Law Students

As a Privacy Lawyer I get asked all the time what kind of processes do we need to support our privacy policy? A policy without the appropriate processes in place won't do an online business much good. Sure, small businesses may not need (or can afford) the same kind of data security protection as Bank of America, but that does not mean they can simply ignore the issue.

The FTC Protecting Personal Information: A Guide for Business site is good place to start (watch the video and download the guide). This is the kind of information that will help small businesses implement the basics, and if implemented, will likely allow them to make a "good faith" compliance argument should the FTC come calling, or if a lawsuit is brought because of a data breach.

The FTC common sense five (5) step plan is as follows:

1. Take Stock: Essentially, perform an assessment/inventory of where personal info is stored in your organization.
2. Scale Down: Keep only what you need for business purposes or for government reporting purposes.
3. Lock It: Protect the information you keep. Be cognizant of physical security, electronic security, employee training, and the practices of your contractors and affiliates.
4. Pitch it: Properly dispose of what you no longer need. Make sure papers containing personal information are shredded, burned, or pulverized so they can?t be reconstructed by an identity thief.
5. Plan Ahead: Draft a plan to respond to security incidents. Designate a senior member of your team to create an action plan before a breach happens.