Now that we’ve gone over the fundamental elements of CIAM, let’s talk about how those elements impact your company’s day-to-day operations and your all-important bottom line.

## CIAM Is Central to Data Security

Customer data can be your company’s greatest asset — unless it falls into the wrong hands. A robust CIAM solution has security features to protect against fraud, hacks, and misused data on multiple fronts.

In recent years, the login box has become the front line for fending off intruders. Hackers use [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) to steal or guess user credentials and impersonate legitimate users at the login box. One of the most damaging forms of broken authentication attacks is [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/), in which hackers use passwords stolen in one breach to break into other sites. This method works given people’s tendencies to reuse passwords. There are currently billions of stolen passwords being passed around the dark web. Credential stuffing attacks alone cost businesses an average of $4 million a year, according to a 2019 [study from the Ponemon Institute](https://www.information-age.com/credential-stuffing-123482099/).

The best defense against credential stuffing and other authentication-based attacks is a CIAM solution with MFA and brute force protection. Brute force protection stops hackers from flooding your application with login attempts and crashing your site. Meanwhile, MFA ensures that a stolen credential won’t give hackers automatic access to your users’ accounts.

It’s important to note that the amount of damage hackers can do with customer credentials is limited, since they don’t have access to back-end systems. But these attacks can still damage your customer relationships and lead to negative headlines, as in the case of the [Disney+ attack](https://auth0.com/blog/the-disney-credential-stuffing-attack-could-happen-to-you/).

CIAM systems also help protect your customer data from back-end mischief in the event of a data breach or hack. CIAM solutions govern how you encrypt and anonymize personal data, so it’s useless to data thieves. It’s essential to choose a CIAM system that uses the latest encryption protocols, however, or your databases of sensitive data might as well be written in plain text. Finally, CIAM systems track who within your organization is accessing customer data and alerts admins to suspicious activity. That way, neither an employee nor a bad actor can walk away with your most valuable and sensitive asset: your customer data.

**How it affects your bottom line? Cost of data breaches.**
A [2019 Ponemon study](https://www.ibm.com/security/data-breach?cm_mmc=OSocial_Blog-_-Security_Optimize+the+Security+Program-_-WW_WW-_-CODB2019Blog_ov70891&cm_mmca1=000000NJ&cm_mmca2=10000253) found that the average data breach costs businesses $3.92 million. Businesses who don’t want to budget for that should budget for a modern CIAM solution instead.

## CIAM Helps Manage Data Privacy Law Compliance

A new crop of data privacy laws like [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) is fundamentally rewriting the rules for how organizations collect, store, and share personal data (PD). Meeting these legal obligations means managing your approach to CIAM.

To begin with, centralized user management is essential in fulfilling the reporting and erasure requirements of data privacy laws. Under GDPR and CCPA, organizations must provide users, upon request, with copies of their data along with a record of how that data is being used.

Then there’s the issue of MFA. GDPR, CCPA, and New York’s SHIELD Act fall short of explicitly demanding MFA. Still, they require “reasonable” or “appropriate” security measures, and both [legal and security experts](https://www.natlawreview.com/article/new-york-shield-act-faqs) agree that this means MFA. GDPR enforcement has supported this idea: multiple organizations have been [slapped with fines](https://auth0.com/blog/gdpr-fines-hit-these-companies-hard-heres-how-to-avoid-them/) for failing to implement MFA.

Data privacy laws are all about controlling who can access PD, so encrypting customer data and controlling access to it are baseline requirements. A CIAM solution needs to provide all of these elements, as well as tailoring data collection and consent management practices to the relevant laws.

**How it affects your bottom line? Cost of regulatory fines.**
As of May 2020, EU states had issued over [€153 million in fines](https://dataprivacymanager.net/5-biggest-gdpr-fines-so-far-2020/) to large and small organizations for non-compliance with GDPR. In November, Californians will vote on the California Privacy Rights and Enforcement Act (CPREA), the so-called “CCPA 2.0.” As the name suggests, the new version will feature a greater emphasis on enforcement. With new laws being passed all the time, the cost of non-compliance can add up quickly.

## CIAM Is a Business Enabler Through Customer Experience

A good CIAM solution is the difference between showing up at a crowded restaurant and being told there’s a 20-minute wait and being escorted straight to your table while the bartender mixes your favorite drink. With the right approach to CIAM, you can give your customers easy login and offer them services based on a nuanced understanding of their needs.

Businesses live and die by their conversion rates, and it’s tough out there. In 2019, the [average global website conversion rate](https://www.invespcro.com/blog/the-average-website-conversion-rate-by-industry/) was 2.58%, which is actually down from 3.42% in 2014. Clearly, today’s customers have no patience for filling out frustrating registration forms. If you use social login, your users get a friction-free registration experience without having to remember another password.

Meanwhile, your company gets the benefit of shared knowledge with that social media provider, so you automatically know your customer’s location, timezone, language, and other details to guide upsell recommendations.

**How it affects your top line? Higher conversions and retention, less frustration.**
[Studies have shown](https://blog.hubspot.com/blog/tabid/6307/bid/6746/Which-Types-of-Form-Fields-Lower-Landing-Page-Conversions.aspx) that reducing the number of form fields increases conversion rates. With social logins, you can eliminate the form altogether and enable one-click signup. Plus, when users don’t have their own unique password for your business, you save help desk time. [Gartner research](https://www.infosecurity-magazine.com/webinars/password-management-getting/) says between half and a quarter of help desk calls are for password resets. A North American healthcare organization told us it spends approximately $160 to $170 per employee per year on password-related issues alone.

## CIAM: A Holistic Approach to Customer Identity Management

As we’ve shown, CIAM plays an increasingly central role in how companies create their digital identities and manage their customer relationships. Given that, companies are allocating more resources to their access management solutions, either from day one or as part of a larger digital transformation.

To learn more about how CIAM can help provide enhanced data protection and seamless customer experience, [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=contact%20us).

<include src="asides/AboutAuth0" />


What is CIAM?

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

2020 amendments to the APPI change the data security obligations of businesses



On June 5, Japan enacted a new set of amendments to its data-privacy law, the Act on the Protection of Personal Information (APPI). These Diet-approved updates are part of the APPI's "every three years" review policy, but the changes go far beyond minor tweaks to existing Japanese privacy law.

Taken as a whole, the 2020 amendments mark a further expansion of the APPI's scope, following in the footsteps of previous expansions. They increase the obligations of companies to be transparent and secure with the personal data of Japanese residents or risk incurring criminal penalties.     

The major part of the APPI amendments isn't expected to officially come into effect until spring 2022, although the timeline is subject to change. But if your company does business in Japan, now is the time to educate yourself and make sure your business is compliant.

## Why Japan's Data-Privacy Law Needed an Overhaul

In recent years, Japan has suffered a string of highly damaging data breaches, prompting the Japanese government to change its "hands-off" attitude toward data privacy and cybersecurity. Understanding those stories is crucial to understanding how the new amendments will be interpreted and enforced.

### A culture of poor cybersecurity

According to [_The Economist_](https://www.economist.com/business/2020/07/18/japan-incs-it-needs-a-security-patch), Japan "lags behind other advanced economies" when it comes to cybersecurity. Many Japanese SMBs have minimal security, and many more use vulnerable legacy technology. (_The Economist_ illustrates this point with this shocking statistic: "Nearly 14m people were still using Windows 7 when Microsoft stopped providing security patches in January [2020].")

### Data breaches prompt outrage and change  

The APPI was originally passed in 2003 and has been updated several times to require greater protection of personal data. In order to adapt to factors such as the rapid evolution of technology and global standards for protection of personal data, the 2015 Amendments required that new amendments be considered every three years. 

While the law was due for amendments in 2020, the contents of those amendments were influenced by a string of high-profile breaches. For instance, in 2019, Japan's Uniqlo retail chain revealed a breach that compromised the data of over 460,000 customers. Stories like this prompted a national outcry and calls to strengthen the APPI's enforcement capabilities. 

At the same time, another case was winding its way through the courts, which would help shape the direction of APPI amendments. Benesse, an education tech company, had a data leak, in which an employee for a subsidiary stole and sold the personal data of an estimated 29 million customers, reports the Japan Times. [Benesse](https://www.nikkei.com/article/DGXMZO39457050X21C18A2CC1000/) stated that the leak involved over 35 million records. 

After a lengthy legal battle, the courts found that the subsidiary should have known its protections against data exports were not up to date, and Benesse should have provided more appropriate supervision. According to [Data Guidance](https://www.dataguidance.com/notes/japan-data-protection-overview), both parties were found liable "for damages of JPY 3,300 (approx. €27) plus 5% late charges per annum per affected individual." Although Benesse was prosecuted under the old version of APPI before the 2015 Amendments (effected in 2017). Although you can't draw a direct line between this case and the 2020 amendments, it is clear that amendments mean action.   

The take-home message of all this context is that businesses can't afford to think of the APPI amendments as needless red tape or a continuation of the status quo. Rather, they're an opportunity to correct serious shortcomings in Japan's cybersecurity culture that could put your company's sensitive and proprietary data at risk.

## What's Changing in the APPI Amendments

The 2020 amendments to the APPI make two broad changes: giving individuals more rights over their personal data and increasing the reporting obligations of companies.

Here's a quick rundown of the APPI's scope.

### Who the APPI applies to

In principle, any business (whether for-profit or not) that handles the personal information of Japanese residents falls under the law, regardless of where the business is headquartered. The current APPI applies to non-Japanese entities if they acquire the data of Japanese residents and process it in a foreign country, except for certain provisions that are considered not applicable or enforceable to non-Japanese entities. There are [limited exceptions](https://www.dataguidance.com/notes/japan-data-protection-overview) for the press, professional writers and academics, religious groups, and political parties. This part of the law is largely unchanged from the previous version.

Under the current version of APPI, the Japanese government can report incidents involving non-Japanese businesses to the foreign business' own regulatory authorities. The 2020 amendments expand that power, and the PPC can demand documents and reports from foreign entities, as well as enter a facility and conduct and audit with a foreign regulatory authority.
                                                                       
### How the APPI defines personal information and personal data

The definition of personal information and personal data under the APPI hasn't changed since the 2017 revisions. It defines personal information as any information from which one can deduce the identity of a living individual. Such information includes biometric markers and official identifier numbers. Like the EU's General Data Protection Regulation (GDPR), there's also a special category of "sensitive personal information," which includes race, religion, criminal record, and medical history. Under the 2020 amendment, personal data includes personal data that are to scheduled to be deleted within six months from the date the entity obtained it, which is excluded under the current law.

It's important to note that the 2020 amendment introduces the concept of pseudonymized information, which can only identify individuals when combined with other data. According to the [_IAPP_](https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi/), pseudonymized information is exempted from parts of the APPI, including the requirement to disclose and stop using personal data. Since pseudonymized information is limited to the internal use by businesses, it is not allowed to be shared with third parties by consent of the individual or through opt-out procedure.     

### The penalties for noncompliance

The current APPI establishes fines and penalties for violations, but the 2020 amendments make the penalties heavier. The amended APPI stipulates that parties who fail to comply with corrective orders by the Personal Information Protection Commission (PIPC, sometimes abbreviated as just PPC) can be liable for criminal punishment of up to 1 year imprisonment or fines of as much as 1,000,000 Japanese yen (if the party is a business entity, up to 100,000,000 Japanese yen). In addition, the 2020 amendments allow the PIPC to publish the names of operators who don't comply with orders.

In the case of a business or employee using personal information with a purpose to gain profit illegally, this Act is considered criminal and can be punished by up to a year in prison or a fine of as much as 500,000 Japanese yen (if the party is a business entity, up to 100,000,000 Japanese yen).           
Individuals can also sue for damages relating to the loss of privacy, which may end up having the biggest financial repercussions for businesses.

In practice, the PIPC usually follows an enforcement pattern of an initial inquiry into allegations, followed by recommendations to correct any violations. The PIPC can pursue legal action against companies who fail to change their behavior after this process.

### New rights of individuals under APPI

The 2020 APPI amendments give individuals an **expanded right of deletion or suspension of use**. According to [the law](https://www.ppc.go.jp/files/pdf/20200612_comparative_table_amended_APPI.pdf), data subjects can now demand their data be erased "if it has become unnecessary for a personal information handling business operator to utilize retained personal data," if that entity has had a certain data breach or leakage, or "there is a possibility that handling of the retained personal data... would harm the rights or legitimate interests of the principal."

Allowing individuals to demand erasure when there is a possibility of harm stands in contrast to the previous language, which allowed for deletion only when personal data was handled or acquired illegally. In addition, in the prior version of the APPI, any data scheduled to be erased within six months was exempt from the right to erasure. The new version removes the six-month exception.
     
<include src="TweetQuote" quoteText="The 2020 amendments also give subjects the right to request an electronic copy of their personal data."/>

### New obligations for companies under APPI

As we mentioned earlier, the old APPI guidelines did not include **mandatory reporting of data breaches**, but the new law does require businesses to report certain "leakage, loss or damage" to the PPIC, which thresholds will be set forth in the rules for the APPI later. However, the language of the requirement is still somewhat murky when it comes to informing individuals that their data has been compromised. The law says this requirement doesn't apply "when it is difficult to inform a principal and when necessary alternative action is taken to protect a principal's rights and interests."

The 2020 amendments include two notable provisions regarding **transfer of personal data to a third party**. The first expands regulations to transfers in cases where the disclosing party can't use the data to identify specific individuals, but the recipient of the data can.

According to [Data Guidance](https://www.dataguidance.com/opinion/japan-impact-adopted-appi-amendment-bill), "Given that provision of online identifiers (such as cookies) to third parties may become subject to consent requirements, this amendment will likely affect targeted advertising and other ad tech practices. The practical impact of the Amendments on businesses, in this respect, is high." However, Data Guidance goes on to say that, because obtaining consent for using cookies is already required under the GDPR, this requirement shouldn't be too onerous for GDPR-compliant companies.

The other unique element regarding third parties concerns **transfer of data across national borders**. Under the current version of APPI, businesses sharing data outside Japan must obtain the consent of the data subject and share information about the data-privacy systems of the third party and their country. If a business does not obtain prior consent (for example, because the transfer isn't to a third party), they are required to ensure that the recipient of the data has equivalent data protection standards to the APPI or is in a country with equivalent standards. At present, the only foreign countries for which this applies are the UK and the European Union.

The 2020 amendments make several changes to this regulation. They expand the information that must be shared with individuals when obtaining consent (the specific details have yet to be released). They also require that when sharing personal data with operators that have equivalent data protection standards, businesses must ensure that the protection standards are maintained.

Also, under the amended APPI, personal information operators are required to disclose their addresses and the name of the representative director in case the operator is a corporation. In addition, additional information needs to be disclosed for the provision of information through opt-out procedure or in case of joint use of personal information.

## Preparing Your Business for APPI Amendments

Like many international data-privacy rules, the text of the APPI doesn't make many specific suggestions for best practices. However, the PIPC has issued guidelines regarding appropriate security measures. The good news is that many of these guidelines are familiar to GDPR-compliant companies, and they start with some basic data housekeeping.

_The following guidelines are not intended as legal advice. Contact your legal counsel for specific recommendations for the provision of personal data._

### Appoint a Data Protection Officer (DPO)

This isn't a hard and fast requirement, but PIPC guidelines recommend it for companies in which a breach could cause harm, provided the business is large enough. If you're running an international corporation handling sensitive personal information and conducting cross-border data transfers, consider this recommendation a requirement.

A DPO can help ensure you're taking appropriate measures to stay compliant, such as regularly reviewing your privacy policy as guidelines evolve. 

### Update legacy systems

Given the prevalence of vulnerable legacy technology in Japan, it's essential to take a hard look at your company's internal systems. A failure to do so could lead to costly legal action. For example, in the Benesse case, the company's negligence hinged on the fact that they hadn't updated their processes to prevent the transfer of data to new Android phones. A small oversight with a big consequence.

In addition, staying on top of the latest encryption standards can free your company from some of its legal obligations. Under the current guidelines, businesses are not required to inform the PIPC of a breach, provided the leaked data is encrypted "[at a high level](https://www.dataguidance.com/notes/japan-data-protection-overview)."

### Implement access controls

The APPI demands that businesses take "necessary and appropriate action for the security control of personal data." The bedrock principle of "necessary and appropriate" security is that you should limit the number of people who can access personal information.

Implementing a sophisticated [workforce identity and access management (IAM)](https://auth0.com/b2e-identity-management-for-employees) system lets you assign permissions for who gets to access sensitive data. Moreover, it creates an immutable record of access, so if there is a breach, you can limit the damage.

If a simple username/password combination is all that it currently takes to access your company's personal information databases, then workforce IAM is a priority.

## Data Protection Is Mandatory, With or Without Privacy Laws

In passing the latest APPI amendments, the Japanese government has made it clear that it intends to take a tougher stance on the handling of personal data. But it shouldn't take a Diet approval for businesses to examine their use of personal information or to ensure that they have appropriate security control measures in place.

Hopefully, these amendments will lead to improved outcomes for Japanese companies, citizens, and everyone doing business in Japan.

For further information on how a modern approach to IAM can help protect your company's data and comply with data protection laws, reach out to the [team at Auth0](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


The New Japanese Privacy Law: What Businesses Need to Know

Why more companies are entrusting identity to the experts in the name of security and growth


Every organization that uses a login box must have some form of identity and access management (IAM) system to keep track of users and control access to data and services. But in recent years, managing identity has become more complex. Today, identity management is inextricably bound to issues of security, user experience (UX), and scalability.

To cope with the challenge of maintaining IAM systems, more and more organizations are turning to Identity-as-a-Service (IDaaS) providers.

