The main victims of any data breach are actually the people, the customers, whom their personal information has been stolen and oddly?they don?t get the deserved attention. Questions like what was the impact of the theft on me as a customer, what can I do about it?and whether I deserve some compensation are rarely dealt with publicly.
Customers face several key problems when their data was?stolen, questions such as:
- Was their data stolen at all? Even if there was a breach it is not clear whether my specific data has been stolen. Also, the multitude of places where my personal information resides?makes it impossible?to track whether and where my data has been stolen from.
- What pieces of information about me were stolen and by whom? I deserve to know who has done that more than anyone else. Mainly due to the next bullet.
- What are the risks I am facing now after the breach? In the case of a stolen password that is used in other services I can go manually and change it but when my social security number was stolen, what does?it mean for me?
- Whom can I contact in the breached company to answer?such questions?
- And most important was my data protected properly?
The main point here is the fact companies are not obligated either legally or socially to be transparent about how they protect their customers? data. The lack of transparency and standards as for how to protect data creates an automatic lack of liability and serious confusion for customers. In other areas such as preserving customer privacy and terms of service the protocol between a company and its customers is quite standardized and although not enforced by regulation still it has substance to it. Companies publish their terms of service (TOS) and privacy policy (PP) and both sides rely on these statements. The recent breaches of Slack and JPMorgan are great examples for the poor state of customer data protection – in one case they decided to implement two-factor authentication and I am not sure why didn?t they do it before and in the second case the two-factor authentication was missing in action. Again these are just two examples that present the norm across most of the companies in the world.
And what if each company adopted a customer data protection policy (CDPP), an open one, ?where such a document would specify clearly on the company website what kind of data it collects and stores and what security measures it applies to protect it. From a security point of view, such information can not really cause harm since attackers have better ways to learn about the internals of the network and from a customer relationship point of view, it is a must.
Such a CDPP statement can?include:
- The customer data elements collected and stored
- How it is protected against malicious employees
- How it is protected from third parties which may access to the data
- How it is protected when it is stored and when it is moving inside the wires
- How is the company expected to communicate with the customers when a breach happens – who is the contact person?
- To what extent the company is liable for stolen data
Such a document can increase dramatically the confidence level for us, the customers, prior to selecting to work with a specific company and can serve as a basis for innovation in tools that can aggregate and manage such information.