It used to be—even just a few years ago—that consumer advocacy groups were complaining that legislation had not “caught up” with technology, and that huge data privacy gaps existed. But today, gaps in data privacy regulation are only half of the problem, as multiple legislative bodies have worked tirelessly to close the gaps. As financial services becomes an increasingly digital industry, finserv organizations now have to prepare for tomorrow’s regulatory landscape as well.

In particular, finserv organizations are finding that consumers of financial services themselves are sensitive to the collection and processing of their information. Fortunately, financial services ties healthcare as the most-trusted sector for data privacy, according to research from McKinsey & Company. Less fortunately, the percentage of respondents who trust data privacy practices in the financial services industry is still only 44%.

Financial institutions can keep pace with these simultaneous rises in digital banking activity and data privacy legislation by taking proactive measures:

• Commit to learning what’s protected under all relevant consumer data privacy laws.
• Consider how advances in digital banking and online payments will affect privacy concerns going forward.
• Give customers transparency regarding data collection, protection, sharing, and use.
• Implement data security and data privacy throughout the entire data lifecycle.
• Appoint chief privacy officers and give them the resources required to develop thorough privacy practices.

The nature of the financial services industry makes the stakes especially high, but a commitment to best practices instills confidence and competence.

What to Know About Data Privacy in Financial Services

Individuals divulge a great deal of personal information during online transactions. This is necessary because financial services organizations must have identity proofing to tie every transaction to a valid entity. Failure to collect, confirm, and store the appropriate data increases the likelihood of fraud. The need to collect, handle, and store data creates tension, as doing so means that financial institutions absorb responsibility for data privacy and data security.

The Current State of Financial Privacy Regulation

The uncertainty around data privacy for financial services is highlighted by the sheer volume of the applicable legislation. Instead of one universal law, financial institutions are accountable to numerous regulations, especially when they operate internationally. The following are several of the most common data privacy regulations impacting the financial services industry:

• Gramm-Leach-Bliley Act (GLBA)
• Payment Card Industry Data Security Standard (PCI DSS)
• Sarbanes-Oxley Act (SOX)
• California Consumer Protection Act (CCPA)
• Payment Services Directive (PSD2)
• General Data Protection Regulation (GDPR)
• Financial Privacy Rule from the Federal Trade Commission (FTC)
• Regulations from the Ney York State Department of Financial Services (NYDFS)
• Consumer Data Right (Australia)
• Monetary Authority of Singapore (MAS)

The list above is a lot to absorb, but it isn’t even exhaustive. Organizations like the NYDFS and FTC work continuously to regulate financial services and products as threats and best practices evolve.

When Financial Privacy Regulations Collide

At times, consumer privacy laws seem to contradict each other. For example, the CCPA gives individuals the right to delete (or request deletion of) some of their information, but there are exceptions. One such exception occurs when financial institutions need the information in question to operate. Reconciling consumer privacy regulations and finance-specific privacy regulations—especially when one regulation supersedes another—requires constant diligence and a comprehensive data protection strategy.

Evolving Data Privacy Responsibilities in the Finance Industry

Data protection strategies must be works in progress if they’re not to become outdated. The current state of data privacy for financial services organizations doesn’t stay current for very long. Legislative bodies are creating and modifying regulations, which is far from the only concern. Data breaches, technological adoption, and data privacy best practices are evolving every bit as quickly.

4 Steps Toward Data Privacy for Financial Services Organizations

Pressing data security challenges in the financial services industry include third-party risks, data transfers, and compliance issues. A comprehensive strategy allows financial institutions to prepare, implement, and maintain an integrated data privacy platform:

Prepare	Implement	Maintain
○ Sensitive Data Discovery and Classification ○ Appoint a chief privacy officer or work with a third-party organization to keep up with changing regulations	○ Static Data Masking ○ Dynamic Data Masking ○  Additional Privacy Enhancing Technologies	○ Database Activity Monitoring ○ Data Subject Access Rights Requests ○ Database Visualization ○ Database Firewall

1. Sensitive Data Discovery

By definition, a privacy plan can only be comprehensive when it covers all information throughout the enterprise or institution. Data discovery is a vital first step. Diligent data discovery brings hidden or forgotten information into the light.

Accurate data discovery and thoughtful data classification make privacy plans more intentional. The process answers some of the most pressing data protection questions:

• Which data is necessary, and which is best disposed of?
• Which individuals, applications, and third parties need access to data?
• How sensitive is the information retained?
• What do applications and analysts need to get from the data to operate as intended?

Answers to these questions provide the visibility required to protect data as efficiently as possible.

2. Data Protection

It’s often necessary to retain sensitive information. The financial institution absorbs responsibility for data privacy and security in these cases. Techniques like encryption, tokenization, and masking anonymize data in various states and environments. Dynamic data masking, for example, protects data in use without slowing down the analytics team. Static data masking is a common choice for data at rest, or whenever it’s best to permanently replace sensitive data without the potential for re-identification (also known as de-anonymization).

To close the loop, Privacy enhancing technologies (PETs) facilitate analysis of the privacy plan itself: with data sensitivity scorecards, incremental data scanning, and audit-ready reporting. Interconnected and interdependent networks of PETs allow financial services institutions to meet their various data privacy goals and expectations.

After selecting PETs or other data protection techniques to meet all privacy requirements, it’s time to bring everything into a manageable hub.

3. Integrating Data Security and Data Privacy

Beyond well-integrated, a data security platform must be scalable enough to protect all data sources, production, and non-production environments. Bringing data privacy into a central hub makes it more difficult for anything to fall through the cracks. Such a platform ties preparation, implementation, and maintenance together.

Increased visibility, manageable breach notifications, and adequate compliance reporting take the guesswork out of data privacy. Scalable solutions and excellent knowledge of the current state of an organization’s data privacy efforts make it easier to evolve. Adapting to changing regulations doesn’t have to mean starting over.

Finally, integrated data security and data privacy platforms keep the burden of database activity monitoring to a minimum. Data subject access rights requests, alerts, and notifications appear in one central location. From there, it’s easier to add database visualization tools to help spend less time identifying priorities and more time working on them.

4. Data Privacy and Consumer Consent

Collecting and using personal data is generally prohibited unless the subject consents or the data processing is expressly allowed by regulation. Even when a financial organization has every right to collect information, it may be required to provide privacy notices. Under the GLBA, for example, organizations are required to provide notice of how they collect and use information. An organization must provide notice to the data subject even when the data processing does not require the subject’s consent.

Data Privacy Technology for the Finance Industry

Regulatory technology, or RegTech, is working behind the scenes to help financial services firms regain customer trust. Financial institutions that navigate the customer trust landscape gain competitive advantages by protecting their reputations.

Societal factors like social distancing forced banks to accelerate digital transformation plans, and RegTech offers a much-needed boost. Consumer insights and regulatory compliance are twin differentiators. Legislative bodies and individual users are most satisfied when financial institutions go above and beyond minimum requirements and invest proactively in data protection solutions.

Getting Started With Data Privacy for Financial Services

The rising legislative and market-driven demand for data privacy separates financial institutions with stringent data protection plans. A demonstrable commitment to data privacy helps organizations win trust to increase their user base, and avoid fines to protect profits. Comprehensive programs address privacy, security, and data risks as interconnected and interdependent issues. To see how data security and data privacy for financial services combine, contact Mage for a demo.

BLOG LIBRARY >