
A Note: this post was written by a guest writer, and does not necessarily represent my opinion. That said, I think it’s important to host a variety of thoughts and perspectives on the blog and thus, I give you the following article written by Frank Lynn, Proposal Manager at SuccessFactors. As always, please feel free to comment.
Imagine this nightmare – You leave your house in the morning juggling your keys, your coffee and your cell phone as you set off for work where you are the Director of HR at a growing, global organization. As you approach your car you notice your windshield is smashed to pieces and you realize instantly that your laptop is gone, along with a spreadsheet you created last week containing payroll information on your 1,500 employees.
Many companies understand the risk associated with sensitive customer data, but they don’t realize that an employee data breach could be just as serious. In today’s post-HIPAA, post-Sarbanes-Oxley environment, implementing controls to safeguard information such as financial statements and medical records is top of mind. CIOs and Risk Management professionals are under a lot of stress. All it takes is one lost or stolen laptop to put an entire organization at risk – and generate a barrage of negative publicity (e.g., the recent Dept. of Veteran Affairs mishap that exposed 26 million patient health records).
The European Union led the way in protecting employee data privacy with its 1995 directives regarding collection and use of employee data; which included giving employees rights to access and correct data concerning themselves. This means EU residents can check their personnel file for errors like you’d check your credit report. The EU also restricts transfers of personal data to countries that do not ensure “an adequate level of protection.” Many EU nations impose strict fines and penalties in the event of an employee data breach.
Canada has also followed suit with the Personal Information Protection and Electronic Documents Act (PIPEDA) that states companies in certain sectors such as banking and aviation must have a legitimate purpose for collecting, using and disclosing employees’ data records.
In response to foreign data privacy laws, the US Department of Commerce created the Safe Harbor Certification process. Safe Harbor Certification is comprised of an annual self-certification process where companies are required to abide by seven principles of data security. This takes navigating the legalese of foreign laws out of the equation, by adhering to a data privacy standard that is universally acceptable.
This issue is upon us and it is here to stay. Make sure your internal systems and processes are safe, your data is restricted appropriately and your application vendors can live up to the highest security standards.
For more information about data privacy laws, take a look at these sites:
http://www.export.gov/safeharbor/index.html
http://www.privcom.gc.ca/legislation/02_06_01_01_e.asp
Gautam reminds us of an old HR saying
Wanted to point you to an interview that