But what exactly is Identity-as-a-Service? What do these providers offer that can help businesses navigate such a challenging environment?

In this piece, we’ll define identity as a service &mdash; its core components and the reasons why it’s a rapidly growing segment of Software-as-a-Service (SaaS).

## IDaaS Defined

When an organization creates or updates an application, they have to choose which functionalities to write themselves and which to entrust to a third party. For instance, if you’re writing an application that takes payments, it’s often more time- and cost-effective to use a platform like Square rather than making your own payment system from scratch. 

The same holds true if your application requires users to log in. Given the complexities of logins and the many ways that identity management touches on analytics and security, it’s often simplest to purchase an IDaaS solution that integrates into your software and handles these issues for you.

IDaaS providers offer cloud-based solutions for IAM functions. 

When you purchase an IDaaS service, you’re essentially purchasing an API (Application Programming Interface). In the simplest terms, an API is a set of programmed rules for how software components or applications interact, like a translator or mediator. 

In the case of IDaaS, the API mediates the authentication flow between the end-user and the customer’s application(s). IDaaS may also be used to mediate Authorization to certain areas of the application or to access certain data within the application(s) your company is building.  

When we talk about managing identity, we’re referring to the identities of three basic classes of users:

* Customer identity and access management (CIAM), which applies to end-users.
* Workforce IAM, which manages your staff and their access to internal applications.
* B2B IAM, which lets businesses integrate identity with their business partners and enterprise customers.

Each of these classes requires a different approach, and an organization may subscribe to an IDaaS provider for all of them or just one.

There are a few core features common to virtually all IDaaS providers. These include:

* Multi-factor authentication (MFA)
* Biometrics
* Single Sign-On (SSO)
* User management and access control

We’ll get deeper into all those terms below.

### Multi-Factor Authentication (MFA)

[MFA](https://auth0.com/docs/mfa) is an increasingly popular way of verifying a user’s identity. It’s more secure than the traditional username/password method of logging in since [passwords are vulnerable to multiple types of attacks](https://auth0.com/blog/what-is-broken-authentication/#:~:text=Auth0%20Docs&text=Broadly%2C%20broken%20authentication%20refers%20to,to%20masquerade%20as%20a%20user.).

MFA requires users to log in with more than one piece of identifying information (i.e., a push notification in addition to a password).

Users must share some combination of the following credentials to log in:

* Knowledge: Something the user knows (such as a password)
* Possession: Something the user has (such as a cell phone)
* Inheritance: Something the user is (such as a fingerprint or retina scan)

The most common form of MFA is two-factor authentication (2FA), though you may customize an MFA solution to ask for more credentials depending on the security risk.

Despite numerous reports on [the benefits of multi-factor authentication for stopping data breaches](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), widespread adoption is still surprisingly low &mdash; though it has increased significantly in recent years:

![2fa-blog](https://images.ctfassets.net/23aumh6u8s0i/3UNdOb3k1qtTTy3vXU2NhJ/ca5386396ac47062473b3562d3314c9f/2fa-blog)

One of the reasons for the lagging adoption rate is that designers are wary of creating extra friction at login, especially for B2C authentication. But third-party IDaaS providers offer more customizable MFA options, like [step-up or adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/). These approaches to MFA only ask for extra credentials if a user meets a certain risk profile; for instance, logging in from a new IP address or changing payment information.

### Biometrics

Biometrics means the use of an “inheritance” criteria &mdash; something the user is as a means of verification. If you’ve ever unlocked your smartphone with your thumbprint, you’re familiar with biometrics.

![biometrics](https://images.ctfassets.net/23aumh6u8s0i/4H45r7da3K3WplJ96rXE8B/ea359f09fc4bd01419eebdc67f09f29d/biometrics)

In addition to thumbprints, other biometric authentication methods include iris or retina recognition, full [facial recognition](https://www.syte.ai/blog/brief-history-image-search/), fingerprint, hand, and DNA usage.

Many organizations are excited to use this technology and have turned to IDaaS providers to implement it rather than trying to train their in-house teams on this specialized branch of knowledge.

### Single Sign-On (SSO)

[Single Sign-On (SSO)](https://auth0.com/single-sign-on) allows users to log in to one application and then automatically be logged in to other designated applications. Most people are familiar with SSO through Google, since signing in to one Google property such as YouTube grants you access to Gmail and other applications. SSO is popular for companies with multiple brands since it allows for greater user visibility, as well as reduced friction. There are also use cases for SSO in workforce and B2B identity management.

![Single Sign-On (SSO) in action](https://images.ctfassets.net/23aumh6u8s0i/6t0LdnTcofxK6ekdSpDEja/a7376b8f04ca074a0d88dd1470d3be55/sso-desktop.jpeg)

### User management and access control

One essential element to any IAM system is the ability to control who is permitted to access data by provisioning users with different roles. IDaaS systems simplify this process by centralizing identity and putting these controls into a single location like a user dashboard. That’s a significant advantage in making sure sensitive data stays in the right hands since it’s much less prone to error than an IT team manually controlling access to individual applications.

## Why Enterprises Choose IDaaS

IDaaS is undergoing a period of exponential growth as more companies—from startups to multinational corporations—decide to outsource identity. The IDaaS market is [predicted to grow](https://www.marketsandmarkets.com/Market-Reports/identity-as-a-service-market-32235637.html) from $2.5 billion in 2019 to $6.5 billion in 2024.

Why this shift toward third-party identity solutions? The reasons include the need to meet legal requirements, manage security risks, and implement an identity solution designed around scalability and extensibility.

### Data privacy law compliance

One of the reasons that IDaaS has become so important recently is the rush to comply with new data privacy regulations. These include the [EU’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA)](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA), and others.

Organizations that fail to comply with these regulations can face stiff penalties. For instance, under GDPR, organizations without secure and transparent data practices can be fined up to 20 million euros or 4% of annual global turnover &mdash; whichever is higher.

![GDPR compliance checklist](https://images.ctfassets.net/23aumh6u8s0i/4XXboWYzyp7LPl5BulfQsM/4a439e75374582bfe2a5cea60fb02120/gdpr-compliance-checklist)

Data privacy laws often grant users more rights over their data. These rights vary depending on the law, but they may include:

* A new right to data portability
* An extended right to be forgotten (also called the right to erasure)
* The right to opt in or out of data collection and sales

These rights translate to a new set of obligations for organizations. It’s now essential to have a centralized repository of user data to satisfy reporting requirements and protect sensitive data according to current best practices. Data privacy laws are rapidly evolving, and managing compliance can be a full-time job, especially for organizations with uses in multiple jurisdictions.

Managing compliance is a major undertaking for any company. However, relying on an IDaaS partner can keep track of even siloed identity stores. A centralized identity solution can deliver lower maintenance costs and greater peace of mind. Although an IDaaS provider can’t ensure your organization will be fully compliant, IDaaS tools can certainly help.

### Increased security With IDaaS

In recent years, identity has become a major source of [high-profile hacks and data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/). In fact, Verizon’s [2020 data breach report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf) found that over 80% of breaches from hacking involved brute force attacks or the use of lost or stolen credentials.

The best protection against [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) like [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) are the features IDaaS providers specialize in: MFA, brute force and anomaly detection, and rigorous access control.

### Extensibility, adaptability, scalability

Legal and security concerns are the most frequently mentioned benefits of partnering with an IDaaS provider, but a sophisticated approach to identity can also help growing companies boost their bottom lines. Organizations with custom-built IAM solutions frequently find that maintaining these systems and adapting them to new needs and partners takes months of developer time.

For instance, in 2019, Apple mandated that [every app on the App Store had to include “Sign in with Apple” as a login option](https://developer.apple.com/news/?id=09122019b). Companies with bespoke IAM systems scrambled to meet this requirement, and many found that their systems were rigid and full of legacy code. Most IDaaS providers, on the other hand, included this as a simple update.

Having an extensible identity platform is also essential to integrating users during [Merger and Acquisition (M&A) deals](https://auth0.com/blog/why-your-ma-strategy-has-to-include-an-iam-solution/) and in deals between enterprises. Two organizations with IAM systems that can’t talk to one another can’t benefit from each other’s data, but an IDaaS provider can act as a translator between different back ends.

## What’s Ahead For IDaaS

IDaaS is an increasingly important segment of SaaS, propelled by new regulations, heightened security risks, and excitement about new technology.

Even organizations that typically adopt a "Do it yourself" (DIY) attitude about building their own features are beginning to recognize the value of relying on third-party identity providers. They can make that switch at any stage: during initial product development, prior to release, or at an inflection point at which they see the limits of their in-house IAM system.

The definition of IDaaS will continue to evolve as providers add new features, but the need for specialized expertise to handle these matters will remain constant.

<include src="asides/AboutAuth0" />


What Is IDaaS?

Privacy and security are partners joined by an IAM



_**Disclaimer:** This article is for general information purposes only and not a substitute for legal advice. Please consult with your legal counsel to obtain specific advice for any legal manner._

Any pre-teen with a journal understands the difference between data privacy and data security. If you secretly read your friend’s journal to find out their secrets, you’ve violated the principles of data privacy. But if your friend tells you their secrets, and you write it in your own journal, and then leave that journal out where anyone can read it, you’ve violated good data security.

As a pre-teen, a failure on either front can cost you your friendship. In today’s business world — in which cybersecurity threats are rampant, and data privacy laws like the EU's General Data Protection Regulation (GDPR) and California Consumer Privacy Act ([CCPA](https://auth0.com/ccpa/)) are cropping up around the world — failure can be even more costly. Knowing the difference between data privacy and data security, and the tools you must employ to protect both can help prevent breaches and achieve legal compliance. Unfortunately, too many executives think that their data security policy covers data privacy, and vice versa.

In this climate, it’s crucial for executives to understand how these concepts differ, how they overlap, and how to incorporate both into a sound data governance strategy.

## What's the Difference Between Data Privacy and Data Security?

You can imagine data privacy and data security as a Venn diagram with significant points of overlap, but businesses should have a distinct set of strategies for managing each. 

That doesn’t mean you can have one without the other, necessarily -- you can hardly protect privacy without security. But it does mean that sometimes it’s important to look at each concept separately to make sure both sides of the security/privacy coin are being properly addressed. 

### Data Privacy

Data privacy is about defining what personal information you should and shouldn’t ask for (or gather) from your users.

It concerns how and why an entity collects, stores, shares, and controls access to sensitive data. Data privacy is about the kind of information you ask from your users (or collect via cookies or from third parties), why you ask for that information in the first place, and how you plan to use the information you’ve gathered.

**Data privacy applies to the personal information of an individual.** GDPR and [CCPA](https://auth0.com/ccpa/) have [broadly similar definitions of personal data](https://fpf.org/wp-content/uploads/2018/11/GDPR_CCPA_Comparison-Guide.pdf). An individual’s full name and mailing address will typically be considered as personal data, while in some cases, browsing history could also be seen as personal data. GDPR goes further in defining special categories of data, such as health information, political affiliation, biometric data, and sexual orientation, which are all subject to stricter requirements for processing. The personal data of minors is also subject to stricter regulation under many international laws.

**Data privacy laws address both the "how" and the "why" of data collection.** These laws require companies to transparently communicate their policies with users and give users greater control over how their data is used, which may require providing users with the ability to opt in or out — that’s the “how.” But they also require companies to disclose what purpose they’re collecting data for — that’s the “why.” In other words, what is the reason for the intrusion.

For instance, prior to GDPR’s passage, the [UK fined Facebook](https://www.bbc.com/news/world-us-canada-48972327) for giving Cambridge Analytica access to user data without user consent, violating their privacy. There wasn’t a data breach or a malicious hacker involved — the company just wasn’t respecting user privacy, and that data was then used to [manipulate elections potentially](https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election).

There are, of course, totally legitimate ways for a company to collect personal information without prior consent that doesn’t inherently violate the principles of data privacy. Most companies who do business online collect things like usernames, password hashes, bank or credit card information, and other data directly related to business operations.

If you’re a home insurance company, you may need the address of the customer’s home, the size of the home, the year it was built, etc. It may be perfectly fine to have that information, but if your insurance company shares this data with an unauthorized third party without your customers' knowledge or consent, you may be trodding into non-compliance territory.

Personal information as defined by the laws is a bit of an ever-changing and refining property, but there are [methods for keeping up with the changes](https://auth0.com/resources/whitepapers/evolving-definition-of-personal-Information). 

**Some data privacy laws, including GDPR, specifically enshrine the "[purpose limitation principle](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/),**" mandating that personal data can’t be used for a new purpose without specific permission. GDPR also requires “data minimization:” that entities don’t [collect more data than is needed for a particular purpose](https://auth0.com/blog/avoid-sinking-your-code-by-treating-data-as-a-liability/) for a specific purpose.

### Data Security

If data privacy concerns the personal data of individuals, data security concerns how a company protects that data from unauthorized access or corruption. Data security is what you do with the data you’ve gathered from your users — where you store the data, whether or not you encrypt it, who has access to it, and how you determine who is an authorized user.

It’s possible to have good data privacy standards while still failing on data security. Even if your data collection policies are strictly in accordance with the law, if you’re not protecting that data with adequate security measures such as authentication and access management, you still may not be in legal compliance.

![dataprivacy_vs_datasecurity-sep-1](https://images.ctfassets.net/23aumh6u8s0i/74v3Z31GvHeWlHw69QRUck/f46dcb7bc08161945d39d0f6bfa54283/dataprivacy_vs_datasecurity-sep-1)

## How the Law Regulates Data Privacy and Data Security

The [GDPR and the CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) came into being largely in response to unscrupulous data collection policies that failed to respect users’ privacy. Data privacy laws may require companies who deal in personal data to have well-maintained records of how user data was acquired, why, who had access to it, and where it was sold or shared and with whom. You may need to have all that information ready at all times, and be able to share it with users and regulators upon request.

The current crop of data privacy laws also specify, to varying degrees, the security measures that companies are obligated to adopt to protect data.

### Protecting Access and Anonymity

There are tools to help you build a stronger data privacy and security program.

**Access management is all about ensuring the user is who they say they are, that you have access to what you should have access to, and having a way to manage that access**. [Implementing multi-factor authentication (MFA)](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) is a major element to data security; otherwise, it would be easy for intruders to impersonate users and expose records through credential stuffing. MFA identifies users by checking who they are (a username), that they know something the user ought to know (a password), and that they have something only the user would have (a USB key, a mobile phone, etc).

Depending on which law you’re trying to comply with, **anonymization and de-identification are all about scrambling user data so it is no longer identified or identifiable**. There are varying legal and technical standards for what constitutes de-identification and anonymization, but as more laws develop, and the ones on the books have time to mature, we can expect some clarity and convergence on this front. IAM’s management can aid compliance even with ever-changing legal definitions. 

## Creating a Data Privacy Plan
A strong data privacy plan is all about knowing what data you have on the customer/client/user and why you have it.

You’ll need both an internal and external policy. Where an external privacy policy lets clients, customers, and shareholders know what kind of data your collecting and why, the internal privacy policy outlines what team members and the company can do with that information.

### Hash Out the Internal Policy

Sit down with your development team and hash out the bare minimum data you need to ask for.

A mapping app needs GPS locations, an online order needs an address, etc. Do not ask your customers (and do not _collect_ from your customers) any non-essential data. Even if it might “come in handy” due to future planned features of your business, GDPR and other laws stipulate that you cannot use data for anything beyond what it was originally gathered for. There’s no saving it “for later.”

The next step is to create a comprehensive policy for everyone that outlines what kind of data you’re collecting for your business, the related bits [of the actual regulation text](https://gdpr-info.eu/) to keep everyone on the same page, and detail who’s responsible for executing each leg of the policy.

Next, take stock of all the data you have and create a comprehensive inventory.  

An identity and access management (IAM) system can help you find and manage this kind of data. Take inventory of where the data has gone - to other businesses or people - and track how it got there and for what purpose.

### Drafting the External Policy

What do you need in your privacy policy to put customers at ease and meet compliance? 

First, find the relevant laws you’re working on in your location and business. A corporate lawyer who specializes in your industry may be a smart first investment, or at the very least seek out the advice of an expert in your field. 

Draft a privacy message that communicates what data you’re collecting and why, matching the legal requirements. Cribbing from boilerplate privacy permission forms from other companies in your industry could be a good starting point, but always work with your legal counsel to make sure your privacy statement accurately reflects your organization’s practices.

### Execute the Plan

The broadcast and execution of the internal and external privacy policy will need a multi-pronged approach. 

The internal privacy policy needs to be located in a knowledge base that all relevant team members have access too, and team members will have to be trained on the new policy. And, of course, developers will have to deploy these changes throughout the system, overhauling or tweaking how you collect customer data (and what data you collect). 

The external privacy policy will need to be broadcast wherever clients and customers will see it when giving the company data of any kind -- on a website, a mobile app, paper forms, whatever method your company uses.

## Create a Data Security Plan
Data security tackles two kinds of data: structured data and unstructured data.

**Structured data is the kind you'll find in your IAM** &mdash who is accessing what, and where, while logged into your system. Modern IAM platforms like Auth0 make handling structured data relatively easy. 

**Unstructured data is anything from emails to PowerPoint decks to paper notes on an employee's desk**: sensitive or valuable data that is outside of your IAM, that cannot be easily tracked and collated. Are employees emailing files to each other instead of sharing them via an encrypted cloud service? Are they taking data home in the form of print-outs or USB dongles?

### Make Someone Responsible for Data Security

The person in charge of these plans should be your CDO (Chief Data Officer) or an equivalent, dedicated position depending on your company’s size and resources. 

They should be in charge of compliance, data handling, and employee instruction on up-to-date data policies. 

