Strong data privacy protections enable corporations to establish boundaries and limit access to information that is protected under data privacy laws. Following the outbreak of the novel coronavirus (COVID-19) and its development into a global pandemic, companies and governments have adopted exceptional measures to safeguard employees, customers, and the public. Some of these measures include the use of technology to enable remote workplaces, and to collect, process, and share personal information in new ways. Companies handling personally identifiable information, financial data, and/or health information must have in place robust cyber security protocols to limit the risk of data and privacy breaches. In addition, the method and type of data collected, how it is used to drive decisions, where it is stored, and for how long, are important considerations for data privacy during the pandemic and beyond.

What is data privacy and how has it evolved over time?

The right to privacy is a “fundamental human right” recognized in the United Nations Declaration of Human Rights, the International Covenant on Civil and Political Rights, and other international and regional treaties. Most countries recognize the right of privacy explicitly within their constitutions. While the definition varies, it may include the privacy of personal data or information (e.g., medical records); the protection of people’s bodies (e.g., drug testing) and personal space (e.g., homes); and the privacy of our communications (e.g., mail, telephones). Data security aims to ensure that any personal information that is collected, used, or stored is protected from unauthorized use.

Over the past decade, governments and consumers have become increasingly concerned about data privacy and security, largely due to the rise of globalization, advancements in technology, the use of multimedia, and the evolution of business models that derive financial value from personal data.

The increased focus on data privacy and security has ushered in a new generation of government regulations. For example, in 2016 the European Union (EU) approved the General Data Protection Regulation (GDPR), which applies to the collection of data from residents by firms inside or outside of Europe. The cost of non-compliance with privacy regulations and requirements can be steep. Companies found to be non-compliant with the GDPR, for example, can be fined up to EUR€20 million, or 4% of a company’s annual turnover (whichever is higher).³ Many companies have been fined in recent years for data privacy violations or breaches, including British Airways (EUR€205 million in 2019), Marriott International (EUR€110 million in 2019), and Google Inc. (EUR€50 million in 2019)⁴ under the GDPR, as well as Facebook (USD$5 billion in 2019)⁵, Google and its subsidiary YouTube (USD$170 million)⁶ to the Federal Trade Commission (FTC).

How can companies address data privacy?

A company’s exposure to data privacy issues is largely a function of their business model, what data they collect, and how they process, store, and share that data. In order to effectively address data privacy and protect the security of data, a company should:

1. Establish board oversight and accountability: Companies should establish clear accountability and responsibilities for data information and security at a senior management and board level. The board, and/or responsible board committee, should receive regular updates on cyber security strategy and processes, and actively seek related expertise when appointing directors.
2. Know and comply with all laws and regulations: Companies should identify and monitor regulations in all relevant jurisdictions, and provide public disclosures committing to compliance with all laws. Both the volume and scope of data privacy and protection laws is increasing, as are the fines for non-compliance.
3. Only collect necessary data: Companies should collect the minimum amount of data required (data minimization) in order to achieve the purpose for which it is collected (proportionality). If additional information is not required, then it should not be collected.
4. Understand and receive consent: Collection of personal information should only be done with the individual’s knowledge and consent, with very few exceptions. As such, consent for data collection and use should be built into processes and reviewed regularly.
5. Implement robust data security management practices: Any company that collects and uses personal information should have in place policies and practices to protect the data and guard against cyber-attacks. These should include incident management plans that cover both disaster recovery and business continuity, as well as audit processes that cover all operations and third-party providers.
6. Build awareness of data privacy: Employees that handle personal information should understand data privacy requirements, as should customers and third parties. Providing regular information and skills training on topics such as consent, protection of credentials, phishing, and cyber security can enhance a company’s ability to manage related risks.

At RBC Global Asset Management (RBC GAM), we consider environmental, social, and governance (ESG) factors to assess the exposure of companies to material ESG risks. The quality and effectiveness of a company’s data privacy and security is one factor our investment teams consider in their ESG integration processes. This may include consideration of a company’s data collection, use, consent, and monetization process; the strength of its privacy policies; managerial responsibility; privacy and security audits; staff training; reporting; and board oversight.

How does COVID-19 impact data privacy?

The World Health Organization declared COVID-19 a global pandemic on March 11, 2020. Since then, companies and governments have taken unprecedented measures to help contain the virus and protect the population. This includes the use of technology to collect, use, and share data with the goal of limiting infections, establishing effective policies, and enabling vaccine research. Under these circumstances, the right balance needs to be struck between public health and safety and the need for data privacy and security.

How will data privacy and protection change as a result of COVID-19?

The COVID-19 pandemic has required governments and companies to adapt quickly to a rapidly evolving situation. While data and technology have an important role to play in helping companies and authorities identify, track, and monitor the spread of COVID-19, data privacy and security must remain important considerations. Once the immediate needs of the crisis have passed, companies and governments will need to:

• Verify compliance with privacy laws: Data that may have been collected under emergencies acts, modified laws, or specific guidance related to COVID-19, will need to be identified and assessed to ensure that any ongoing collection, processing, or sharing of data is in compliance with all privacy laws.
• Confirm individuals’ consent and data rights: In cases where personal data will continue to be collected and/or held, companies and governments should ensure that consent is provided. While implicit consent or voluntary provision of data may have been adequate during the crisis under modified laws or requirements, explicit consent may be required moving forward, especially if the purpose for which the data is collected has changed.⁹
• Verify data privacy and security: Technologies or processes, such as video conferencing, remote onboarding, or digital verifications, may have been implemented during the crisis without having gone through an organization’s normal third-party risk-management process. Companies should ensure that any gaps in the verification process are filled to avoid potential non-compliance with privacy laws or security violations.

At RBC GAM, every investment team evaluates material ESG factors, including data privacy and security, as part of its investment decision-making process. We also convey our views on key factors through thoughtful proxy voting and engagement with issuers. We believe that being an active, engaged and responsible owner empowers us to enhance the long-term, risk-adjusted performance of our portfolios and is part of our fiduciary duty.