U.S. organizations need to re-evaluate data protection policies in anticipation of pending EU data protection legislation

David Gibson

With the European Commission poised to announce sweeping data protection legislation, it's imperative that U.S.-based organizations take a closer look at putting reliable, robust systems in place for protecting data. It would be wise for U.S. organizations to commit resources now to protecting data in anticipation of the new EU laws that will soon be unveiled, even if they are not doing business abroad.

We’re already seeing the UK regulator, the ICO, imposing its first major fines on public sector bodies, so it’s clear that regulators are recognizing the increasing value of digital assets, and the need to protect them. And with penalties of five percent of global turnover, the advice has to be to shape up, or face the consequences.

These changes to EU data protection legislation are designed to prevent harm to those whose information is housed by organizations and out of their direct control. It is likely we'll see the U.S. following suit in the near future.

With more than 23 million records containing personally identifiable information (PII) leaked in 2011 alone, it is more important than ever for organizations to have pro-active and repeatable processes in place for identifying and protecting critical data. There are already PII laws in the U.S., including California, Nevada and Massachusetts.

Even experienced security professionals may be surprised to learn that the U.S. Sarbanes-Oxley Act draws closely on the original 1985 UK Companies Act. European laws are traditionally broader and deeper, and influence U.S. legislation. In this way, even U.S. organizations not doing business abroad are affected by international laws so it is imperative that we pay attention now.

It is increasingly clear that the biggest risk surrounding data does not come from hackers directly compromising customer and employee files, but from employees and contractors with overly permissive access, lack of access auditing, lack of context and lack of automation for the volumes of unstructured data that slosh around company archives.

Research from IDC and other analyst firms show that more than three quarters of data in large enterprises is unstructured, is overly accessible, lacks access auditing and lacks automated analysis of authorizations and use.

Auditing this data can be difficult for IT security staff concerned, but that doesn’t mean it is impossible. It just means that organizations have to invest in the necessary data protection and analytical technologies capable of auditing -- down to the last file -- who does what, when and where with the data.

David Gibson is director of strategy for Varonis. He can be reached at:

dgibson@varonis.com