###  Identify Your Vulnerabilities
Where are your data security vulnerabilities?

The more sensitive data you collect, the greater your security should be. If you have an online store, your IAM needs to help you manage and encrypt user names, addresses, and financial information.

For a company that controls medical information and has a greater responsibility to protect data in the eyes of the law, authorization and security must be airtight. Methods like multi-factor authentication and data scrambling become non-negotiable. Choosing a security solution with HIPAA experience that can offer BAAs is paramount.

If your organization stores messages, chat, or email from customers and clients, those messages need to be encrypted -- data pulled from seemingly innocuous communication could contain user information useful to breach financial accounts. If you offer a reward or loyalty program, those are frequent targets of fraud and require strong authentication and identification.

### Secure Every Form of Data

Your plan to secure data is going to depend on what sort of data you’re dealing with. Most, if not all, organizations deal with both structured and unstructured data. 

**In the case of structured data, your security plan should be tightly controlled permissions, multi-factor authentication, and single-sign-on policies for all sensitive data**. All passwords need to be hashed and salted in your database, as do all usernames.

**The primary weapon against unstructured data breaches is training**. To tackle unstructured data, start with a strong DLP (data loss prevention) plan to identify your most sensitive data and your most likely avenues of breach. 

Again, whoever is in charge of data security is also responsible for training team members about the danger of USB drives, sensitive information written on slips of paper, mobile phone photos and videos.

Create regular reminders and in-person training, showing all employees how to keep their communication private, and how to properly share files while keeping them in your secured Cloud. 

Detail policies of what data can go home if any, and consider tagging that data with a kind of check-out system to increase accountability.

**And don’t neglect machine-generated unstructured data**. Does your workplace have security cameras? Are those security cameras, either the live feeds or backed-up recordings, accessible online in anyway? Cameras and video storage can be hacked, and it's very easy for hackers to glean a huge amount of sensitive data from visible computer screens and conversations.

If you have a fleet of vehicles, their GPS data can be hacked. Your logistical routes for both cargo and personnel isn’t something you want a bad actor to have, but it’s the kind of unstructured data that’s easily forgotten.

![dataprivacy_vs_datasecurity-sep-2](https://images.ctfassets.net/23aumh6u8s0i/717Ex47kQdyZ5d40k3dM24/bd043d7ddbc62e50247db9b1f3399cb8/dataprivacy_vs_datasecurity-sep-2)

## How to Address Data Privacy and Security With IAM

Good data privacy and security means controlling permissions and dictating who has authorized access to user information. It means ensuring that the only people with access to user data have adequate training and are doing so for legitimate purposes. It means defining authorized access and prohibiting unauthorized access. It means knowing, at all times, who is doing what in your system and why.

One major point of overlap between data privacy and security (and subsequently the best place to address both) is IAM. With your IAM platform, you can authenticate users, protect their data from unlawful access, and create user profiles from which administrators can access and manage all the data you have on everyone in your system.

When formulating your company’s [data governance strategy](https://segment.com/resources/cdp/customer-data-management/), the right IAM solution will help you get a picture of where your data is being stored and control who accesses it. A good IAM system keeps your finger on the pulse of what’s actually happening in your system and provides up-to-date information on your user-base's data.

![IAM](https://images.ctfassets.net/23aumh6u8s0i/60gvj9w6NoByMHhxSq0wQM/95c8e6319ed6f269aee6e02a891ecf0f/dashboard)

Auth0’s IAM system creates granularity of access — you can define which users have permissions and at what level of security. It doesn’t have to be a binary choice between admins (who can access everything at all times) and users who are completely blocked. You can define different permissions for different needs: helpdesk, accounting, marketing, and your CTO would all have vastly different levels of trust and access. This not only tracks accountability better, but ensures that a breach of one account won’t necessarily expose all the data in the system.

Sophisticated IAMs also enable features like [multi-factor authentication](https://auth0.com/blog/different-ways-to-implement-multifactor/) and single sign-on, both of which [act as safeguards against breaches](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/) in the first place.

## Data Privacy Plus Data Security Equals Compliance

While data privacy and data security aren’t the same, they are complementary concepts, and executives must take both into account when approaching data.

Your users, your partners, and international regulators all expect you to be able to explain what data your company possesses, what you do with it, and how you protect it. They also want assurance that the data collected is only for the stated purpose, not to be sold, shuffled around, or exploited when new features or services are created.

The right IAM platform can help you find the answers to those questions, and help you design data privacy and data security policies that work together to form a cohesive whole.

<include src="asides/AboutAuth0" />


Data Privacy vs. Data Security: Why Your Business Needs Both

Outdated IAM can cost you in terms of analytics, security, and UX.



The saying goes, “If it ain’t broke, don’t fix it,” and plenty of CISOs and CTOs live by that motto when considering whether to update or outsource a particular functionality. But when it comes to Identity and Access Management (IAM), just because your old system is still up and running, doesn’t mean it’s working as it should.

At best, an outdated IAM solution could be leaving money on the table by failing to fully take advantage of user data. At worst, it could be leaving your company vulnerable to potentially disastrous data breaches and regulatory fines, and siphoning off developer time that could be spent refining your core competency.

We’ll go over three of the hidden costs that lurk beneath the surface of in-house IAM solutions, and how real companies have reaped the benefits of investing in an alternative.

<iframe width="560" height="315" src="https://www.youtube.com/embed/LWZkJtJw1JU" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## If You Don’t Deal With Data Security, It Will Deal With You
In recent years, data security has become an urgent issue for companies of all sizes, with [3,813 breaches reported](https://pages.riskbasedsecurity.com/2019-midyear-data-breach-quickview-report) in the first half of 2019 alone, exposing billions of records. 
The problem isn’t confined to a single industry or region, as evidenced by some of the most recent high-profile data breach stories:

* Facebook has repeatedly been in the news for exposing user records, including an [April 2019 scandal](https://www.cnet.com/news/millions-of-facebook-records-were-exposed-on-public-amazon-server/) that exposed passwords the company had stored in unencrypted text.

* A hacker broke into Australian graphic design company [Canva](https://www.zdnet.com/article/australian-tech-unicorn-canva-suffers-security-breach/), stealing 139 million records and tarnishing Canva’s reputation as a tech darling.

* Europe has been rocked by numerous major breaches and equally major regulatory fines. The [top ten GDPR fines](https://www.law360.com/articles/1223876/biggest-eu-data-breaches-generated-402m-in-fines-in-2019) for breaches in 2019 totaled €402 million.

* Meanwhile, Latin America is grappling with its own epidemic of breaches. According to [one 2018 study](https://www.welivesecurity.com/wp-content/uploads/2018/06/ESET_security_report_LATAM2018.pdf), three in five businesses in the region have had at least one security incident.

In response to these breaches and concerns about ethical data collection, new data privacy laws like [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) are springing up around the world. 

All these laws seek to ensure that companies have appropriate security measures in place to safeguard personal data. IAM is at the heart of data privacy and security, and a sophisticated platform like Auth0 can save you money by protecting you from breaches and helping to manage your compliance obligations.

According to [IBM](https://www.ibm.com/security/data-breach), the average cost of a data breach is $3.92 million, and no company can assume they’re safe. A [Verizon](https://enterprise.verizon.com/en-gb/resources/reports/dbir/2019/summary-of-findings/) study found that 43% of all breaches in 2019 involved small businesses. One of the most serious cybersecurity threats of the moment are credential stuffing attacks, in which hackers use credentials stolen in one breach to log in to other accounts.

If these attacks lockout users (as in the [Disney+ attack](https://auth0.com/blog/the-disney-credential-stuffing-attack-could-happen-to-you/)), they can be damaging, but if someone impersonates an admin, they can be downright devastating, and [Auth0 detects](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) over 50,000 credential stuffing attacks every day. Implementing multi-factor authentication (MFA) and breached password detection are the most surefire ways to ensure your users are who they claim to be, but these capabilities may be out of reach for a legacy IAM system.

Aside from the damage done by an attack itself, a lack of security can leave your business vulnerable to prosecution under data privacy laws. Under the EU’s GDPR, many businesses have been hit with significant fines for failing to implement identity-based security measures. For example, [Dutch insurer UWV](https://www.natlawreview.com/article/dutch-supervisory-authority-imposes-gdpr-security-standard-processing-broadly) will have to pay €900,000 specifically for not having MFA in place for health data. A sophisticated IAM platform like Auth0 is continually evolving to meet the regulatory and cybersecurity challenges of the moment, while an in-house IAM solution may fall behind without constant maintenance.

<include src="TweetQuote" quoteText="Just because your old identity system is still up and running, doesn’t mean it’s working as it should. How to avoid the high cost of doing nothing."/>

## Maintaining IAM Is a Costly Distraction to Your Team
Coding for identity and authentication in-house is a time-consuming (and therefore expensive) proposition for developers. Aside from maintaining legal compliance, integrating with new applications and third parties can be tricky, since most DIY IAM solutions weren’t designed with extensibility in mind. 

While your in-house developers tinker with your system, you’re pushing back your time to market and keeping your partners and customers waiting. When you consider costs associated with those delays and missed opportunities, building IAM yourself simply doesn’t make sense; it’s like forcing a basketball team to sew its own sneakers. Now consider the alternative: outsourcing to IAM experts. 

In contrast, implementing Auth0’s platform takes less than a month for [94% of customers](https://auth0.com/blog/the-real-roi-of-auth0-part-1-time-to-market/), and according to [Forrester’s research](https://auth0.com/forrester-total-economic-impact/), Auth0’s customers reduce the time it takes to federate enterprise partners by 33%. For example, the automotive data services platform [Otonomo](https://otonomo.io/) started out with an in-house identity solution, but it became too difficult to manage as they grew. They [switched to Auth0](https://auth0.com/learn/otonomo-saves-200000-annually-auth0/) and reported savings of at least $200,000 per year and a 10% reduction in development time. Similarly, [Servcorp](https://www.servcorp.com/en/) says that they save weeks [using Auth0](https://auth0.com/learn/servcorp-saves-months-development-time-thanks-auth0/) rather than using their own in-house system when they are onboarding new applications.
 
Extensibility is particularly critical for companies in the [M&A market](https://auth0.com/blog/why-your-ma-strategy-has-to-include-an-iam-solution/), since quickly integrating data after a deal is crucial to identifying synergies and creating value, but without an extensible IAM solution, migrating data can take months. But a platform like Auth0’s can connect to any application, platform, or device. This allows for [automatic migration](https://auth0.com/docs/users/guides/configure-automatic-migration) from multiple databases, creating a single source of truth without slowing down normal operations.

An IAM solution’s ability to quickly integrate new features can make or break a business. Case in point: Apple recently announced that it would begin requiring every app in the App Store to [Sign In with Apple](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/). That means that every business with a mobile app has to incorporate this feature or lose their seat at the table. But if your team has to stop everything and focus on integration, your other projects, more central to your company’s value proposition, will inevitably fall by the wayside.

<include src="TweetQuote" quoteText="Uncover the three of the hidden costs that lurk beneath the surface of in-house IAM solutions."/>

## IAM Should Be a Bridge, Not a Wall, Between You and Your Users
When you’re using a legacy IAM solution, it can feel like your company and its users are on either side of a brick wall. Users are frustrated by poor UX, and businesses are left in the dark about their users’ identities, needs, and behaviors.

Removing that barrier starts at the login box by making the experience both frictionless and secure. Achieving this requires a highly customizable IAM solution. If you’re still making your users enter a username and password combination every time they log in, you risk users forgetting their passwords and having to reset them, which is not the pleasant experience you want them to associate with your business. Users might also recycle the same password over multiple applications—the very behavior credential stuffing attacks take advantage of.

With a cutting-edge IAM platform, on the other hand, the login experience can create a single, holistic view of users. You can implement [Single Sign On (SSO)](https://auth0.com/single-sign-on) and enable enterprise federation or social login. Users are familiar with the experience of a single login giving them access to multiple applications from companies like Google, which automatically logs users into all their connected accounts. It provides them with an easy experience, and for companies, it enables the creation of data-rich profiles, allowing you to visualize each step of a user’s journey.

![SSO](https://images.ctfassets.net/23aumh6u8s0i/6OrHw7kjnnCI4U2raQ9EeG/df571074acd713cbe3db69d21ec13dc6/sso-diagram-desktop-56afcf29cf)

Building security into authentication without compromising UX requires a highly customizable IAM solution. For example, it would be a mistake to implement MFA across the board; users don’t want to have to enter a one-time code every time they log in. But Auth0’s platform allows for [step-up authentication](https://auth0.com/blog/step-up-authentication-is-key-to-making-paywalls-work-in-media/), so with a few lines of code, your developers can define the specific parameters under which to request extra credentials. With this level of customizability, you can use security measures as a precise tool, not a blunt instrument.

The login box is the most visible part of IAM for your users, but a sophisticated IAM platform goes much further in organizing and protecting their data. Legacy IAM systems leave data siloed across multiple applications and mean that a single user might have multiple profiles. That makes it difficult to manage user requests, or even have a clear idea of where all their personal data is.

But Auth0’s platform offers the simplicity of a central dashboard, a single location from which you can manage user needs. If an employee starts or stops work, you can grant or revoke their access to sensitive data. From there, you can manage permissions with the flip of a switch. If the system flags a suspicious login, you can examine the circumstances and decide what action to take. And if users make a request to change or delete data, you can quickly comply, thus meeting your data privacy obligations.

## Make IAM an Asset, Not a Drain
Most legacy IAM solutions were designed to be more or less static, but today, identity is evolving at breakneck speed. Without a cutting-edge IAM solution, your company will have to slam on the breaks every time a new data privacy law is passed, a new threat appears, and every time you want to embrace innovative new technologies. 

If you don’t have an identity platform that evolves with you, you’re building these costs into your business plan. So while “If it ain’t broke, don’t fix it” may be an apt expression in certain contexts, IAM, a better adage is “An ounce of prevention is worth a pound of the cure.” 

Digital transformation is a moving target for any company, but when choosing priorities to overhaul, consider that IAM sits at the nexus of security, analytics, and UX. If you’d like to learn more about how the right IAM solution can save your business money, time, and energy, don’t hesitate to [reach out to the Auth0 team](mailto:sales@auth0.com).


The High Cost of Doing Nothing

The UK’s new rules are pushing companies to handle kids’ data with greater care.



In January 2020, the United Kingdom’s Information Commissioner’s Office (ICO) released a [Code of Practice](https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/01/ico-publishes-code-of-practice-to-protect-children-s-privacy-online/) to protect children’s privacy online. The code isn’t the first piece of legislation that specifically seeks to limit how organizations handle the data of minors, but it is significantly broader than previous laws. Among other things, the ICO’s code demands, “The best interests of the child should be a primary consideration when you design and develop online services likely to be accessed by a child.”

The UK’s new rule — and the data privacy scandals that brought it into being — should grab the attention of the C-suite at every company that counts children among its users. This law and others like it demand a shift in both the technical measures and the philosophy with which businesses handle the data of minors.

As Elizabeth Denham, the UK’s information commissioner, has argued: “There are laws to protect children in the real world — film ratings, car seats, age restrictions on drinking and smoking. We need our laws to protect children in the digital world too.”

## Why Children’s Data Privacy Is a Hot-Button Issue in 2020
Concerns about the safety of children online are as old as the internet itself, but the increasing power of big data has brought those concerns back to the forefront. And while adults can make educated choices about their own privacy, many are uncomfortable with recent news stories of children being monitored and targeted by corporations and potentially exposed to hackers.

### Youtube Caught With Its Hand in the Cookie Jar
In September 2019, YouTube reached a $170 million [settlement with the FTC](https://www.ftc.gov/news-events/press-releases/2019/09/google-youtube-will-pay-record-170-million-alleged-violations) for allegedly breaking the [Children’s Online Privacy Protection Act (COPPA) Rule](https://www.ftc.gov/enforcement/rules/rulemaking-regulatory-reform-proceedings/childrens-online-privacy-protection-rule) (more on that below). YouTube was accused of using cookies to collect personal information from viewers of kid-targeted channels and using the cookies to deliver targeted ads without parental consent. The FTC noted that YouTube publicly bragged about its popularity with kids and made millions of dollars marketing to them and therefore could not claim ignorance about its legal obligations under COPPA.

![DataPrivacy Youtube](https://images.ctfassets.net/23aumh6u8s0i/XBTQ3j1zo75iWEFPf82Ve/ae32e671866fe920e1ff3f54e3d2c38f/dataprivacy-yb)

### The Dress-Up App That Toyed With Data
In April 2019, the FTC issued another [COPPA fine to i-Dressup](https://www.ftc.gov/news-events/blogs/business-blog/2019/04/i-dressup-data-security-mess), an app that offered games and virtual dress-up features to children. That company let kids fill out registration forms, sent a link to their parents for approval, but then failed to delete the children’s information even if parents never gave their consent. The company also failed to implement adequate security to protect data — they transmitted [passwords in plain text](https://auth0.com/blog/yes-data-privacy-applies-to-you/) and failed to monitor for security incidents, for example — and, as a result, was infiltrated by a hacker who accessed information about millions of users, 245,000 of whom had reported that they were under 13.

### Ring Camera’s Vulnerabilities Led to a Privacy Nightmare
Arguably the biggest recent child privacy story came in December 2019, when several owners of Ring security cameras reported that their cameras had been hacked. [In one particularly troubling incident](https://www.nytimes.com/2019/12/15/us/Hacked-ring-home-security-cameras.html), a young girl in Mississippi was terrified when an unknown man calling himself Santa Claus started speaking to her through the camera’s speakers.

