New Report Reveals Less Than Half of Businesses Are Prepared to Comply with the California Consumer Protection Act (CCPA)

Time to read
2 minutes
Read so far

New Report Reveals Less Than Half of Businesses Are Prepared to Comply with the California Consumer Protection Act (CCPA)

Results Indicate Compliance Measures are Lagging as Enforcement Begins January 2020

London, UK – 20th November 2019 – Egress, the leading provider of people-centric data security solutions, today announced the results of a comprehensive survey on the “Key Steps in Satisfying Your CCPA and Other Privacy Obligations”. The survey, conducted by Osterman Research, Inc., revealed the current state of security team preparedness and critical gaps in compliance with the California Consumer Protection Act (CCPA) before it comes into effect on 1st January 2020. Key findings include only 15% of organisations report having a mature approach to data privacy, more than half (59%) have yet to allocate budget to CCPA compliance, and 58% are currently using or will look to implement machine learning-driven systems to improve manual processes for data security.

In succession to the EU’s landmark GDPR legislation, the CCPA is set to revolutionise data privacy and security within the United States, with major penalties and litigation slated for those unable to protect residences’ new privacy rights. To gain better insight into the state of preparedness for compliance with CCPA, Osterman Research surveyed 149 security professionals about the state of organisational compliance, the successes and challenges associated with satisfying compliance, lessons learned from GDPR, and the level of buy-in security professionals believe they’ve received from the wider organisation.

“CCPA is a monumental piece of legislation in the United States that will drive forward data protection for consumers not just in California, but more broadly as it inspires other states into similar action,” said Tony Pepper, Chief Executive Officer at Egress. “The results from Osterman Research show clear gaps in compliance and preparation, including a robust email security strategy, efficient processes that can quickly respond to data subject access requests (DSARs), and measures to reduce the risk of email compromise or the accidental exposure of sensitive data.”

“Our research found that most organisations just aren’t yet ready for compliance with the CCPA, despite the fact that we conducted the survey less than three months before it becomes enforced,” said Michael Osterman, Principal Analyst at Osterman Research. “This is likely to present some serious consequences for non-compliant organisations given our view that the State of California will be reasonably aggressive in pursuing non-compliant organisations during 2020.”

Survey findings include:

  • Data protection is still not prioritised today, with only 15% of organisations reporting a mature approach to data privacy
  • More than half of organisations (58%) believe there is some overlap in compliance between GDPR and CCPA, but CCPA will require a fresh look at systems
  • Consent is a critical element of GDPR, CCPA, and other privacy regulation compliance, yet only about 50% of organisations have reviewed how they obtain consent from external parties, leaving them open to non-compliance problems
  • Most organisations are currently using technology to help with data classification, with 62% using rules-based systems for automatic classification
  • Within two years, organisations predict that manual processes will move to more technology-based classifications. AI-driven systems will increase from 23% today to 58% in two years, and manual systems will drop from 55% to 36%
  • Fewer than two-thirds (36%) of organisations have conducted an audit to determine where corporate data is located
  • Only about two-thirds (69%) of organisations currently have a data breach notification procedure, despite the fact that data breach notification requirements have been established in most states for many years
  • Confidence levels in the ability to comply with privacy regulations are low; only about one-third (35%) of organisations are confident they can delete all information on a data subject, which would leave them vulnerable to non-compliance

With findings also showing that many organisations are holding off on actions, improvements, or compliance until 2020 or later, and less than half (41%) have allocated budget for compliance, it’s more important than ever for organisations and security professionals to understand the risks and implications of non-compliance. Email security, in particular, is a major component of data privacy that organisations need to consider when preparing for CCPA.

Findings of the survey were also presented on November 7th through a webinar hosted by Egress’s Senior Product Manager, Fahim Afghan, and President of Osterman Research, Inc., Michael Osterman. In the webinar, Afghan and Osterman outlined the state of compliance, the main challenges of satisfying compliance, primary ways CCPA affects email security, and considerations for building a robust email security strategy.

For full survey results available in a white paper authored by Michael Osterman, President of Osterman Research, visit the Egress website here: https://pages.egress.com/Whitepaper-OstermanCCPA-11.2019_Download-uslp….