One year on and GDPR is, variously, the gold standard for data privacy legislation, a monstrous example of bureaucratic red tape, or a busted flush leading to greater big tech dominance, few meaningful fines, some basic checkbox ticking and a blizzard of irritating pop-up statements.
What does the GDPR mean for business leaders, communicators, risk managers, lawyers and others preparing for tougher data privacy laws across Asia and responding to data breaches in the EU?
Here are some important principles to bear in mind:
Take swift, decisive
action to address the problem
Companies have no option other than to move fast under GDPR. There are only 72 hours to establish what has happened, assess the likely damage, notify the regulator(s) and communicate with those impacted can seem like precious little time, especially when the facts remain unclear.
Notification and communication can appear especially daunting when the hole remains open and the facts are unclear. Yet, the quicker a company moves to fix the hole and the more decisively it does it, the more likely it will be able to limit the actual and potential damage and rebuild confidence.
Err on the side of caution, but do not panic
It is easy to feel like you are being press-ganged into publicly disclosing a data breach. In fact, not all breaches need to be reported to the regulator, and some don’t need to be reported within 72 hours.
Some breaches do not pose a high risk to those impacted, while others may be considered temporary. In some cases, the data involved is unintelligible and/or already in the public domain, in others, the effort involved in notifying the regulator may be considered disproportionate to the actual or likely damage.
In such instances, a company may choose to inform the customer of an incident without notifying the regulator or making a public statement—provided it is confident it is on a safe footing legally.
However, generally, it is best to err on the side of caution and report a breach to the regulator. If one is unclear, information regulators will generally advise whether it needs to be reported. They may also provide guidance on whether it should be communicated with those impacted.
That said, there may be some instances in which
you feel it is more important to communicate immediately with those impacted,
before notifying the regulator. For example, where the data involved is
extremely sensitive, or where a supplier processing data for a business
customer is breached.
There are also good reasons to be wary of going
straight to the data subject. Customer and stakeholder expectations vary widely
on data privacy and, in the wake of an incident, their behaviours can conflict.
And news of a breach typically becomes public as soon as it has been
communicated with those impacted.
Whichever route you choose, it is usually best
to err on the side of caution. There’s no need to panic.
Be open and honest
EU information regulators have said they will take seriously anything that puts these twin principles into jeopardy and that they are willing to expand investigations beyond assessing IT/cybersecurity governance and controls to testing compliance in areas like technical competence and education and training.
The same goes for customers in Asia, who increasingly expect organisations to be honest about their shortcomings and to move quickly when something goes wrong.
Consider carefully how those impacted might be affected
Understandably, company leaders and executives fret primarily about the sensitivity and volume of data involved in a breach and what it means for the well-being of their employer. But it is just as important to pay close attention to those impacted and to the context in which the incident has occurred.
In August 2018, British Airways suffered a major breach involving the personal and financial details of over 500,000 customers. Despite no evidence of fraudulent financial activity at the time, British Airways quickly appreciated that the potential for lasting reputational damage was significant, given the large number of payment card and CVV numbers involved.
Hence the airline’s decision when it acknowledged the breach to offer compensation to customers for any financial hardship suffered—a promise that may result in significant payouts and higher insurance premiums going forward. The decision almost certainly also took into account the overwhelmingly negative reaction to the airline’s 2017 IT systems outage.
Consider carefully the needs and expectations of those impacted, the degree of external and internal scrutiny the incident attracts, your firm’s historic reputation, perceived culpability and other factors when you respond to a breach.
Don’t walk away
From a communications perspective, it is
tempting to treat a breach as a one-off negative event to be resolved with
a little timely public grovelling.
This is a mistake.
Nowadays, people take naturally to social media to vent their experiences and concerns, which can easily spiral into secondary news stories. Leaks are common, and breaches easily bleed into other business issues, thereby aggravating the situation and elongating the news cycle.
Worse, GDPR means regulatory investigations, fines and litigation are more likely, resulting in additional negative publicity. In the process, you may also come under greater pressure to publish internal and expert investigative reports.
It is important to understand that a breach is
often just the start of the reputational battle, and that you must stay – and be seen to stay – the distance
in all facets of your response if you are to have any real chance of
Align your response
The messiness and complexity of data breaches and the need for different business units to be involved in the response can result in sloppy, inadequate, or inconsistent communications.
Given the expanded legal obligations under GDPR, the likelihood of the emergence of equivalent regimes across Asia and heightened public awareness of data privacy rights, it is particularly important that companies’ legal and communications responses are properly aligned.
Legal and communications teams can sometimes be at loggerheads, so this is not necessarily as straightforward as it sounds. It need not be difficult. Unlike in a court of law, in the court of public opinion, a business is presumed guilty until it proves its innocence.