Ring (which is owned by Amazon) asserted that their system had not been hacked, and that these users were the victim of a [credential-stuffing attack](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/). Amazon reminded users to use [multifactor authentication](https://auth0.com/learn/get-started-with-mfa/) and unique username/password combinations when registering new devices. That’s certainly good advice, but the idea of putting cameras that are vulnerable to intrusion in their children’s bedrooms still left many customers uneasy.

## The UK’s Law Demands That Children’s Privacy Be Built Into Design
The UK’s ICO developed its code in the wake of these stories and in the midst of growing public understanding of personal data as a precious resource. The UK’s code — its full name is the [Age Appropriate Design Code](https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/age-appropriate-design-a-code-of-practice-for-online-services/) — establishes 15 standards to protect children’s privacy online.

### The Requirements of the Age Appropriate Design Code
The code applies to organizations that design, develop, or provide online services “likely to be accessed by children,” such as apps, streaming services, social media, games, and internet-connected toys. It requires that privacy settings should automatically default to high when a child downloads an app or visits a site. Geolocation services should automatically be turned off for children, data collection and sharing should be minimal, and profiling that is used to deliver targeted ads should also be disabled by default.

In addition to stipulating a high baseline for privacy settings, the ICO’s code forbids using “nudge techniques” to convince children to weaken their privacy. Nudge techniques are tools for leading users to behave as the designer would prefer, typically by making the alternative unappealing, cumbersome, or easy to miss.

![Nudge Technique](https://images.ctfassets.net/23aumh6u8s0i/3ADJoKGdFIwDeK42Ax6hHa/8ebec8e7efbcb94dfbedd8744e90bacf/dataprivacy-nudge-technique)

The ICO’s code is unique for its emphasis on the “[best interests of the child](https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/age-appropriate-design-a-code-of-practice-for-online-services/1-best-interests-of-the-child/).” Organizations that use the personal data of minors are encouraged to consider how they can:

* Keep children safe from exploitation (whether commercial or sexual),

* Protect health and well-being (physical, psychological, and emotional),

* Support parents in protecting the best interests of children, and

* Recognize children’s ability to form their own views as they develop and “give due weight to” those views.

### How Businesses Are Responding to the Code
The code still needs to be officially approved by Parliament, but assuming it passes, organizations will have a year to update their policies before the rules take effect, most likely in fall 2021.

While the [ICO has stated](https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/age-appropriate-design-a-code-of-practice-for-online-services/enforcement-of-this-code/) its commitment to helping organizations comply with the new rules, they have also made it clear that they intend to rigorously enforce the law. This may include reprimands, orders, and, “for serious breaches of the data protection principles... fines of up to €20 million or 4% of your annual worldwide turnover, whichever is higher.”

Some [businesses have complained](https://ico.org.uk/media/about-the-ico/consultations/aadc/2616638/conde-nast-britain-aadc-response.pdf) that having “the best interests of a child” in mind when designing a product is a vague directive, especially for online services used by adults and children alike. But the ICO has been firm in its commitment to this principle. As Commissioner Denham said in her statement: “In an age when children learn how to use an iPad before they ride a bike, it is right that organisations designing and developing online services do so with the best interests of children in mind. Children’s privacy must not be traded in the chase for profit.”

<include src="TweetQuote" quoteText="@ico has argued: _There are laws to protect children in the real world — film ratings, car seats, age restrictions on drinking and smoking. We need our laws to protect children in the digital world too._"/>

## The Global State of Children’s Privacy Legislation
The UK’s code is notable for going further than previous laws in protecting the digital privacy of minors, but it’s far from the only such law on the books.

The United States passed COPPA in 2000 and then amended it in 2013. This law prohibits online services from collecting the personal information of children under 13 without parental consent. COPPA applies to services that are designed for children or that have “actual knowledge” that they are collecting data from children.

The California Consumer Privacy Act ([CCPA](https://dataprivacy.foxrothschild.com/2019/06/articles/california-consumer-privacy-act/selling-childrens-data-under-ccpa-no-minor-issue/)) is broadly consistent with COPPA, with a few tweaks. Under the CCPA, businesses can’t sell the personal information of minors under 16 without permission. If the child is under 13, permission must be given by a parent or guardian, but minors between 13 and 16 can opt into data sales themselves.

Other states, including [Connecticut and Massachusetts](https://www.ncsl.org/research/telecommunications-and-information-technology/consumer-data-privacy.aspx), attempted to pass similar legislation in 2019. Thus far, those bills have failed to pass, but with more data privacy legislation being cooked up all the time, the trend isn’t going anywhere.

Meanwhile, across the pond, the General Data Protection Regulation ([GDPR](https://auth0.com/docs/compliance/gdpr)) requires parental consent to process the data of children under 16, although member states can modify that to be as low as 13. In addition, the GDPR applies to data collection, not just data sales. Unlike the CCPA, it provides no exemption for organizations that claim they are unaware a user is a child.

<include src="TweetQuote" quoteText="Children’s data privacy scandals recently hit @ring @youtube. Find out why children’s privacy is driving #dataprivacy legislation in 2020."/>

## For Businesses, Authorization Is Central to Compliance
All the laws we’ve discussed demand that online services treat users differently if they are children, but this raises the question: How do you know the person on the other end of the screen is a child? For that matter, how do you know that the person giving their consent for data use is actually their parent or guardian? The answer is a matter of authorization.

Most people who share streaming accounts with their families have seen authorization separate the adults (who will be recommended the latest Scorsese drama) from the children (who will be steered toward _My Little Pony_). Media companies do this by creating multiple user profiles under a single account, enabling greater personalization and ensuring that kids’ profiles are treated differently. 

There are several [authorization models](https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/age-appropriate-design-a-code-of-practice-for-online-services/) for accomplishing this, which can support varying degrees of complexity and customization. For example, in the Attribute-Based Access Control (ABAC) model, permissions are assigned based on their attributes, including age. In contrast, in the Relationship-Based Access Control (ReBAC) model, permissions are assigned based on relationships, which enables policies that reflect real-world user dynamics. 

Even with social mapping, it can be tricky for companies to verify the relationship between an adult and child. Most companies consider the person who can pay to be an adult, and so they allow the subscription holder to indicate which profiles belong to children. The ICO also lays out  identity verification methods for determining the age of a user, which businesses can choose from based on their resources and the risk level of the data they’re collecting:

* **Self-declaration**, in which a user states their age but gives no other evidence. This is suitable only for low-risk situations

* **Artificial intelligence** gleaned from observing how users interact with the service. This method provides a greater level of certainty but has privacy pitfalls of its own. Under the ICO, businesses that go this route must inform users up front and adhere to the principles of data minimization and purpose limitation for all data collected this way.

* **Third-party age verification services:** These services use an “attribute” system to confirm the age of a user without the website or app needing to request additional personal information. That presents an advantage for businesses, but you must be careful to ensure that these third-parties are reasonably accurate and that they themselves are not violating data protection laws.

* **Account-holder confirmation** can be employed in cases where you know an existing account holder is an adult, so they can confirm the age of additional users through an email or text of a known device.

* **Technical measures** can strengthen self-declaration. For example, if a user is denied access to a service for being too young, you may prohibit them from immediately resubmitting the form with a different age.

* **Hard identifiers** are formal identity documents, such as passports. This is an option of last resort because some children don’t have access to such documents, and requiring them may be discriminatory to those users.

### Children’s Data Privacy Takes a Village
The push for giving specific data rights to children shouldn’t discourage organizations from designing products that cater to them. Nor should organizations use data privacy to lock kids out of the digital world; rather, they should help kids become thoughtful participants in that world. Hopefully, these laws will inspire companies to be more thoughtful in crafting policies that respect children’s curiosity as well as their safety.


It’s Time for a Fresh Approach to Children’s Data Privacy

New regulation is part of a global push for MFA



At the end of April, the Australian Communications and Media Authority (ACMA) will begin requiring all telcos to implement two-factor authentication (2FA) when customers transfer their phone numbers between providers.

ACMA member Fiona Cameron was quoted in [ZDNet](https://www.zdnet.com/article/australian-government-introduces-new-telco-regulations-to-fight-phone-scams/), explaining her support for this regulation: “Mobile number fraud can have devastating effects as scammers can gain access to bank accounts, email, social media and more... [V]ictims struggle to regain control over personal and financial information, often over the years."

For Australian businesses providing telco services, including virtual networks of any size, this new 2FA requirement demands immediate attention. Telecommunications companies that fail to comply can be [fined up to $250,000](https://www.theguardian.com/money/2020/feb/28/acma-announces-new-rules-on-porting-mobile-numbers-to-tackle-identity). 

But even if you're not directly involved in telecommunications services—and don’t operate in Australia—this news is important. It represents a global movement, in which lawmakers are increasingly treating [multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) as a requirement rather than a mere recommendation.

## What Australia’s Regulation Entails
On its face, ACMA’s 2FA requirement is fairly limited in scope. The law requires that when customers switch (or “port”) their mobile phone numbers from one provider to another, 2FA must be in use to ensure that the number is not being hijacked by scammers. The telco will implement 2FA by sending a one-time SMS code to a customer’s phone number or email. 

2FA is the most common form of MFA. It’s more secure than logging in using a simple (easily stolen or hacked) password because it communicates with an account or device already associated with a user’s identity. 

However, some have argued that SMS codes aren’t the strongest 2FA choice to break the cycle of fraudulent phone porting. Australian Communications Consumer Action Network chief executive Teresa Corbin told [_The Guardian_](https://www.theguardian.com/money/2020/feb/28/acma-announces-new-rules-on-porting-mobile-numbers-to-tackle-identity), “We’d like to see the Acma require telcos to use highly secure forms of verification, such as hardware or software authentication tokens, which are generated with a mobile app.”

There may not be a perfect consensus on Acma’s solution, but no one denies that Australia’s specific focus on phone porting comes in response to a real security need. [According to Paul Fletcher](https://www.news.com.au/technology/consumer-issues/twofactor-authentication-to-be-made-mandatory-for-mobile-phone-number-transfers/news-story/845224336b099726f6a7410461ff8143), Australia’s Minister for Communications, Cyber Safety and the Arts, scammers steal the identities of thousands of Australians yearly through fraudulent porting, costing an average of AUS$10,000 per victim.

<include src="TweetQuote" quoteText="Find out why @acmadotgov’s 2FA requirement for all telcos to implement two-factor authentication (2FA) when customers transfer their phone numbers between providers is a global forerunner."/>

These attacks are often very targeted (unlike ransomware) in order to steal money by gaining access to financial accounts or bitcoin wallets. They are also used to target high-value people at companies (think admins) to access highly valuable resources. In 2018, [Reddit was breached](https://www.wired.com/story/reddit-hacked-thanks-to-woefully-insecure-two-factor-setup/) in one of these “SIM swapping” attacks, which prompted them to stop using SMS authentication in favor of token-based 2FA. 

The biggest players in Australia's telecommunications industry (Telstra, Optus, and Vodafone) already require pre-port authentication, but the government believes smaller service providers also need to implement the requirement or risk attracting scammers to their networks. Those network providers will have until April 2020 to achieve compliance with the regulation.

## Why Australia Is Getting Aggressive on Cybersecurity
Passing mandatory 2FA for telco is just one part of the Australian government’s broader effort to tighten cybersecurity. Last year, the government instituted the [Notifiable Data Breach](https://www.wired.com/story/reddit-hacked-thanks-to-woefully-insecure-two-factor-setup/) (NBD) program, requiring companies to notify individuals when their data has been compromised. Australia’s government is in the midst of overhauling its 2016 cybersecurity strategy, and MFA authentication was one of the “[Essential Eight](https://www.bit.com.au/guide/your-guide-to-the-essential-eight-security-strategies-451152)” security steps recommended by the Australian Signals Directorate in 2017.

While the telco 2FA regulation is highly targeted at phone porting, it’s still an indicator that Australia's federal government is willing to legislate 2FA in the name of consumer protection. This initial rule could be part of a regulatory framework that may spread to other industries. According to [ZDNet](https://www.zdnet.com/article/australian-government-introduces-new-telco-regulations-to-fight-phone-scams/), “the government believes there are still one million services that are yet to have these consumer safeguards implemented,” and these service providers may be under the microscope next.

However, the Australian government is clearly still weighing how forcefully to regulate businesses. The 2FA requirement is the first piece of policy to come out of Australia's [Scam Technology Project](https://www.acma.gov.au/theACMA/scam-technology-project), a partnership between industry and the government.

In September 2019, the government circulated a public survey soliciting input on the appropriate balance between industry self-regulation versus governmental intervention on matters of cybersecurity. The [survey](https://www.homeaffairs.gov.au/reports-and-pubs/files/cyber-security-strategy-2020-discussion-paper.pdf) asks, among other things: “Do you agree with our understanding of who is responsible for managing cyber risks in the economy?” and “Do you think the way these responsibilities are currently allocated is right? What changes should we consider?”

<include src="TweetQuote" quoteText="@acmadotgov’s 2FA requirement will provide better protection for people switching telco providers. Discover why it could pave the way for additional global MFA adoption."/>

### MFA Is Becoming a Global Standard
While Australia’s law is a pioneer in specifically mandating 2FA for phone porting, MFA is increasingly required to do business with private corporations and certain government agencies and in order to be compliant with broader data privacy laws.

In June 2019, [Microsoft announced](https://krebsonsecurity.com/2019/06/microsoft-to-require-multi-factor-authentication-for-cloud-solution-providers/) that all of its Cloud Solution Providers (CSPs) had to use MFA. In the United States, [the IRS requires](https://www.irs.gov/privacy-disclosure/multi-factor-authentication-implementation) that any federal, state or local employee accessing IRS data remotely must use MFA.

While the EU’s [General Data Privacy Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance/protect-user-data) doesn’t specifically stipulate that businesses must implement MFA, it does require “appropriate security measures” to protect personal data, and it holds businesses liable for any breach. Because MFA is among the strongest safeguards available to protect data, GDPR compliance practically makes it a necessity. The European Union Agency for Cybersecurity (ENISA) published a [list of guidelines](https://www.enclave.ie/blog/multi-factor-authentication-is-recommended-by-the-european-union-agency-for-network-information-security-for-gdpr.508.html) when GDPR became law. In it, they specifically advised that any system handling personal data use 2FA.

In addition, the EU mandates [Strong Customer Authentication (SCA)](https://ec.europa.eu/info/publications/190913-safer-payment-services_en) for payment service providers, requiring that electronic payments user MFA.

The private sector is quickly recognizing that instituting MFA is critical to protecting data against breaches and staying compliant with data privacy laws. According to [Global Industry Analysts'](https://www.reportlinker.com/p03329771/Global-Multi-Factor-Authentication-MFA-Industry.html?utm_source=GNW) October 2019 report, the 2FA market worldwide is predicted to grow to US$12.1 billion by 2025, with potential growth of 14.3%.

Historically, many businesses have shied away from implementing MFA. For example, a [2018 Experian report](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf) found that only 44% of eCommerce businesses implemented MFA, out of concern that any demand for credentials would be a source of friction that might alienate customers and hurt profits.

However, with each new regulation that requires (and therefore normalizes) MFA, the perceived level of friction decreases. In other words, customers are becoming more accustomed to encountering MFA whenever they conduct sensitive transactions, so no individual business that implements it needs to worry about presenting an undue burden on the end-user.

That isn’t to say that businesses (in Australia or otherwise) shouldn’t be thinking about implementing MFA in order to ensure a seamless customer experience. Not every login attempt should require users to get a one-time code; [step-up authentication and adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/) tailor MFA requests based on risk.

Furthermore, a good MFA solution is designed to prioritize UX by completing authentication requests in as few steps as possible. Auth0’s [Guardian MFA](https://auth0.com/multifactor-authentication), for instance, lets users authenticate through a simple push notification on their phones.

![Multifactor Authentication Dashboard](https://images.ctfassets.net/23aumh6u8s0i/76dOMSouGVa1RG4sZHWMIl/fb3c361a75713719bef1665bc9ba185d/mfa-dashboard-1)

## Auth0 Can Ease the Journey to MFA
The legal requirements, customer expectations, and technological capabilities around MFA are evolving rapidly. Australia’s 2FA requirement for phone porting is just one sign that the prevailing winds are pushing industries toward more secure authentication solutions. In light of this, businesses who have avoided implementing MFA should take this opportunity to reconsider their stance.

Aside from any regulatory mandate, MFA is no longer an inherent source of friction for customers. When you outsource this capability to an authentication partner like Auth0, you can reap the benefits of MFA solutions that are secure and compliant and are as easy on your customers as possible.

For a deeper dive into MFA and the potential implications for your business, please check out our whitepaper [When is MFA the right choice](https://info.auth0.com/contact.html?utm_source=blog&utm_campaign=2020-03-aus-mandates-2fa)? 


Australia Mandates Two-Factor Authentication for Telcos

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

These days, data privacy can make or break Mergers & Acquisitions


Merger and acquisition (M&A) deals can take years to put together, and they involve hundreds of moving parts, but it takes only one faulty element to turn a deal from a success story to a cautionary tale — especially if that element is cybersecurity.

According to one survey by Forescout Technologies, [53%](https://www.forescout.com/company/news/press-releases/forescout-study-reveals-cybersecurity-concerns-on-merger-and-acquisition-activity/) of respondents reported that their organization had encountered a critical cybersecurity issue during an M&A deal that put the deal into jeopardy, and 65% of respondents experienced regret after closing a deal because of cybersecurity concerns.

In the current regulatory environment, with the passage of the [GDPR and the CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA), and with more data privacy laws in the works, cybersecurity, and data privacy have become crucial elements of pre-M&A due diligence. If an acquiring company doesn’t like what they find, they may walk away from the deal or later wish they had.

Here, let’s go over three recent M&A transactions that never got off the ground or whose deal value was severely undermined by data security issues.

