Photo: Shutterstock
For many years, outsourcing has provided an efficient, cost-effective way to perform many of a business’ data processing functions, including communications, internet hosting and website management, network and systems operations, software development and services, application development and maintenance, desktop management and field services, data management, customer support, and much more. Especially with increasing robotics and process automation expanding so quickly, the growth of outsourcing is likely to continue into the future.
Two Missing Pieces
Until recently, most outsourcing processes have paid little attention to two components. One is the privacy of individuals’ personal information. Except in certain sectors like health care, finances or education, and with various limits on techniques like background searches, telemarketing and so on, the U.S. attitude has mostly thought that contact information, purchase histories and preference, demographics, and much other personal data should be widely available—not exactly for “theft,” but perhaps for “creative monetizing,” especially through direct advertising.
Subcontractors or “sub-processors” have also been overlooked. Businesses have always focused on making sure the lead outsourcing provider delivers results, but have more rarely considered how it would do so. For example, details like which subcontractors would participate or what else they might do with the personal information entrusted to them isn't always thought about. Instead, outsourcing businesses have customarily relied on warranties and confidentiality agreements from the lead outsource provider, expecting to hold it entirely responsible for failures to accomplish the main purpose. This, in effect, often leaves sub-contractors or undisclosed sub-subcontractors free to make ancillary use of personal information so long as the main purpose of the outsourcing was achieved.
Now, however, global privacy laws are requiring businesses that outsource to track and control individuals’ personal information “all the way back,” and to keep a tight grip on each subcontractor and other link of the entire chain of the outsourcing process. The threatened penalties are ferocious, reaching up to 4 percent of a business’ entire global revenue.
New Regulatory Expectations
The new European General Data Protection Regulation (the GDPR), as well as similarly inspired legislative efforts in the United States including the California Consumer Privacy Act of 2018 (CCPA), have caused a ruckus, a reckoning and a reshaping of how risk is addressed in outsourcing. Now, regulatory expectations are newly and sharply focused and positively require—especially in outsourcing—that data privacy be made a high priority.
The sharpened focus on data privacy differs from the prevailing U.S. view of privacy because both the European Union and the state of California recognize privacy as a fundamental right. In those jurisdictions, therefore, concepts of “personal data” and “data processing” are far more expansive than what have traditionally been recognized in the U.S.
"Personal data" is broadly defined as any information relating to an “identified or identifiable” individual. "Processing" is similarly broadly defined as “any operation or set of operations,” whether manual or automated, including but not limited to “collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.” By contrast, in most of the U.S., the term "processing" generally relates only to technical actions, such as conversion from one format to another.
These strikingly different meanings for the same words reflect profound differences in basic concepts of privacy, and, in practice, are forcing privacy considerations to become a critical issue in practically every outsourcing transaction—even in those not entirely subject to the GDPR or CCPA, as companies find it cheaper and easier to apply the same procedures across the enterprise than to have different practices for European or Californian data.