This doesn’t just mean one should be as open and honest as possible and that one’s rhetoric always meets reality. It means that a company must look at the wider picture, avoid inappropriate legal threats, actions, and lawyerly sounding statements, and apologize sincerely when it is at fault.
By following these principles, you will be less likely to botch your business and communications response to a data privacy incident.
More important, you will be in a much better position you to persuade your customers and others that you are acting in their best interests.
A series of vague and apparently contradictory statements have marked Cathay Pacific’s public response to its recent data breach – the world’s largest airline data privacy incident.
While the extent of the damage to the company and its reputation remains unclear, the breach has been described by Cathay’s Chairman as ‘one of the most serious’ the airline has faced, and that its response would be ‘different’ tomorrow.
What can be learned from the airline’s fumbled response?
First, the backstory: late one evening Cathay acknowledges a ‘data security event’ affecting 9.4 million customers that it claims to have acted to contain ‘immediately’. A torrent of negative coverage and plenty of speculation about the state of the firm’s IT security quickly ensues. Journalists and customers complain that Cathay is not responding to phone calls or emails.
The following morning Cathay admits that it had been aware of suspicious behaviour on its network for a three month period starting March, prompting an avalanche of questions from worried customers and bemused regulators and politicians about why it had taken so long to inform its customers. CEO Rupert Hogg takes to the media and video to defend his firm.
Three weeks later, Cathay submits a statement (pdf) to Hong Kong lawmakers confirming the attack had intensified over a three month period and that it had known in August that passenger data had been accessed and/or stolen. Cue a third wave of hostile coverage, this time questioning the company’s honesty and transparency. Lawmakers accuse the company of orchestrating a cover-up.
Making inaccurate or inconsistent statements during a data privacy incident is easily done when facts are thin on the ground and the media is breathing down one’s neck.
Top data breach communications pitfalls
Based on my experience, here are the top five communications mistakes organisations make when responding to a data breach – the first and most damaging of which is zero communication:
Concealing a breach. Until recently, most data breaches were not made public. GDPR and other data privacy laws now mean organisations must notify those impacted and the relevant authorities about a breach. Yet some will try to bury it from public view. As Uber and Yahoo! cantestify, a cover-up is seen as worse than the breach itself. Substantial fines may appear a good deterrent to concealment, but research shows the longer-term reputational damage can be more significant.
Confirming a breach too slowly. Cathay Pacific took three months to delay formal notification in order to contain the attacks and to determine what data had been lost and who has been affected. But organisations in many jurisdictions are now obliged to notify regulators quickly, and customers now expect to be informed quickly, and view organisations that are seen to move too slowly as unprofessional, clueless, or with something to hide.
Providing inaccurate facts or data. Cathay Pacific may have waited until it was sure of the facts and numbers, yet many organisations now quickly go public about a breach to meet their regulatory obligations, or under pressure from a third party, and then have to revise their statements as the facts become clear (eg. Dixons Carphone revising upwards the number of records involved in its 2017 data breach from 1.2 million to 10 million). This creates additional negative news cycles, and creates a perception of amateurism at best and willful obfuscation at worst.
Downplaying a breach. It is tempting to claim that the sensitivity and scope of the data and systems involved in a breach are limited, or that the impact on the company and those affected is minimal. But such statements can easily come undone as the full extent of the intrusion comes to light, leaving you looking irresponsible or worse.
Providing inadequate media support. Cathay chose to push out its bad news late in the evening and send its teams home. But little irritates journalists more than an unmanned communications team or unresponsive senior management, and senior executives unable or unwilling to provide a human face to something that has already been confirmed publicly by the company.
Every organisation is advised to avoid these pitfalls wherever possible.
Cathay’s CEO may have promised the airline would respond differently to future breaches, but he did not elaborate how.
Notifying regulators and customers more quickly is an obvious starting point.
Careful thought should also be given to the openness, transparency, tone, consistency and ownership of its’s statements, amongst other factors.
It is a trusim that every high-profile incident or crisis is accompanied by a tidal wave of rumour and misconception. This has always been the case, but nowadays the volume, intensity and power of false stories and fake news means every company has to work much harder to ensure what is being said about them is accurate and fair.
As Facebook can attest to the scathing reaction to some of its senior executives using social media to correct reports describing the harvesting of 50 million or so user profiles by SCL Group/Cambridge Analytica as a ‘data breach’, clamping down on rumour can feel as futile as chasing ghosts. It can also be as perilous.
Legally and technically, Andrew Bosworth (@boztank) and his colleagues were correct – this was not a data breach. The profiles had been misappropriated rather than stolen, and precision is required from a security, legal and communications perspective.