## Facebook Walks Away From Tiktok’s Forebear
[_Fortune_](https://fortune.com/2019/11/13/facebook-musically-tiktok-bytedance-acquisition/) reports that in 2016, Facebook spent months considering a possible acquisition of Musical.ly, which later became TikTok, the massively popular video app. Facebook passed on the deal because of two concerns: the app was based in China, and its predominately underage user base would likely run afoul of American laws governing child internet privacy.

After Facebook opted out, Musical.ly went on to be acquired by Beijing-based startup ByteDance for $1 billion. Today, TikTok is a runaway hit with [over a billion](https://www.cnn.com/2019/06/20/tech/tiktok-bytedance-users/index.html) active users, but it's grappling with the same cybersecurity issues that made Facebook walk away, and those may even threaten ByteDance's acquisition.

In November 2019, [Reuters](https://www.reuters.com/article/us-tiktok-cfius-exclusive/exclusive-u-s-opens-national-security-investigation-into-tiktok-sources-idUSKBN1XB4IL) reported that ByteDance was being investigated by the Committee on Foreign Investment in the United States (CFIUS) because of national security concerns. Apparently, lawmakers were alarmed by [reports from TikTok employees](https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-where-us-views-about-censorship-often-were-overridden-by-chinese-bosses/) that their bosses in China compelled them to censor videos, including political content. There were also concerns about the security of the app’s data on U.S. users, and in December, ByteDance was hit with a [class-action lawsuit](https://www.bbc.com/news/business-50640110) in California. The suit claims that TikTok collects and stores “vast quantities” of user information without consent and then sends that data to servers in China, in violation of multiple laws.

<include src="TweetQuote" quoteText="What made @facebook walk away from TikTok. #mergersandacquisitions #lessons"/>

ByteDance has attempted to address these concerns by fencing off its U.S. operations from China, but if they fail to convince CFIUS, the committee may force ByteDance to divest from its holdings of Musical.ly, effectively reversing the acquisition. It wouldn’t be the first time CFIUS has intervened in M&A deals over data privacy concerns. In recent years, lawmakers have been vigilant about policing cross-border M&A deals, especially between tech companies.

In 2017, CFIUS refused to allow China’s Ant Financial to buy MoneyGram due to worries about the security of personally identifiable data of Americans, and last year, CFIUS forced Chinese company Kunlun Tech Co Ltd to sell the gay dating app [Grindr](https://www.reuters.com/article/us-grindr-m-a-exclusive/exclusive-us-pushes-chinese-owner-of-grindr-to-divest-the-dating-app-sources-idUSKCN1R809L). All of these stories point to the necessity of keeping data privacy top of mind when considering an international M&A deal, especially one with China.

## Verizon’s Acquisition of Yahoo Unearths a Privacy Nightmare
In 2017, [Verizon acquired Yahoo](https://www.washingtonpost.com/news/the-switch/wp/2017/06/13/its-official-verizon-finally-buys-yahoo/) for $4.48 billion, but the deal almost fell through over two data-breach scandals that came to light in the midst of negotiations.

Yahoo revealed that they had suffered two separate data breaches, which they had not made public. In the first breach, a hacker stole the personal data of at least 500 million users, including some unencrypted passwords and answers to security questions. As [TechCrunch](https://techcrunch.com/2016/09/22/yahoo-confirms-state-sponsored-attacker-stole-personal-data-of-at-least-500-million-users/) reported at the time: “With the answers to security questions, a hacker could easily jump through a number of online forms to reset users’ passwords on sites where an additional means of account verification — like two-factor authentication — is not involved.”

In the second breach (widely reported to have been carried out by a state-sponsored actor), 1 billion accounts were compromised, and again personal information and login credentials were stolen. Yahoo’s chief information security officer reported that stolen passwords were hashed using MD5, but [tech insiders countered](https://techcrunch.com/2016/12/14/yahoo-discloses-hack-of-1-billion-accounts/) that MD5 was an outdated and insecure form of hashing that could easily be cracked to reveal the passwords.

In the end, Verizon went ahead with the acquisition of Yahoo but knocked $350 million off the purchase price. Verizon also agreed to share legal liability for the breaches with Yahoo. It was a costly inheritance, and, coupled with the PR fallout, it damaged the deal’s value in ways that will doubtlessly be felt for years.

In the wake of this scandal-plagued acquisition, the [SEC issued new guidelines](https://www.sec.gov/rules/interp/2018/33-10459.pdf') for cybersecurity disclosures, so neither shareholders, customers, nor acquiring companies are kept in the dark about a data breach. Nevertheless, the Verizon-Yahoo story has made mergers and acquisitions dealmakers take a closer look at cybersecurity during due diligence in order to determine whether the target company has appropriate security in place to be legally compliant.

<include src="TweetQuote" quoteText="Why @verizon’s acquisition of @yahoo unearthed a privacy nightmare. #mergersandacquisitions #lessons"/>

## Marriott Acquires Starwood... and a Major It Headache
In 2016, [Marriott International purchased](https://www.cnbc.com/2016/09/23/marriott-buys-starwood-becoming-worlds-largest-hotel-chain.html) Starwood Hotels & Resorts for $13.3 billion, forming the largest hotel chain in the world. Despite initial enthusiasm for this megadeal, it has been fraught with difficulties, many stemming from problems integrating software between the two chains’ operations. Two years into the merger, the two chains still struggled to transform into a truly combined company, with [some hotels reporting](https://skift.com/2018/08/07/marriott-still-working-through-starwood-integration-two-years-after-deal/) that the transition to a new salesforce system got in the way of sales.

Then, in 2018, Marriott revealed that Starwood had suffered a massive data breach, in which nearly 400 million guest records were exposed through a security flaw in Starwood’s reservation system. The flaw in Starwood’s system had existed since 2014, long predating Marriott’s acquisition. But when the breach was discovered in 2018, two years after the deal, Starwood’s reservation system still hadn’t been migrated to Marriott’s.

In light of this, Marriott was hit with a [$123 million GDPR](https://www.forbes.com/sites/kateoflahertyuk/2019/07/09/marriott-faces-gdpr-fine-of-123-million/#1c7e3c654525) fine by Britain’s Information Commissioner's Office (ICO). In a [statement](https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/statement-intention-to-fine-marriott-international-inc-more-than-99-million-under-gdpr-for-data-breach/), Britain’s information commissioner, Elizabeth Denham, said, “The GDPR makes it clear that organizations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but also how it is protected.”

## Don’t Let Data Privacy Derail Your M&A Deal
The one thing all these M&A disasters have in common is that they could have been prevented, or at least mitigated, had the companies in question known what warning signs to look for. Each of these companies (both the acquirers and the acquired companies) could have benefited from the expertise of dedicated identity-management professionals.

The right partners could have implemented cutting-edge encryption for Yahoo’s personal information, could have integrated Marriott and Starwood’s systems more quickly and could have advised TikTok on the importance of data siloing in cross-border M&As.

In the year to come, investors will surely take these lessons to heart. Even though M&A activity is predicted to be robust in 2020, it will doubtlessly be tempered by caution around cybersecurity to ensure that these issues don't prevent M&A transactions from providing a return on investment.

If your business is in the M&A market, and you’d like to make sure it doesn’t have any cybersecurity skeletons in its closet, [reach out to the team at Auth0](mailto:sales@auth0.com).


Recent M&A Deals that Imploded Over Cybersecurity

Gain cloud flexibility and agility while maintaining security and control


Amazon famously brought [book publishing “to its knees”](https://mashable.com/2014/07/30/amazon-has-killed-publishers-they-just-dont-know-it-yet/) by dominating distribution, creating eBooks, and transforming the publishing world with its own titles and opportunity for authors to self publish. 

In 2018, [Amazon entered the insurance market in India](https://www.insurancebusinessmag.com/us/news/breaking-news/amazon-set-to-file-for-insurance-licence-111581.aspx). [And in 2019, the U.S.](https://www.geekwire.com/2019/amazon-jpmorgan-roll-new-health-insurance-plans-part-haven-joint-venture/) 

After killing off [car insurance comparison tools](https://www.businessinsider.com/google-kills-auto-insurance-comparison-tool-2016-2), Google’s invested in [insurance agency software](https://www.insurancejournal.com/news/national/2019/01/02/513324.htm) and signaled further interest in the market. 

In other words, digital transformation is already here. 

While industry complexities afford some protection, they offer greater opportunity for insiders, says TechCrunch. 

A recent [J.D. Power survey](https://www.jdpower.com/business/press-releases/2019-us-home-insurance-study) on customer satisfaction with home insurance noted that the home insurance business model was “primed for change” and that “weak points in customer experience offered an opportunity for startups.” 

The other side of the desire for customer experiences that are real-time and online is the fact that FinServs are tasked with protecting hackers’ favorite data targets. And the [global rise in data privacy regulation](https://auth0.com/explore/data-privacy/) makes stronger protections important from customer, legal, and compliance perspectives.

While digital transformation can seem daunting for incumbents relying on decades of legacy code, the right identity solution can create seamless customer experiences while increasing your data protection — even if you’re an incumbent partnering with (or acquiring an) up and coming Insurtech startup.

Forbes expects [XaaS (everything as a service), UX, CX (User/Customer Experience), and digital privacy](https://www.forbes.com/sites/danielnewman/2019/07/14/top-10-digital-transformation-trends-for-2020/#3dfc8bdc76be) to “take center stage” in as a digital transformation trend 2020. Like other industries, the need to streamline services, reduce capital expenditures, and be increasingly agile and innovative is fueling FinServ’s change. But FinServ’s need for security, stability, and high availability kept many systems in On-Prem solutions that have proven expensive to scale and maintain — putting the ability to keep up with evolving customer expectations at risk.

For FinServ’s looking to innovate (or even just keep pace), Public Cloud is often touted as an option, but it isn’t the best choice. Public Cloud outages and uptimes provide a strong reason to go private. Auth0 Private Cloud helps (or eliminate) that risk, by providing a secure, flexible, extensible solution. 

![Deployment Options Diagram](https://images.ctfassets.net/23aumh6u8s0i/23TVeU9N9cKlxxrenpT6hA/ae7991f61be42885833856bed91a74f7/deployment_options_diagram)

## Why Is Private Cloud Particularly Suited for Finserv Environments

For many years, incumbent FinServs have been buffered by deep compliance capabilities and an established customer base. But FinTech disruptors have eroded that edge says a recent PWC [report](https://www.pwc.com/gx/en/financial-services/assets/pdf/technology2020-and-beyond.pdf), in part because successful disruptors are able to offer a stronger customer experience at a lower cost to customers and with less investment. 

To solidify standing and increase the customer base in this environment, FinServ’s need to:

* Improve customer experience
* Keep ahead of evolving data privacy regulations
* Reduce costs without sacrificing cybersecurity

The data that FinServs hold makes them a prime target for hackers — and the sheer company scale usually means millions of breached accounts, rather than thousands. Globally, the increase in data privacy laws like GDPR and CCPA demonstrates that regulators have lowered tolerance for breaches and expect greater protections to be in place. When not implementing features like multi-factor authentication (MFA) can hit an insurer with a large fine, like what happened to [Dutch public insurance company UWV](https://auth0.com/blog/gdpr-fines-hit-these-companies-hard-heres-how-to-avoid-them/), the need for greater security while still ensuring flexibility becomes more appealing.

<include src="TweetQuote" quoteText="The data that FinServs hold makes them a prime target for hackers — how Private Cloud can help."/>

From an identity perspective, let’s take a closer look at what Auth0 Private Cloud can mean for key digital transformation considerations.

### Performance at Scale
The most innovative solution in the world does zero good if it doesn’t offer you the performance you need.  Auth0 Private Cloud offers request-per-second (rps) baseline is higher than public cloud, with the option of adding on capacity up to 1500 rps.

### Reliable High Availability
FinServ is more aware than most industries the dramatic impact of service interruptions, especially given the pressures of changing global conditions. High availability helps guard against those challenges, especially since Private Cloud can be deployed between two regions to provide failover.

### Control & Segregation
Managed Private Cloud offers a fully-isolated development environment that is updated independently from the production environment. Standard Private Cloud is a single instance production environment. Both Standard Private Cloud and Managed Private Cloud meet standards that require all data to be housed within specific regions.

### Free Developers to Improve Customer Experience
For a developer coming up with an innovative solution while working only On-Prem can feel like trying to code while wearing handcuffs — it’s hard to even get your hands on the keyboard. 

To keep up with the pace of customer’s hunger for real-time innovations, streams of data from connected vehicles and smart homes, and the data privacy compliance requirements from laws like GDPR and CCPA, developers need not only the flexibility but also the scale of a [cloud deployment](https://auth0.com/cloud). And they need that deployment to be secure and reliable enough to handle the demands of enterprises whose customers are often interacting during moments of high stress or need.

### Unify Legacy and New Data Stores
Unifying legacy and new data stores can be a giant headache, as well as a source of weeks of downtime without a plug-n-play identity solution that allows bulk imports, but can also streamline user migration without expensive forced password resets – whether unifying stores at a single organization or when an incumbent partners or acquires an insurance startup.

### Support for Different Languages/Architectures (SDK)
Aside from unifying data stores, incumbent companies often rely on a maze of programming languages and architectures. Shutting down one part of the maze can have unexpected consequences if all the interrelationships aren’t fully mapped out or even understood due to poorly commented code or loss of institutional knowledge due to attrition or staffing turnover.

Your devs will be a lot happier (and more productive) when working with an identity solution that can handle multiple programming languages and architectures and already has SDKs (software development kits) that can be dropped into place to provide rapid access to functionality. And the right solution gives you the flexibility to map the maze at your own pace, reducing costs by removing unnecessary middleware, maintenance, and security as you deem appropriate.

### Extensibility
<iframe width="560" height="315" src="https://www.youtube.com/embed/kCmU4EMMPf0" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

The real world is a messy place where you might have an out-of-the-box tool that needs to be integrated with custom code. The ability to inject code into the Auth0 Identity solution means that developers can handle the last-mile customizations that execute on the C-suite’s business strategy without weeks of downtime or missed opportunities. To delve into this topic in greater technical detail, you might also check out Auth0 Principal Architect Vittorio Bertocci’s whitepaper “[The Tao of Extensibility.](https://auth0.com/resources/whitepapers/tao-of-extensibility)”

## Support and Failover
Uptimes, updates, failovers, and support can have a big impact on the success of your deployment. 

With Public Cloud coming in with an uptime SLA of 99.90%, Private Cloud offers a stronger uptime SLA of 99.95% with the option to upgrade to maxim uptime guarantees of 99.99%. Geo redundancy can provide resiliency against catastrophic events. As mentioned above, Private Cloud offers failover between two geographic regions. 

For teams that would appreciate additional support, Auth0 offers a support SLA as an add-on, as well as the add-on option to work with the skilled identity experts on our Professional Services team.

## Managed Private Cloud vs. Standard Private Cloud
Let’s take a look at the different deployment Private Cloud models and benefits, including a checklist to help you assess deployment needs.

**Standard Private Cloud** is a low touch engagement model that offers additional power, security and compliance* benefits through an isolated tenant just for a single customer. Uptime SLA is 99.95% with an upgrade possible to 99.99%. PCI compliance is available as an add-on.

**Managed Private Cloud** is a high-touch engagement model where customers are much more involved with all aspects of this deployment model. Our team will work closely with the customer to ensure all aspects of their Auth0 environment are tuned for what best suits their business needs. Uptime is 99.99%. PCI compliance is available as an add-on.

**Reasons to choose Managed Private Cloud**                                                                                                          * **Choice of update frequency**<br>Coordinated with Auth0 (required once per 3 months). The update cycle begins with the Pre-Production Environment.
* **A separate DEV (Pre-Production) environment**<br>Fully-isolated and independently updated instance for development and testing (Single Node)
* **On-demand scaling**<br>WIll scale customer environment for any spikes                                                                              * **Load Testing**<br>4x Load Testing per year with dedicated Auth0 MSE Support                                                 * **Customer-hosted AWS deployment**<br>More **control** over the environment                                                                              * **GEO-HA deployment option**<br>Datacenter **redundancy** and automatic **failure handling**.                                                               
<br>
**Reasons to choose Standard Private Cloud**
* ***Doesn’t require any of the Managed Private Cloud reasons***
* **More cost-effective**
* **Less involved with managing the deployment**<br>The customer is looking for an offering that feels similar to a standard Public Cloud SaaS but has isolation and the other advantages of our Private SaaS Deployments. |

<include src="TweetQuote" quoteText="Legacy code can make #digitaltransformation feel like a high hurdle for FinServs. Find out how Private Cloud can help securely smooth the jum"/>

## Reduce Risk, Increase Innovation With Private Cloud
Like identity, digital transformation is not a one-and-done solution, but an ongoing need to keep pace with the evolution of technological change. Auth0 Private Cloud provides the flexibility, agility offered by cloud deployments but allows FinServ’s to maintain the control and security they need to protect their customers and their businesses. Your IAM solution is a critical component of your security strategy, but even if you’re dealing with decades of legacy code, you don’t need to sit down and build it in-house. The more secure option is to let identity experts protect those critical credentials, freeing your team (and resources) to focus on what you do best. Identity no longer needs to be a roadblock or an afterthought. Identity Access Management (IAM) is an essential component of customer security and privacy. If you’d like to learn more about how Auth0 Private Cloud might work for your particular situation, please reach out to an [Auth0 resource](https://auth0.com/).


How FinServs Can Reduce Risk, Increase Innovation with Private Cloud

Executives are being held to account by regulators and seeking to shape the law


In January 2020, the FTC released a [statement](https://www.ftc.gov/news-events/blogs/business-blog/2020/01/new-improved-ftc-data-security-orders-better-guidance) defining its new position on data security orders, to give companies a clearer understanding of the FTC’s expectations for security practices. The new orders specifically emphasize the role of executives in taking responsibility for overseeing policy, in the hopes that C-Suite and board-level buy-in will improve compliance.

