Best Practices in Global Data Privacy

May 26, 2021 by BBB National Programs Global Privacy Division

Privacy has become a very public matter. Business news sites, TV business networks, and the pages of major newspapers are full of stories on the topic of – and the controversies related to – data privacy. The issue of properly managing personal data is not only big in the U.S.; it is increasingly important around the world.

If you are striving to build a business with a global reach, you must take cross-border data privacy seriously. Today’s economy requires using systems that process data from around the world, even if you do not yet sell or operate outside the country where you are headquartered. And using data, especially personal data, in global commerce means you must comply with a growing labyrinth of privacy-related regulations. 

Forward-thinking business leaders, like those who are working with us at BBB National Programs, must commit to embracing established standards for privacy and data security. To do this right, you must have insight, documentation, and transparency. 

 

Insight

Every business relationship with personal data is unique, so creating an inventory of your collection and use of personal data is always the first step. Ask yourself, what types of personal information does our company or non-profit organization process? Once you have that list, you should ask a series of questions about each data type, such as: 

  • Is it sensitive information? 
  • Where does it come from?
  • At the time it’s collected, what kinds of permissions or limitations are set out about how it can be used? 

 

Documentation

With the answers to these questions in hand, and following straightforward data best practices, you can customize and document your processes and procedures for handling the personal data you collect. Crafting operational practices that fit your data inventory requires consideration of how all of your data insights translate into practical action steps for handling that data. 

 

Transparency

Strong privacy practices enhance business relationships with customers and other stakeholders. Enhancing relationships includes making sure that their expectations match reality when it comes to how personal data will be processed. With your policies and procedures in hand, it is a natural and straightforward step to craft informative notices of your privacy practices. 

 

Certifying Your Practices

These internal privacy practices only get you part of the way. Independent indicators are needed to verify that your practices are, in fact, in accordance with recognized standards.

Third-party privacy certifications do just that, while at the same time helping your privacy strategy remain interoperable with a variety of legal regimes. Similarly, independent dispute resolution for customers with privacy complaints provides a second layer of trust, while providing consumers with a responsive redress mechanism that sets your customer service apart. This type of mechanism is also mandated by international frameworks like APEC and Privacy Shield.

Your business reputation for privacy also depends on the practices of your vendors and partners. Once you know who touches your data and where that data is stored, it is up to you to conduct ongoing due diligence to make sure your partners treat it consistent with your standards, practices, and public statements.

Thankfully, you don’t have to reinvent the wheel or dedicate internal resources to vet your contractors. 

  1. Ask your vendors to secure trustworthy third-party certifications about their privacy and security practices. Look for services and mechanisms like Cross-Border Privacy Rules (CBPR) or Privacy Recognition for Processors (PRP).
  2. Next, use standardized contractual requirements to hold your business partners to the same standards and trusted best practices you expect of yourself. 

 

Find the Right Method of Accountability

Getting global privacy operations right means embracing a “Show and Tell” approach. Your voluntary commitment to independent mechanisms of accountability, such as certifications, assessments, or independent dispute resolution can provide that trusted verification. 

Even in an environment where global privacy regulations are actively shifting, maintaining a robust privacy program with independent indicators will go a long way toward minimizing the scrutiny of consumers and government agencies.

Our role at BBB National Programs as a third-party provider of privacy certifications, assessments, and independent dispute resolution is to help companies confidently demonstrate that their privacy practices are built upon the principles that form the building blocks for global privacy standards. 

We can help make privacy achievable and accountable for businesses of all sizes. Reach out to GlobalPrivacy@bbbnp.org to get started.

Suggested Articles

Blog

When Organizations Market To Children, They Should Do So Responsibly

Today's generation of digital natives might be more comfortable navigating gaming and content platforms, but they face the same cognitive limitations — and vulnerabilities — that children always have. The gap between a child’s needs online and the safeguards in place to protect them in digital spaces has grown to the point where big players like Google and Facebook are making more of an effort to address these gaps.
Read more
Blog

What Is Arbitration and What Should You Expect from It?

Arbitration is a form of dispute resolution and is an alternative to litigation (going to court). In some cases, a process called mediation will precede arbitration. In fact, more than 60% of claims that come through AUTO LINE are resolved in mediation. But, if a dispute cannot be resolved in mediation, the claim will proceed to arbitration.
Read more
Blog

The Potential Cost of Misleading Income Claims

The FTC recently put direct sellers, and other companies offering money-making opportunities, on notice: false promises about earnings potential and other aspects of a company’s business opportunity could subject the company to civil penalties. DSSRC published the Guidance on Earnings Claim for the Direct Selling Industry to reinforce fundamental tenets regarding the dissemination of earnings claims by direct selling companies and their independent salesforce members.
Read more
Blog

In-App and In-Game Ads: Tips to Staying Compliant in 2022

Today, children have increased access to technology as well as increased screen time, using apps and playing games, reading books, doing their homework, creatively expressing themselves, and socializing on their devices. As a result, business models have adapted, with apps reliant on ads and in-app purchases for revenue, rather than up-front purchase fees. These new business models require special design considerations outlined in CARU's revised Advertising Guidelines.
Read more