That said, the average Facebook user has little interest or understanding of the difference between a cyber attack, data breach, data loss or data leak. She wants to know what has happened to her data, and how its unintended use may affect her. Bosworth’s intervention made Facebook appear unnecessarily touchy, defensive and inward-looking.
Worse, it rebuttal served to highlight the real, underlying issue: Facebook’s apparently cavalier approach to collecting and profiting from its users’ personal information in ways most people have little understanding of.
Handling rumour and speculation is not about pouncing ruthlessly on every misconception or tall story – it is necessary to box clever, especially when the eyes of the world are on you.
Here are five basic but important things to remember when punching back against fake or partially fake stories during a crisis:
1. Pick your target carefully.
You could spend much of your time dealing with clearly inaccurate, wilfully misleading or entirely false news in a crisis. As we have seen, a misjudged intervention can easily prove counterproductive. My advice is to focus on those rumours that you know are untrue and which may cause real long-term damage to your company’s reputation due to the plausibility of their claims and the credibility of their advocates. And to ignore rumours that are clearly absurd, irrelevant or that matter little in the broader scheme of things and to which a response will likely come across as nitpicking or needlessly defensive.
2. Speak clearly and unambiguously.
If you do decide to respond to a rumour in a crisis, make sure your position is clearly expressed and in a language that everyone from the technical expert to the bemused member of the general public can understand. Little irritates and alienates people more than a put-down full of weasel wording, legalese and jargon. Or one that fails to tackle the issue in a straight-forward manner – as demonstrated by the hostile reaction to a series of Twitter-based rebuttals by Cambridge Analytica in the aftermath of Channel 4’s first investigatory video into its dealings with Facebook.
MYTH #5: CA uses fake news. REALITY: We do not. Fake news is a serious concern for all of us in the marketing industry. Malicious actors are using the same digital marketing tools that ad agencies use, and that's deeply worrying for everybody.
There will be times when you strongly believe your company is innocent or is being unfairly maligned in a crisis. In such instances, it is tempting to hit back as hard as possible. There are good reasons to resist this urge. Some people may not understand what is necessarily a complex situation or topic. Others will struggle to give you the benefit of the doubt based on their personal experiences and interactions over the years. And nobody appreciates being told what to think.
Even if a crisis is not your fault you must accept that others are entitled to their point of view and explain your case in a way they can relate to and understand. This requires paying close attention to the tone of your words and making sure you are not seen as arrogant, patronising or antagonistic at any time.
If success breeds envy and scrutiny, then so be it. There are countless firms that have used our tactics to get information on target customers. More in @Forbes: https://t.co/lb9re88E9j
4. Support your position clearly and in a human way.
Today’s distrustful business and political environment means words alone may be insufficient to quell a rumour. Rather, it is necessary to buttress your case with compelling evidence. Better still that respected third-parties are willing and able to support your argument in the mainstream media and online.
And the more human you can appear the better. Mark Zuckerberg may have been conspicuously absent from Facebook’s response to its current data privacy crisis over the past few days and while he has been accused of hiding behind his Facebook page he has used it successfully in the past to set the record straight by answering questions and generally giving the impression he is available and willing to talk.
5. Provide a visible call to action.
Whichever way you choose to rebut a rumour or misconception, it is important to provide people with an easy way to get further information. This might be an email address, telephone number or URL that directs people to a news article or dedicated crisis website or page containing your statements, plans, FAQs and other resources. Whatever it is, signpost it clearly on your homepage and media statements, and work it into your tweets and other interactions.
Combatting false rumours is a real challenge for business owners and communicators at any time, and is particularly tricky during a crisis. A hard head and thick skin are useful attributes, but even more necessary is the ability to read the public mood and react in an appropriate manner, even when presented with the most jaundiced and outlandish views.
These five basic considerations will ensure you are in a decent position to stop rumour and speculation escalating and start convincing people of your side of the argument.
We live in the age of the leaky corporation – one in which the wrong information can easily slip into the wrong hands – be it from external cyber attack or data breach, or from malicious or careless insiders, partners or suppliers.
Some organisations continue to think a good way to minimise the likelihood of data breaches, leaks and losses is to restrict employee access to the internet and/or social media. This may sound sensible, but at what cost to an organisation’s ability to conduct research, share information and communicate externally?
I recently met with the regional communications lead at a major global bank who turned out to be the only person in his company in Asia with access to Twitter. Little surprise that the individual felt highly restricted in what he could achieve online on behalf of his employer.
So it was good to hear business and cyber experts on the HBR podcast argue that cutting internet access is a simplistic, impractical and ineffective solution to the problem of leaky data.
Rather, companies should focus on adopting strong cybersecurity policies, monitoring use of their IT systems and email, and raising awareness about common, insidious threats such as phishing and malware.
Such an approach has the additional benefit of letting communicators get on with the job of managing their employer’s reputation whenever and wherever they need to.