Under the new orders, companies must present their board with an annual report on their security program, and senior officers must directly provide the FTC with certifications of compliance. According to the FTC’s statement, “This will force senior managers to gather detailed information about the company’s information security program, so they can personally corroborate compliance with an order’s key provisions each year.”

The FTC asserts that requiring high-ranking executives to provide certifications under oath has been effective in other sectors, such as securities law since it creates direct accountability for individual executives. They cite two studies that correlate executive involvement in data security with a decrease in breaches, including one that found a 35% decrease in the probability of breaches when a company’s Chief Information Security Officer is in the top management team and has access to the board.

<include src="TweetQuote" quoteText="Find out why the @FTC’s new data security orders will require the C-suite and board to strengthen data security strategies."/>

## Executives Are Influenced by Policy and Are Influencing It

PWC’s [Top Policy Trends 2020](https://www.pwc.com/us/toppolicytrends) report surveyed over 400 CEOs, CFOs, and COOs, and concluded that data is “the unifying thread” across all the major policy areas the C-Suite is concerned within 2020. Specifically, the report highlighted data privacy as a central concern for the C-Suite, with 44% of CEOs listing it as one of the top three policies impacting their business the most.

For the past two years, organizations have been forced to adapt their data policies to a rapidly evolving regulatory landscape, most notably the EU’s [General Data Protection Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr) and the [California Consumer Protection Act (CCPA)](https://auth0.com/resources/whitepapers/simple-guide-CCPA-compliance). Most executives recognize the need for greater regulation on how businesses collect, store, share, and protect sensitive personal data. However, many are also worried that a global patchwork of contradictory regulations could hamstring their ability to operate their businesses across various jurisdictions and hope to work toward more universal standards for data privacy and security. Indeed, of the C-Suite executives PWC surveyed, close to 70% say their organization is “very actively” seeking to shape data privacy policy.

While it’s healthy for executives to help create laws that are informed by the reality of doing business, business leaders must exercise care in attempting to influence legislation, or risk a backlash. A prime example is CCPA, which in its current form is significantly weaker than the original ballot referendum, which would have granted Californians more rights.

While fines under CCPA can still be significant, one of the initiative’s drafters, [Mary Stone Ross](https://www.fastcompany.com/90444501/i-helped-draft-californias-new-privacy-law-heres-why-it-doesnt-go-far-enough), publicly criticized corporate lobbyists for their role in drafting the final legislation.  Ross voiced the hope that new laws at the state and federal level would “learn from California and guard against the relentless efforts of corporations to weaken people’s rights.” In the long-term, this negative perception of corporate influence erodes public trust and makes it more difficult for businesses to wield their influence responsibly. Already, [CCPA 2.0](https://www.barrons.com/articles/california-consumer-privacy-act-alastair-mactaggarts-51576779571), which gives consumers more rights and increased enforcement powers, is set to be a ballot initiative in 2020. 
Policy aside, the public at large is increasingly sensitive to businesses whose actions don’t live up to their professed values. When Facebook’s stock tumbled 7% in January, despite strong quarterly revenue, [_The Guardian_](https://www.theguardian.com/technology/2020/jan/29/facebook-fourth-quarter-earnings-stock) suggested that “continuing scandals and regulatory roadblocks may finally be catching up with the social media giant.”

## Strategies for the C-Suite to Lead on Data Privacy
In the second edition of [_Navigating the Digital Age_](http://securityroundtable.org/ndte/ndte2.pdf), published by Palo Alto Networks and the NYSE, experts and executives from across various tech sectors joined together in a clarion call for greater innovation, collaboration, and leadership on issues of privacy and security. Their advice ranges from big picture ideas (the word “moonshot” appears 28 times) to small but crucial suggestions for improvement.

In his chapter, security advisory Marc Goodman advises leaders to pay attention to the UX of cybersecurity, since the design of many legacy security programs is “abysmal and painful.” The design of a pop-up security warning window might seem insignificant, but if it’s all that’s standing between your employee and a catastrophic security mistake, it’s a big deal. Says Goodman: “It’s not enough that our security protocols work in theory; they have to work where the rubber meets the road at the end of a keyboard... And that requires a good understanding of human behavior—something infrequently accounted for in organizational cybersecurity strategies.”

<include src="TweetQuote" quoteText="@FTC ordered the C-Suite and board to get more involved with data security. Why IAM is a strong place to start."/>

One subject that many experts mention as a lynchpin in transforming cybersecurity is authentication. Ann Johnson, Microsoft’s Corporate Vice President of Cybersecurity Solutions, writes that one of the most encouraging current developments in cybersecurity is “the imminent demise of passwords.” This outdated and breach-prone form of authentication is “giving way to biometrics and other steps in multi-factor authentication, making it harder for bad actors to penetrate our firewalls and grab our personally identifiable information, intellectual property, and digital assets of every format.” Of course, experts have been predicting the demise of passwords for ages, but until that day actually comes, it’s crucial to do a better job of securing usernames and passwords.

There’s a growing consensus that sophisticated Identity and Authentication Management (IAM) platforms offer executives a fast and comprehensive way to get control of data and step up security. That consensus is largely responsible for [Auth0’s explosive](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) growth in recent years. As [Auth0 customer Rolf Bekkstrand](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/) attested, “As a CTO, I really don't want to be responsible for a data leak that showed passwords and user logins and those kinds of things. I'm 100% sure that Auth0, a company that is built around this, will have better ability to take care of the security than I'm able to do — your entire business depends on it.”

## To Get Involved With Data Privacy, Start by Getting Educated
For the C-Suite, taking the lead on issues of data privacy and cybersecurity begins with listening. Executives must listen to their users’ concerns, and they must also seek out opportunities for expert education so that they can make informed decisions for their companies.

At Auth0, we pride ourselves on providing not just a cutting-edge IAM platform, but also advice for leaders (whether they’re our customers or not) who are interested in stepping up their approach to security. If you’d like to explore strategies to get your C-Suite up to speed, [reach out to an Auth0 resource](mailto:sales@auth0.com).


The FTC Orders the C-Suite to Get Involved in Data Security

How Startups and SMBs can balance compliance with growth



For startups and small and medium-sized businesses (SMBs), “Move fast and break things” is no longer a viable philosophy for data privacy. Today’s startups and SMBs face the same relentless pressure to innovate, grow, and scale as the Silicon Valley darlings of yesteryear but must contend with a slew of new laws demanding much greater care in how customer data is handled.

The rapidly shifting attitudes and regulations governing data privacy are putting executives in a challenging position. After all, customer data remains an essential asset in doing business, and tasking developers to build and maintain identity management tools is costly and time-consuming and pulls them away from working on your company’s core product.

Data privacy laws have existed in Europe, the Middle East, and Africa for some time, but we’re in the midst of a new wave of global laws, led by the EU and California. Given the threat of massive fines, and the genuine public interest in preventing data mismanagement, startup and SMB executives are having to give [data privacy](https://auth0.com/explore/data-privacy/) greater consideration than in the past.

In this piece, we’ll offer a primer on current and upcoming data privacy laws and discuss how outsourcing identity management can make you compliant without sacrificing growth.

## Catch up to (and get ahead of) the laws

The current data privacy laws differ in their specifics, but they operate from similar sets of principles. The most fundamental shared mandates concern the right of users to access and control their personal data and the obligation of companies to disclose a breach of such data.

To comply with these laws, companies must be transparent in communicating their data practices and offer users the means to control, export, and remove their data.

Looking at the two most prominent laws and the others they have inspired will give executives a sense of where these trends are heading.

![Illustration of data privacy separator 01](https://images.ctfassets.net/23aumh6u8s0i/4XkWjoyQ9J2SUHkUo63OzT/f3fc030e823110e367abe0179057b4b0/data-privacy-illustration-separator-01)

## General Data Protection Regulation ([GDPR](https://auth0.com/gdpr/))

The EU’s landmark privacy legislation set the standard for the new age of data privacy by emphasizing user consent and calling for transparency and accountability in data collection. The GDPR applies to any company (not just tech) that processes the data of EU residents, regardless of the company’s size or where they are headquartered.

Anyone who doubted the seriousness of this law has been proved wrong by the wave of GDPR fines issued in recent months, prompting one Gabe Morazan, director of product management at CrownPeak to dub 2019 the “[year of enforcement](https://digiday.com/media/2019-is-the-year-of-enforcement-gdpr-fines-have-begun/).”

While the fines levied against Google and other major corporations have grabbed headlines, smaller companies are far from exempt. [TechRepublic](https://www.techrepublic.com/article/gdpr-fines-levied-so-far-the-lessons-businesses-can-learn/) reports that in the past year, a Portuguese hospital, a Danish taxi company, and the German social media company Knuddels were all slapped with penalties for failing to adequately protect, delete, or anonymize data. As TechRepublic states: “It does not matter to the European data protection authorities whether violations of the provisions of the GDPR are unintentional mistakes stemming from neglect, laziness, sloppiness, or ignorance.”

## California Consumer Privacy Act ([CCPA](https://auth0.com/blog/yes-data-privacy-applies-to-you/))

California’s privacy law, which takes effect January 1, 2020, has a great deal of policy overlap with the GDPR, though there are also [substantive differences](http://bakerlaw.com/webfiles/Privacy/2018/Articles/CCPA-GDPR-Chart.pdf). The CCPA applies to companies with customers in California, provided they:
- Have a gross revenue above $25 million
- Hold data on more than 50,000 consumers
- Earn at least half their revenue from selling personal data.

The [CCPA](https://auth0.com/ccpa/) allows for personal data to be collected, used, and sold, provided it is sufficiently deidentified. However, much like the GDPR, it requires that companies make their data collection policies available to customers and give them the ability to opt out of certain types of reselling. 

CCPA has also undergone several significant [amendments](https://www.adlawaccess.com/2019/09/articles/ccpa-update-legislature-amends-the-ccpa-to-exclude-employee-data-b2b-communications-for-one-year/) that require, among other things, for data brokers to register in California, for businesses to require at least two ways for customers to request information, and a one-year exemption on collecting employee data.

![Illustration of data privacy separator 02](https://images.ctfassets.net/23aumh6u8s0i/6qHnwuxvn5oC7kf9p7rIDj/f1bc4b28698f0c853632d08b1bd6f674/data-privacy-illustration-separator-02)

## Future (stricter) legislation

More laws are currently on the books or in the works that go much further than CCPA or the GDPR. However, in this environment, it’s easy for founders to be confused about which set of laws to tailor their product to. But generally, it’s a good rule of thumb to build on the principles laid out in the legislation discussed above, while still keeping an eye on the latest developments.

The [EU’s ePrivacy Regulation](https://iapp.org/news/a/eprivacy-regulation-continues-to-stall-but-theres-hope/) hasn’t passed yet, due to concerns that it’s too strict in prohibiting benign forms of tracking and cookies, but some form of it is likely to pass in the coming months.

In the United States, Maine's privacy law goes into effect in July 2020, and as the _[National Law Review](https://www.natlawreview.com/article/maine-s-new-internet-privacy-law-what-you-need-to-know)_ explains, it “requir[es] broadband internet service providers (ISPs) to obtain a customer’s express, affirmative consent before using their personal information, including browsing history.” Meanwhile, enforcement of Nevada’s [Senate Bill 220](https://www.infolawgroup.com/blog/2019/6/4/nevada-enacts-new-online-privacy-law-requiring-opt-out-rights-for-data-sales) became effective on October 1, 2019, and that law may be more aggressive than the CCPA in its requirements for letting consumers opt out of data sales.

Many of these laws have different definitions for crucial concepts, such as what constitutes personally identifiable information and how it should be anonymized. This patchwork of legislation presents a minefield that any company would struggle to navigate. Many observers think Congress is highly likely to pass unifying federal data-privacy legislation in the near future, but until then, whichever state passes the strictest laws effectively forces every company to play by its rules.

## Get control of your data

Like it or not, laws like GDPR and CCPA represent a huge paradigm shift in data privacy, and meeting their demands requires an immediate response. Of course, changing how your company handles data is a challenge for any team, and especially for startups and SMBs that are also trying to grow.

That’s why a [Wall Street Journal survey](https://www.wsj.com/articles/businesses-across-the-board-scramble-to-comply-with-california-data-privacy-law-11567947602) found that, even when faced with serious fines and a loss of public trust, only 52% of companies expect to be CCPA-compliant by the January 2020 deadline.

The unpleasant truth is that most companies don’t even have the ability to assess their current data privacy picture. User data is frequently siloed across applications, and companies frequently lack clear protocols for managing permissions.

You can’t tackle your data security until you have a holistic, high-level view of how it’s being accessed, and by whom, so getting this bird’s-eye view is the first step in getting compliant.

![The Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/01LwCh4Yy7Tk0LdhNxgxG8/7d2a6efdfb8b4c12093076b1e00b5140/auth0-dashboard)

The [Auth0 dashboard](https://auth0.com/docs/dashboard) lets you manage all of your users, employees, and third parties, quickly enabling or revoking permissions as needed. This kind of intuitive, de-siloed interface will be critical in order for companies to comply with the legal mandate (shared by the CCPA and the GDPR) that users be able to access, delete, or change their data in a timely fashion.

Once you have an organized look at your users, the best way to minimize your company’s exposure to fines and scandal is to minimize your data’s exposure to breaches. Implementing [multi-factor authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/) can give your company a huge boost in security, not just from cybercriminals using stolen user credentials but also from stolen admin or third-party contractor credentials, which can lead to massive data breaches.

As you restructure your company’s data privacy policy, keep in mind that it’s not enough to meet the legal requirements. Your company must also integrate well with other businesses, which are changing their attitudes and expectations around data privacy.

For example, Apple recently announced that any app on its platforms that allows for third-party sign-in options must also include [Sign In with Apple](https://auth0.com/blog/auth0-adds-sign-in-with-apple-as-ootb-integration/). This is considered a privacy-friendly option since Apple doesn’t share information on nearly the same scale as Facebook or many other social login providers.

[Auth0](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/) is already integrating it into [Universal Login](https://auth0.com/docs/universal-login) as an out-of-the-box option. This integration is a must for any company that wants access to the App Store, and with Auth0, you can do it by flipping a [single toggle](https://auth0.com/blog/try-sign-in-with-apple-in-your-auth0-apps-today/).

![Auth0 Social Connections](https://images.ctfassets.net/23aumh6u8s0i/3rMC0k1THr4rYHnQ22y2zx/891a90db2e67aed1b0e233a26713139b/social-connections)

## Shift your philosophy, not just your policy

These laws, and the public outcry that brought them into being, require that companies make data privacy a foundational principle woven into their entire operations. The legislators behind CCPA and GDPR have indicated that they will consider whether companies have acted “[in good faith](https://auth0.com/blog/data-privacy-2019-the-lowdown/)” when issuing fines. Proving good faith starts with aligning your company’s philosophy to the legal demands, and there are some actionable methods to put that into practice.

Changing your company culture around data privacy and security starts with getting internal alignment. [Develop employee training](https://www.vyond.com/resources/how-to-create-cybersecurity-training-videos-for-employees/) that educates your team on how to avoid social engineering attacks, such as phishing, and on the importance of following protocol in protecting data flow.

Embrace [transparency](https://auth0.com/blog/cybersecurity-shouldnt-be-a-secret/) in your cybersecurity and data collection policies to avoid appearing underhanded. Failing to explain how and why you’re collecting data leaves you vulnerable to scandal. Email startup [Superhuman](https://www.dailydot.com/debug/superhuman-email-privacy-scandal-explained/) became the most recent example of this phenomenon. Users learned the company collected location data via tracking pixels, and, despite a public apology, the damage to Superhuman’s credibility has been done. The backlash from this type of scandal can hurt even established companies, but the reputational damage is particularly devastating to startups and SMBs.

It’s hard to shift gears around data privacy overnight, and it’s even harder if you try to do it all yourself. For many startups and SMBs, off-loading identity management onto an IdaaS company like Auth0 is the most cost-effective way to shift your approach. If you’re rapidly scaling, and your team doesn’t have the bandwidth or expertise to address all of these issues, you can reap the benefits of Auth0’s accreditations and integrations without having to worry about constantly updating and maintaining identity to keep pace with the next set of laws — leaving you free to focus on your business processes and the core business driving your need for an identity solution.

<include src="TweetQuote" quoteText="It’s hard to shift gears around #CCPA or #GDPR overnight, and it’s even harder if you try to do it all yourself. How offloading #identity can help."/>

## Compliance doesn’t have to stall growth

Even if your company is under the minimum size for CCPA fines, you should still design your identity solution with growth in mind. You don’t want to lose out on landing a major customer because they aren’t confident your policies are up to their standards.

Conversely, you don’t want to slow your company’s growth by making your developers code for the complex and ever-changing demands of data privacy. For the vast majority of startups, off-loading identity management to experts is the smartest choice to allow you to focus on delivering your product. To learn more about your legal obligations and how our platform can meet your company’s needs, reach out to an Auth0 representative.

