95% of American companies not GDPR compliant

The European Union’s General Data Protection Regulation (GDPR) was established to ensure companies are accountable for the data they are handling, managing and storing. This includes keeping data well secured and protected, as well as ensuring the data is not used for reasons that customers are not aware of.

Since its inception in 2018, the GDPR has fined numerous companies that have not taken their data usage and protection seriously. The biggest GDPR fine recorded was a penalty to Amazon in July 2021. The big tech giant was fined a penalty of 746 million euros for not handling its customer data properly. In fact, the top three largest fines for mishandling customer data have been meted out to American companies, with Meta-owned WhatsApp and Alphabet’s Google in second and third place, respectively, after Amazon.

While the GDPR has been touted as the strictest data privacy regulation in the world, many companies are ensuring they oblige with it to not only avoid the hefty fines but also be able to operate in Europe. Globally, data privacy regulations set by other countries are now also echoing some of the regulations made by the GDPR.

In the US, data compliance is also a priority with bodies like the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) ensuring regulations are met. However, a recent report by CYTRIO has resulted in some concerns about the compliance of most companies in the US when it comes to regulations.

As of March 31, 2022, findings from CYTRIO’s data privacy research uncovered that 90% of companies are not fully compliant with CCPA and CPRA Data Subject Access Request (DSAR) requirements. Further, 95% of companies are using error-prone and time-consuming manual processes for GDPR DSAR requirements.

According to Vijay Basani, founder and CEO of CYTRIO, the research confirms that first-generation privacy rights management solutions have not gained wide adoption due to cost and deployment complexity, resulting in a high percentage of CCPA non-compliance.

“This problem will become more pronounced as CPRA enforcement takes effect in 2023 with the stringent 12-month lookback. Awareness of their data privacy rights by consumers coupled with the rise of data aggregators is driving an increased number of data requests. As the California Privacy Protection Agency (CPPA) begins active enforcement of CCPA and CPRA, non-compliance to DSAR requests will become cost-prohibitive for both medium- and large-sized companies,” added Basani.

The inaugural State of CCPA Compliance research studied 5,175 US companies with revenues ranging from US$25 million to more than US$5 billion. The findings showed that only 11% of companies were fully meeting CCPA requirements, while 89% of companies were either non-compliant or somewhat compliant. From January to March, CYTRIO researched an additional 1,570 companies for CCPA and GDPR DSAR compliance, bringing the total to 6,745 companies to date.

This most recent research shows only 10% of companies have deployed an automated CCPA DSAR management solution. Additionally, B2B and B2C companies of all sizes are equally and poorly prepared for CCPA compliance, and B2B and B2C companies are also woefully unprepared for GDPR compliance, despite the regulation going into effect in May 2018 with US$1.8 billion fines levied as of March 2022.

The top three most compliant verticals remained the same with business services, retail, and finance making up 54% of the companies researched. While California, New York, and Texas remained the top three most compliant states, the total number of companies from those states as a percentage of total companies decreased from 31% to 25%, indicating other states seem to be catching up.

Last month, the state of Utah passed the Utah Consumer Privacy Act, moving closer to becoming the fourth state to enact privacy legislation in the US behind California, Colorado, and Virginia. Currently, 22 states, including Alaska, Hawaii, Massachusetts, New York, Pennsylvania, Washington, Wisconsin, and New Jersey, have multiple consumer privacy legislation pending.

A key observation in this research was that DSARs coming from data aggregators are increasing in frequency and volume with the majority of requests being Right to Delete (Erasure). To be in compliance, companies must respond to these requests in a timely manner.