<include src="TweetQuote" quoteText="Even if your company is currently under the minimum size for #CCPA fines, why you should still design your identity solution with growth in mind."/>

<include src="asides/AboutAuth0" />

---


Data Privacy 101

Calif. AG’s independent report released last weekend project a total initial compliance spend of $55 billion



Last weekend, the State of Calif. Attorney General released an [_independent report_](http://www.dof.ca.gov/Forecasting/Economics/Major_Regulations/Major_Regulations_Table/documents/CCPA_Regulations-SRIA-DOF.pdf) putting the estimated cost of [California Consumer Privacy Act (_CCPA_)](https://auth0.com/ccpa/) initial compliance for the world’s fifth-largest economy at [_$55 billion_](https://www.cnbc.com/2019/10/05/california-consumer-privacy-act-ccpa-could-cost-companies-55-billion.html). While much of the focus has been on larger companies like Google and Facebook, as Wired explained, the companies most likely to feel the sting aren’t operating at that scale. [_It’s the smaller companies that could take a larger percentage hit_](https://www.wired.com/story/why-californias-privacy-law-wont-hurt-facebook-or-google/)

![The smaller companies in California are most likely to feel the CCPA sting](https://images.ctfassets.net/23aumh6u8s0i/6nOzt9wsmyGnfsP6Z4DsdA/d71c4b8dc04f9b80daf6f5d05d25e72c/downtown-los-angeles-at-night)

## Which rights are granted?

[CCPA](https://auth0.com/ccpa/) builds on the state’s existing data privacy law, which has not kept up with the [evolving definition of Personal Information (PI)](https://auth0.com/resources/whitepapers/evolving-definition-of-personal-Information). The law affords consumers four key rights:

1. **Right to Know:** The right to be informed about how and why and when data is collected, what data or categories of data is collected, as well as the disclosure of use and sales of PI.
2. **Right to Delete:** The ability to request that businesses delete PI collected from the consumer and direct service providers to also delete (unless excepted).
3. **Right to Opt-Out:** Consumers can direct a business selling a consumer’s PI to stop. Minors from 13-16 may not have their PI sold without affirmative authorization. Under 13, that authorization must come from a parent or legal guardian.
4. **Right to Non-Discrimination:** No business may discriminate against a consumer for exercising any of these rights. They can’t deny goods or services, charge different prices or provide a different level or quality of service. But, a business can offer different rates or service if the value is reasonably related to the consumer’s data.

With 6 amendments waiting for a signature from the governor of the State of California by Oct. 13, 2019, the law is expected to go into effect on Jan. 1, 2020 with enforcement beginning on July 1, 2020. 

For those who remember the onset of EU’s data privacy regulation, GDPR (General Data Privacy Regulation), this may sound similarly stressful, but if you’re already GDPR compliant, you are part way there. Still, this is an untested law with some admittedly fuzzy language. How strictly it will be enforced remains to be seen. Based on the AG’s recent report, here’s what companies can expect in terms of cost.



## 4 categories of cost

The AG’s report outlines four main costs. As we saw with CCPA, thinking through the full impact of the law will require legal costs [_if you fall within the requirements_](https://auth0.com/explore/data-privacy/) and could include rethinking your business model.

1. **Legal costs:** You’ll need an attorney to evaluate your technical and business plans. No matter what you read online, your best source is the legal consultant you pay to interpret the law regarding your specific situation. 
2. **Operational:** You’ll need to establish some non-technical infrastructure and procedures for handling compliance.
3. **Technical:** Establishing the technologies to handle requests from large numbers of consumers and for things like establishing an [opt-out button on your home page](https://www.jdsupra.com/legalnews/the-ccpa-has-placed-a-mandatory-link-on-61019/) if you sell PI.
4. **Business:** The law may impact your business model or require renegotiations with service providers.

## Back of the napkin costs

So total compliance cost is going to vary. How much? The AG’s report expects that 75% of all California businesses will be expected to comply, with the total cost of efforts coming in at approximately $55 billion collectively, which is 1.8% of California’s 2018 Gross State Product.


![Back of the napkin costs](https://images.ctfassets.net/23aumh6u8s0i/6GpHGCRbM7AJlMje9mVpBZ/ed454437152884777d738933ca72947c/back-of-the-napking-costs)

*Source: *[*_Standardized Regulatory Impact Assessment: California Consumer Privacy Act of 2018 Regulations_*](http://www.dof.ca.gov/Forecasting/Economics/Major_Regulations/Major_Regulations_Table/documents/CCPA_Regulations-SRIA-DOF.pdf)* *


Also important is that 83% of California’s businesses will be able to leverage their GDPR compliance. The laws aren’t perfectly aligned, which is why we are seeing [_CEOs like Apple’s Tim Cook and Satya Nadella call for a global data privacy law_](https://www.businessinsider.com/satya-nadella-on-gdpr-2019-1).

<include src="TweetQuote" quoteText="Back of the napkin estimates of how much your company might need to spend to become #CCPA compliant."/>


## Future-proofing

Compliance isn’t a one-and-done activity. It requires regular maintenance and monitoring, which will vary according to business model and company size. While the rapidly evolving data privacy landscape can seem daunting. Having gone through GDPR compliance, many Auth0 customers tell us that identity can be a good place to begin to [_properly clarify what data they need to retain to give their customer’s the experiences they expect_](https://auth0.com/explore/data-privacy/). If you’d like to learn more about how Auth0 can help you move towards CCPA identity compliance, reach out to [_an Auth0 expert_](mailto:%20sales@auth0.com).

![View of Bay Bridge and San Francisco from Treasure Island California](https://images.ctfassets.net/23aumh6u8s0i/1GtfAs85Q7o2WxEOXnhIhW/5177191cb38ed3a34a2530e67841e2c7/view-bay-bridge-san-francisco-from-treasure-island-california)

<include src="TweetQuote" quoteText="The State of Calif. AG estimates initial CCPA compliance costs at $55B. Find out what your company can expect to spend."/>

<include src="asides/AboutAuth0" />


How Much Will CCPA Cost Your Company?

GDPR and CCPA provide real motivation, but with rapid legislative shifts, it’s time to put your data house in order.


If you think General Data Privacy Regulation ([GDPR](https://auth0.com/gdpr/)) fines are only for big companies like Facebook, you're wrong.

Yes, their fines make big news. [Another €1M fine](https://techcrunch.com/2019/07/24/facebook-settles-with-ftc-5-billion-and-new-privacy-guarantees/) from Italy for Cambridge Analytica on top of [€10M](https://www.theguardian.com/technology/2018/dec/07/italian-regulator-fines-facebook-89m-for-misleading-users) for misleading sign-in practices and [€3M for What'sApp data](https://techcrunch.com/2016/08/25/whatsapp-to-share-user-data-with-facebook-for-ad-targeting-heres-how-to-opt-out/) plus a whole suite of investigations underway in Ireland makes for a lot of ink. Plus Facebook is a living test case for what is (and isn't) possible. (To say nothing of the [$5 billion in fines levied by the U.S.](https://www.wsj.com/articles/ftcs-5-billion-fine-alone-wont-get-facebook-out-of-crosshairs-11563043006)!)

The quieter fines don't see quite as much press, but that doesn't mean that they're not happening. Just ask the [Spanish soccer league La Liga](https://iapp.org/news/a/spanish-dpa-fines-la-liga-250k-euros-for-alleged-gdpr-violations/) or [Portuguese hospital Centro Hospitalar Barreiro Montijo](https://iapp.org/news/a/first-gdpr-fine-in-portugal-issued-against-hospital-for-three-violations/).

![Illustration of data privacy separator 01](https://images.ctfassets.net/23aumh6u8s0i/4XkWjoyQ9J2SUHkUo63OzT/f3fc030e823110e367abe0179057b4b0/data-privacy-illustration-separator-01)

## Motivation Intended (And Storing in Plain Text = Bad)

Data privacy fines also get a lot of ink and eyeballs because deterrents are viewed as great motivators, but a deeper look at Knuddels.de reveals that deterrents aren't the entire rationale behind the GDPR.

[The first GDPR fine from Germany](https://iapp.org/news/a/germanys-first-fine-under-the-gdpr-offers-enforcement-insights/) followed a hack of the chat app [Knuddels.de](https://www.knuddels.de/). In September of 2018, 808,000 email addresses and passwords were compromised, with 330,000 unique users exposed. The company reported within the 72-hour requirement, but after the Landesbeauftragter für den Datenschutz (LfDl) investigation revealed that the passwords had been stored in plain text, they received a relatively low €20,000 fine.

It's helpful to consider that GDPR didn't just pop up out of nowhere. It evolved from existing data privacy laws and the intent to alter company behavior.

The GDPR report cited Knuddels.de's "exemplary cooperation" and, as LfDl Head Stefan Brink told the International Association of Privacy Professionals ([IAPP](https://iapp.org/news/a/germanys-first-fine-under-the-gdpr-offers-enforcement-insights/)), "As a DPA it is not important for the LfDI to compete for the highest possible fines. What counts in the end is the improvement of data protection and data security for the users concerned."

SIDE NOTE: If you're currently storing your passwords in plain text and feeling somewhat relieved because [Facebook](https://www.wired.com/story/facebook-passwords-plaintext-change-yours/) and [Twitter](https://www.zdnet.com/article/twitter-says-bug-exposed-passwords-in-plaintext/) have also done so, please stop. Not everyone is as forgiving as the LfDl and they might become less forgiving over time. We can also help you with [more secure storage](https://auth0.com/docs/connections/database) --- and it will be relatively painless. The key takeaways from above are that cooperation matters and the end goal isn't torturing tech companies --- the end goal is the improvement of data protection and security.

![Illustration of data privacy separator 03](https://images.ctfassets.net/23aumh6u8s0i/2IcNXJTVFVawhlPPlYTTzh/74524d2abaec83a0e56adbc3fe92b040/data-privacy-illustration-separator-03)

## U.S Patchwork - New York Indicator

The recently failed [New York Privacy Act](https://www.govtech.com/policy/NYs-Data-Privacy-Bill-Failed-Is-There-Hope-Next-Session.html) would have required businesses to act as "data fiduciaries," meaning that companies would be required to put the interest of their people whose data they protect ahead of their own financial interests, much the way that doctors or lawyers are required to protect data (more on that in this [Atlantic](https://www.theatlantic.com/technology/archive/2016/10/information-fiduciary/502346/) article.)

The bill would also allow "private right of action," which means private parties could bring lawsuits and it would apply to companies of any size. It also would have applied to businesses of any size.

Although a comprehensive New York Privacy Act looks unlikely, don't be lulled by the fact that this act recently failed. Parts of it could come back to life in the next session &mdash; and it's not the only U.S. state addressing data privacy.

[Nevada recently updated their law to include opt-out rights for data sales](https://www.infolawgroup.com/blog/2019/6/4/nevada-enacts-new-online-privacy-law-requiring-opt-out-rights-for-data-sales)--- and it goes into effect October 2019. [Maine also passed a law reportedly tougher than CCPA](https://thehill.com/policy/technology/447824-maine-shakes-up-debate-with-tough-internet-privacy-law), which will require users to opt-in before companies can sell data. It goes into effect on Jan. 1, 2020, and [more are on the books](https://iapp.org/news/a/us-state-comprehensive-privacy-law-comparison/).

![Illustration of data privacy separator 02](https://images.ctfassets.net/23aumh6u8s0i/6qHnwuxvn5oC7kf9p7rIDj/f1bc4b28698f0c853632d08b1bd6f674/data-privacy-illustration-separator-02)

##  Get Ahead of the Patchwork of Legislation

Many are already complaining about the disruptive impact of the patchwork of U.S. state data privacy laws. The U.S. Congress is working on putting something together before [CCPA](https://auth0.com/ccpa/) goes into effect.

And if that's not enough to convince you to put your data house in order, [India](https://economictimes.indiatimes.com/news/economy/policy/data-protection-aadhaar-bills-listed-for-budget-session/articleshow/69920880.cms), [China](https://iapp.org/news/a/more-positive-progress-on-chinese-data-protection-regime-in-2019/), and the [UAE](https://www.techradar.com/news/uae-data-protection-law-similar-to-gdpr-likely-landing-this-year) have data privacy regulation in motion.

By this time next year it's unlikely that anyone will forgive you for storing passwords in plain text.

Identity can be a great way to start getting your data house in order. You can [learn more here](https://auth0.com/blog/breaking-down-master-data-management/) about why our customers often begin with authentication or reach out to an [Auth0 resource](mailto: sales@auth0.com) for info on how we can help with your specific needs.

<include src="asides/AboutAuth0" />


Yes, Data Privacy Applies to You

Use public support to your advantage. Roll out privacy features that build your brand's integrity.


In the wake of the EU-centric [_General Data Protection Regulation (GDPR)_](https://auth0.com/blog/get-ready-for-gdpr/), several other nations, as well as states in the U.S., followed suit with similar privacy regulations. One of the landmark follow-on initiatives, the [_California Consumer Privacy Act (CCPA_)](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375), was approved in June 2018. CCPA will take effect on January 1, 2020.

The Act [builds on existing California law](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=BPC&division=8.&title=&part=&chapter=22.&article), which requires businesses to disclose basic information on data collection practices and data breaches.

In January 2020, California residents, who share their state with many of the world’s tech giants, may ask companies handling their data to disclose what personal information has been collected, and how and why they’ve collected it. Residents will also be able to “opt out of” having their data shared with or sold to third parties.

If companies do not or cannot comply — residents have the right to sue. Many companies are already feeling the pressure.

According to Robert L. Wallan, a partner with Los Angeles-based firm Pillsbury Winthrop Shaw Pittman LLP, [as cited in *Insurance Journal*](https://www.insurancejournal.com/news/west/2019/07/01/530904.htm):

> “You’re going to see some class-action litigation, my prediction is, pretty early.”

Despite the threat of hefty fines ([$7,500 per violated record](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375)) — as well as reputational damages — for noncompliance, many teams are still not prepared. If you’re a chief security officer (CSO) or team lead responsible for safeguarding the data of your users, this article provides an update on major points in the current version of the CCPA — and ways to quickly meet these requirements.

In doing so, you could set yourself apart from [86%](https://fortune.com/2019/03/19/companies-california-privacy-law/) of organizations who are not yet compliant (according to a TrustArc survey reported on in *Fortune*), build greater credibility with your users, and set yourself up for more sustainable growth.

## CCPA: Major Points (the Good and the Bad) to Know

As of the [_July 1, 2020 enforcement date_](https://www.huntonprivacyblog.com/2018/09/01/ccpa-amended-enforcement-delayed-substantive-changes-made/), the Attorney General will support California residents who request the following from companies that collect and use their personal information (PI):

* the particular pieces of personal information they collect,
* the categories of sources that provided their data,
* the categories of third parties with whom they share the data, and
* their commercial reasons for collecting or selling the data.

The CCPA broadly [defines PI](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375) as information about a California resident that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” This covers standard items, such as:

* SSN
* driver’s license and passport numbers, purchasing histories,
* internet activities,
* geolocation data, and
* professional or employment-related information.

It also includes “inferences drawn about a California resident” — personal details such as interests, aptitudes, or predispositions that a company uses to [create a customer profile](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/). For a full list of PI as defined by the CCPA, see [here](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375).

Under the CCPA, residents may also request that companies delete any personal information (subject to certain exceptions). As mentioned above, they may also opt out having their data sold.

While the Act isn’t set to be enforced until July 1, 2020, it covers personal data twelve months prior to the January 1, 2020 effective date. This means that the CCPA *already* applies to companies’ data collection, storage, and usage practices today—and throughout 2019. If you don’t have a process in place to handle these specific requests, it’s time to create one.

There are more important criteria to note. If an individual does not want their information sold, the CCPA gives them the right to maintain a consistent level of service and steady costs (i.e., not be discriminated against for not consenting). Under the Act, companies are required to clearly display a link that says "do not sell my data" at the bottom of any page that collects personal information. The CCPA also increases fines and penalties for companies that do not take reasonable measures to secure consumer data—again, a civil penalty of up to $7,500 for each violation.

The Act exclusively applies to businesses that:

* have annual gross revenues greater than $25,000,000;
* buy, sell, or otherwise use personal information of 50,000 consumers, households, or devices each year; or
* derive 50% of their annual revenue by selling personal information.

Since being approved in June 2018, the CCPA has already [_been amended_](https://www.dataprivacymonitor.com/ccpa/california-amends-landmark-privacy-law-delaying-enforcement-and-making-revisions/) — and it’s likely to be revised further. Numerous bills could make the CCPA even more stringent. If the CCPA applies to your company, it’s critical that you’re up to speed to avoid penalties. At the same time, this might feel like an overwhelming task when the regulations continue to grow more numerous and complex.

### The Bad News

The practice of collecting consumer data has expanded without regulation for years. Many companies rapidly and successfully built themselves on this information, which underpins their marketing, product development, industry research, and corporate strategy. Now, they must make major operational changes, including the following:

* Tighten and clearly communicate the process whereby customers can request access to their data, have it erased, or transfer it to another data controller.
* Create new systems with better [user management](https://auth0.com/user-management) and/or potentially hire more IT staff.
* Consider outsourcing core services to an [expert managed services provider](https://auth0.com/blog/managed-service-providers-myths/) if the company can’t cover expanded data-privacy needs in-house
* Work with pared-down data sets in the event that consumers withdraw their information.

Figuring out what to do to bring your company into compliance has never been more important — but you don’t have to work through it alone.

### The Good News

Since California is a hotbed of startups, many young and medium-sized teams are flexible by nature. In contrast to industries like insurance, where many teams have processes set in stone over decades, most tech companies and [tech unicorns](https://auth0.com/blog/so-you-want-to-be-a-unicorn/) are more nimble and willing to adapt to changing circumstances. Already, most of these have sent out updated privacy-policy emails to their customers:

![Everlane changes its privacy policy making it easier to understand](https://images.ctfassets.net/23aumh6u8s0i/1E4wAnIObdgK5o5DS08bUP/063ec75b42428fec586862450e9da822/everlane-changes-privacy-policy-making-it-easier-to-understand)

![Houzz updates its policies to make them more transparent](https://images.ctfassets.net/23aumh6u8s0i/iH4yYW88yxsjFttg4ldXO/bdc27ad70562353ce495b040e03698cd/houzz-updates-policies-to-make-them-more-transparent)

In anticipation of CCPA enforcement — as well as the implementation of data privacy policies across [107 nations](https://unctad.org/en/Pages/DTL/STI_and_ICTs/ICT4D-Legislation/eCom-Data-Protection-Laws.aspx) and [nearly 15 other U.S. states](https://www.dataprivacymonitor.com/ccpa/the-california-consumer-privacy-act-frequently-asked-questions/) — other industries are quickly following suit. In addition to email, some best practices are arising across sectors on the back end, including [_identity and access tools_](https://auth0.com/b2e-identity-management-for-employees), specialized managed service providers, [more efficient deletion of user data](https://segment.com/blog/preparing-for-the-ccpa-and-the-future-of-privacy-regulation/), and enhanced anomaly protections for suspicious user behavior.

## Anomaly Detection

[Many companies are taking advantage of](https://twitter.com/intent/tweet?text=%22Auth0+has+anomaly+detection+to+protect+consumer+information.%22%20via%20@auth0%20http://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/) [anomaly-detection tools](https://auth0.com/docs/anomaly-detection) to ensure that the users accessing consumer information are (1) who they say they are and (2) behaving appropriately. With large organizations giving access to a wide swath of users both internally (IT staff, marketers, managers) and externally (third-party contractors or consultants), it can be difficult to figure out who is logging in when and from where, and who is using what device(s). Implementing identity access and management tools that incorporate anomaly detection can be essential for avoiding fraudulent practices.

![Auth0 has anomaly detection to protect consumer information](https://images.ctfassets.net/23aumh6u8s0i/4bGZ8v04Sr8DuJR9hXNeYg/583bb6a4ad7a7f7c7e4b02e8a7df8c69/auth0-has-anomaly-detection-to-protect-consumer-information)

With Auth0, anomaly detection is customizable. Once enabled, you can set rules that alert administrators to any suspicious activity and block login attempts by specific users if, say, they are working with data they do not have authorization to use or they fail to enter the system with the correct password.

<include src="TweetQuote" quoteText="Auth0 has anomaly detection to protect consumer information."/>

Teams have been testing and finding early success with these and other new features, like [user dashboard views](https://auth0.com/docs/getting-started/dashboard-overview). Even if you're not a hot tech startup, you still have the advantage of proximity to some of the most cutting-edge technologies and resources in the world.

## Seize the opportunity

The CCPA has strong momentum to become even more robust. As consumers continue to feel the damages from the massive Target and Equifax breaches, Cambridge Analytica’s [_data leaks_](https://auth0.com/blog/cambridge-analytica-and-facebook/), the recent [Marriott breach](https://auth0.com/blog/marriot-starwood-data-breach-5-steps-to-protect-your-data/) and [British Airways incident](https://www.nytimes.com/2019/07/08/business/british-airways-data-breach-fine.html) — they’re pushing their representatives for change. The original ballot initiative that gave rise to the CCPA had [>600,000 signatures](https://www.wired.com/story/california-unanimously-passes-historic-privacy-bill/) when it passed, nearly 2x the 366,000 minimum requirement. Private and public sector coalition backers included the Consumer Federation of California, DuckDuckGo, Consumer Reports, BLUR, DeleteMe, Catalina's List, the Center for Public Interest Law, the Parent Coalition for Student Privacy, and the Academy of Integrative Health & Medicine.

Instead of facing CCPA enforcement with anxiety or opposition, use this swelling public support for the measure to your advantage. Get ahead of the curve in rolling out privacy features to your users on the front end, improve your back-end policies with better identity and access management software to protect your customers, and build a reputable brand in difficult times.

<include src="asides/AboutAuth0" />


Brace Yourself for CCPA Aftershocks (2019 Update)

What Companies Can Expect from GDPR and Developing Data Privacy Regulations



If you want attention, you could do worse than getting big names like [Google](https://www.google.com/intl/en/about/?fg=1&utm_source=google-US&utm_medium=referral&utm_campaign=hp-header), [Amazon](https://www.aboutamazon.com/), [Apple](https://www.apple.com/music/), and [Netflix](https://www.netflix.com/) into headlines. 

We’ve seen France’s data authority, [CNIL](https://www.cnil.fr/), [level €50 million in fines at Google](https://www.bbc.com/news/technology-46944696) for violating the General Data Protection Regulation (GDPR) thanks to a Not Your Own Business ([NOYB](https://noyb.eu/)) and [La Quadrature du Net](https://www.laquadrature.net/en/) filing. NOYB, the nonprofit European center for digital rights, [filed a fresh suit against eight major tech players](https://www.darkreading.com/privacy/gdpr-suit-filed-against-amazon-apple/d/d-id/1333690?_mc=NL_DR_EDT_DR_daily_20190119&cid=NL_DR_EDT_DR_daily_20190119&elq_mid=88915&elq_cid=25956827) (see chart below). [Max Shrems, NOYB Director, also sank the U.S. Safe Harbor law](https://www.theregister.co.uk/2015/10/06/safe_harbour_walls_come_tumbling_down/) and challenged Privacy Shield and still has [additional projects](https://noyb.eu/projects-2/) in play. While not every company is a Google or an Amazon, these fines establish precedence that can easily be applied to other organizations.

Every day plenty of scare tactics and odd products ([like GDPR shredders and recycling bins marked “confidential”](https://www.theregister.co.uk/2019/01/22/gdpr_compliant_shredder_book/)) likely land in your inbox under the guise of GDPR compliance. But now that we’re seeing major fines, we thought it was time to take a realistic look at data privacy impacts companies can expect as they move through 2019 and prep for 2020.

![Response to Access Requests](https://images.ctfassets.net/23aumh6u8s0i/7mbI7mXcQxmrqnK4yGsJwE/726184ad6408e3bb07103a4f2c644b58/access-requests)

<include src="TweetQuote" quoteText="A realistic look at data privacy impacts companies can expect as they move through 2019 and prep for 2020."/>

## What's Coming

_EDITOR’S NOTE: Each regulation/law has minimum sizes for impacted organizations. Please check each for specific details._

* **Brexit Possible ‘No Deal’ (March 29, 2019)**: The proposed withdrawal agreement would have protected data transfers between the UK and the EU through December 2020. If the UK leaves the EU without a deal in place — and this seems likely, see the next paragraph — this leaves international data flows in jeopardy, with an inadequacy ruling for the UK. 
<br/><br/>
[ComputerWeekly](https://www.computerweekly.com/news/252456093/Prepare-for-no-deal-Brexit-says-ICO) reports that the Jonathan Bamford, director of strategic policy at the Information Commissioner’s Office told a Westminster eForum event on GDPR in London that the UK government and the EU believe a “magic adequacy agreement” is unlikely. “So you need to think about what the situation will be if there isn’t an implementation period as the result of a withdrawal agreement — a no-deal Brexit — and you need to prepare for that.”
Organizations may find this [IAPP article on impacts of a ‘No Deal’](https://iapp.org/news/a/brexit-a-data-protection-action-plan/) useful.
<br/><br/>
**Impacts**: Companies transferring data from, to, or through the UK.

* [ePrivacy (late 2019 possible)](https://iapp.org/resources/article/eprivacy-regulation-october-2018-draft/): Data privacy is covered under GDPR, but also under upcoming ePrivacy regulations, expected to come into force sometime during 2019. The tech industry continues to express concerns that the regulation replaces the EU directive on telecommunications, but also includes digital communications, [is much too strict](https://www.nytimes.com/2018/05/27/technology/europe-eprivacy-regulation-battle.html). Cookies, consent, data collection should sound familiar to anyone having dealt with GDPR, however, ePrivacy reportedly places electronic communications under a stricter set of rules than other personal communication, [reports IAPP](https://iapp.org/news/a/consent-remains-major-eprivacy-sticking-point-for-eu-bodies/). Once a final draft is accepted, organizations doing business with the EU will need to revisit data privacy policies.
<br/><br/>
**Impacts**: Organizations doing business with the EU and/or EU citizens

* [California Consumer Privacy Act (CCPA)](https://www.caprivacy.org/) (six months after publication of the Calif. Attorney General's implementing regulations, or July 1, 2020, whichever comes first): “Nobody should assume that being GDPR compliant makes them CCPA compliant,” says Lydia de la Torre, CIPP/US in a [Privacy Tracker Post on CCPA and GDPR for IAPP](https://iapp.org/news/a/gdpr-matchup-california-consumer-privacy-act/). She also notes that the CCPA definition of personal data is broader than that of GDPR. “As the first U.S. attempt at a comprehensive data protection law, the CCPA has the potential to become as consequential as the GDPR. After all, California is the fifth largest economy in the world, the home of many technology titans, and traditionally a trend-setting state for data protection and privacy in the U.S.” The rapid adoption of the law, which was [passed after only a week of debate](https://www.jdsupra.com/legalnews/california-passes-landmark-consumer-87324/) indicates that legislators are looking to show action in the face of increasing [mega-breaches](https://auth0.com/blog/marriot-starwood-data-breach-5-steps-to-protect-your-data/). 
<br/><br/>
**Impacts**: Companies doing business with California citizens. Also, the law is frequently put forth as a potential model for a U.S. data privacy law.

* [Cross-Border Data Transfer Pact/Privacy Shield](https://www.bna.com/new-euus-data-n57982090596/): GDPR compliance has reportedly diminished the value of the EU-US Privacy Shield, which is a cross-border data transfer pact that allows the flow of data between participating EU countries and the U.S. [Threatened over the summer](https://techcrunch.com/2018/07/05/eu-parliament-calls-for-privacy-shield-to-be-pulled-until-us-complies/), the voluntary program got a recent boost with the news that [DocuSign’s former CEO Keith Krach](https://www.whitehouse.gov/presidential-actions/president-donald-j-trump-announces-intent-nominate-individual-key-administration-posts/) may come on as ombudsperson for the pact. Shrems (the guy who brought down Safe Harbor and runs NOYB), is also challenging [Privacy Shield](https://www.theregister.co.uk/2018/08/01/irish_supreme_court_makes_surprise_decision_to_hear_facebooks_appeal_in_schrems_ii/) for the way that personal data is transferred from the EU to the U.S. How the ruling plays out will have implications for the thousands of companies that rely on trans-Atlantic data transfers. Most recently, the Irish Supreme Court [agreed to hear Facebook’s appeal](https://www.theregister.co.uk/2018/08/01/irish_supreme_court_makes_surprise_decision_to_hear_facebooks_appeal_in_schrems_ii/) after acknowledging the complexity of the law. [At publication, the court had yet to rule](https://www.irishexaminer.com/breakingnews/business/facebook-appeal-wraps-up-in-the-supreme-court-ruling-to-happen-on-later-date-899564.html). 
<br/><br/>
**Impacts**: U.S. companies transferring data across the Atlantic.

* **EU Data Protection Supervisors Management Strategy (2019 Priorities)**: EU’s Data Protection Supervisor, [Giovanni Buttarelli](https://edps.europa.eu/about-edps/members-mission/supervisors/giovanni-buttarelli_en), listed several priorities for 2019 while responding to the news that the U.S. had put forth an ombudsperson for Privacy Shield, including “digital ethics, better cooperation with national Data Protection Authorities (DPAs), identifying Artificial Intelligence threats to society, and finding closer alignments between consumer law, data protection and competition rules,” reports [Euractiv](https://www.euractiv.com/section/data-protection/news/this-is-not-a-concession-says-eu-data-chief-on-privacy-shield-ombudsman/).
<br/><br/>
**Impacts**: Companies with EU customers and/or doing business in the EU + possibility that these new standards could influence data privacy in other regions.

* **Plus a reminder**: Canada - [Personal Information Protection and Electronic Documents Act (PIPEDA)](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/) (November 2018). This data law update includes [new consent guidelines](https://www.lexology.com/library/detail.aspx?g=354a398d-f2cd-4ccc-a68c-f91b23be2feb) that went into effect in November of 2018.

<include src="TweetQuote" quoteText="The shift from legal to technical data privacy compliance — and how you can mitigate increasing consequences."/>

## What is Acting in ‘Good Faith?’

GDPR and other data privacy fines aren’t leveled automatically with each violation. The bodies have leeway to weigh whether or not an organization was “acting in good faith.” Whether or not the deciding bodies have an understanding of all that goes into being compliant can be debated, but they do get that, for many organizations, compliance can be a massive undertaking.

As legislators move towards [increasing consequences for putting personal data at risk](https://auth0.com/blog/gdpr-effect/), what does “acting in good faith” look like? As we moved toward the deadline for GDPR in 2018, many companies handed GDPR to their legal teams to interpret the regulation in the absence of precedence, taking a “wait-and-see” approach by making the minimal necessary tech investments towards compliance. 

Meanwhile, 2018 saw [breaches from a host of big brands](http://fortune.com/2019/01/04/worst-data-breaches-of-2018/) and lots of talk about the need for additional data privacy laws. Comments from Forrester on the Marriott Mega-Breach lend insight into why the global public and legislators are losing patience: “As the case has been for nearly every other mega-breach in recent history, the methods that the attackers used to exploit this system weren’t magic or exceedingly advanced. Basic database security protocols, good authentication, minimization of lateral movement, and an understanding of how to apply technology strategically would have made a big difference.”

Paralleling the breach consequences of missing the basics are companies that are perceived to be taking advantage of their customers. CNIL’s €50 million GDPR fine against Google wasn’t for a minor violation. The finding cited Google’s violation of transparency, information, and consent. “The violations are continuous breaches of the Regulation as they are still observed to date. It is not a one-off, time-limited, infringement,” CNIL wrote in the [filing](https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc).

And older data laws can have current implications. Illinois’ [Biometric Information Privacy Act](http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57) (BIPA) says that individuals have the right to control their biometric information: fingerprints, iris scans, etc. A lawsuit started in 2014 found that [Six Flags Amusement Park cannot collect thumbprints without consent](https://newschannel20.com/news/local/illinois-supreme-court-rules-six-flags-cant-collect-thumbprint-data-without-consent), upholding what [Gizmodo](https://gizmodo.com/six-flags-biometric-case-could-turn-one-of-the-toughest-1830656685) called one of the most “rigorous” data laws in the United States.

A Federal data law for the United States is looking increasingly likely. U.S. Senator Marco Rubio (R-Fla.) recently introduced a [Federal bill](https://techbizweb.com/marco-rubio-proposes-new-federal-data-privacy-bill/) designed to provide national data privacy legislation. Backing legislative interest is [Apple CEO Tim Cook](https://www.prnewsonline.com/apple-tim-cook-communicators-us-gdpr)’s earlier proposal for a U.S. privacy law and Microsoft CEO Satya Nadella’s recent statement that privacy is a “human right” while calling for “global GDPR.” Meanwhile, U.S. Senators Elizabeth Warren (D-MA) and Mark Warner (D-VA) are seeking the power to penalize breached entities under [Data Breach Prevention and Compensation Act](https://www.recode.net/2018/1/10/16871928/equifax-elizabeth-warren-mark-warner-fine-bill).

## Evaluating Risk

In this current environment of consequences, moving from legal-focused compliance to addressing the legacy technical challenges involves assessing risk and deciding how to manage it.

In 2018, [Ponemon](https://newsroom.ibm.com/2018-07-10-IBM-Study-Hidden-Costs-of-Data-Breaches-Increase-Expenses-for-Businesses) reported that [data breaches](https://auth0.com/blog/what-is-a-data-breach/) averaged $3.86 million with mega-breaches (defined as greater than 1 million records) costing companies nearly $40 million. But that was before GDPR and its 72-hour reporting requirement. Calculating the potential cost of a breach has become more complex (Although recent news that [Twitter is being investigated regarding its Jan. 8, 2019 breach notification](https://www.jpost.com/Breaking-News/Irish-data-protection-body-says-it-is-investigating-Twitter-GDPR-breach-578686) may set precedence.

Now says Ian Thornton-Trump, head of cybersecurity, AMTrust International, speaking with [Bank Info Security](https://www.bankinfosecurity.com/interviews/life-under-gdpr-sizing-up-long-term-costs-i-4226), we’re seeing a body with broad authority level fines. The ICO can refer companies for potential criminal charges if they notice something during their full access to company records during an investigation. Shorthand? Breaches are likely to become more expensive.

And there’s some question over whether or not English law permits insurance companies to cover fines leveled under GDPR because in some instances, the breach/lack of compliance may prove to be “quasi-criminal,” says [The National Law Review](https://www.natlawreview.com/article/can-english-law-insurance-policies-cover-fines-imposed-under-gdpr).

## What You Can Do About It

Investigations from a variety of regulatory agencies and insurance companies and class-action lawsuits can mean that a company may see financial and brand impacts from five or six investigations, says Thornton-Trump, but it may take years to play out. Meanwhile, your company’s tech team will likely have moved through multiple tech lifecycles. 

Ransomware, breaches, compliance issues all add complexity to an already challenging process, but they also provide concrete reasons to justify preventative measures as well as cleanup costs. Merck, for example, says Thornton-Trump, [rebuilt their entire network](https://www.bankinfosecurity.com/interviews/life-under-gdpr-sizing-up-long-term-costs-i-4226) for $250 million after facing down WannaCry Ransomware. 

For ongoing regulatory action, proving “due diligence” is critical. “Being compliant is not good enough. Maintaining compliance is really the key,” Thornton-Trump told [Bank Info Security](https://www.bankinfosecurity.com/interviews/life-under-gdpr-sizing-up-long-term-costs-i-4226). And maintenance requires ongoing action.

If you’d like to learn how streamlining identity can help support your ongoing data privacy efforts, please reach out to [sales@auth0.com](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />

---


"data-privacy"