Application Security requirements: GDPR vs. CCPA

Key things you should know for developing compliant applications and bringing current applications into compliance

The new GDPR supersedes Data Protection Directive 95/46/EC. The old law was ineffective in practice, as enforcement and implementation differed from country to country within the EU.

Additionally, with the explosion of uncontrolled data collection, big data, and the increase in data breaches and leaks, the former Directive could not keep up with the new reality. With enforcement of the GDPR beginning May 25, 2018, security has undergone a paradigm shift, as the focus moves from infrastructure to people.

The GDPR protects the fundamental rights and freedoms of EU citizens and residents by placing requirements and obligations on organizations to follow the principles of lawfulness, fairness, and transparency. Processing of any data may occur only after clear, explicit consent from users (no checkboxes-by-default) or in some other defined cases such as performance of a contract or legitimate interests. Moreover, information on processing of personal data should be explicit and legitimate, easily accessible, and easy to understand.

Communication to users must be completely clear with regard to:

• The fact that personal data is being collected, used, consulted, and processed.
• Risks, rules, safeguards, and rights related to the processing of personal data.
• The way in which one can assert his or her rights with regard to the processing of personal data.
• Data breaches if they are likely to present high risks to the rights and freedoms of individuals.

Additionally, the legislation gives some important rights to users, including:

• To request and obtain access to your personal data.
• To rectify and delete personal data concerning you.
• To request erasure (the "right to be forgotten").
• To not be subject to profiling.
• To restrict processing.

The GDPR also introduces important requirements such as designating a Data Protection Officer (DPO) for large-scale processing to ensure compliance with regulations as per Articles 38 and 39. Additionally, the GDPR requires notifying the Data Protection Authority (DPA) within 72 hours of any security incidents likely to affect personal data. Beside these organizational changes, there are also many technical measures for data protection: the GDPR aims to incentivize businesses to focus on securing data by means of encryption, pseudonymization, and protection by default and design.

If you plan for your applications to be compliant with GDPR requirements, there are four articles to which you should pay particular attention:

• Article 25: Data protection by design and by default
• Article 32: Security of processing and security assessment
• Articles 33, 34: Data Breach transparency requirements

What are the penalties for non-compliance?

The GDPR authorizes regulators to impose high fines: up to €20,000,000 or 4 percent of the total annual global turnover of the previous financial year, whichever is greater.

The CCPA expands upon Californians' right to privacy enshrined in the California Constitution since 1972. As stated in the bill itself, "Fundamental to this right of privacy is the ability of individuals to control the use, including the sale, of their personal information." Legislators in favor of the law cited past data breaches and manipulation of Facebook users.

Broadly speaking, the CCPA takes a similar approach to protecting personal data as the GDPR, but imposes fewer specific requirements and strikes a more balanced approach between the privacy rights of users and obligations on business.

The main goals of the law are to provide the following rights to Californians:

• To know what personal information is being collected about them.
• To know whether their personal information is sold or disclosed and to whom.
• To say "no" to the sale of personal information.
• To access their personal information.
• To receive equal service and prices, even if they exercise their privacy rights.

Some tips on complying with CCPA requirements

1. Make sure to update policies and notifications
   The CCPA requires specifying why are you collecting data, what kind of information is being collected, and for what proposes (to be shared, sold, processed, etc.).
2. Update your web applications
   You now need to add a clear way for users to exercise their rights, such as opting out or requesting to delete all stored data.
3. Map your clients' information
   You need to be transparent about how and where client information is stored. The CCPA grants greater opt-out rights for personal information sales than the GDPR. You likely will have trouble pulling this information together from different applications.
4. Inform your clients of privacy policy updates
5. Reduce risks by getting rid of unnecessary or old personal data
6. Update your internal policies
   You need to be ready to inform about a breach in a specific format, with exact information about the nature of the breach, information affected, what you are currently doing, what the client can do, and a clear way for users to reach out for clarifications. In addition, you need to check how access controls are implemented throughout your applications.
7. Adopt security practices
   CCPA requirements regarding specific security practices are less specific than the GDPR, with a greater focus on tracking, accessing, and storing data. However, you are required to keep client data secure by looking out for threats and vulnerabilities.

What are the penalties for non-compliance?

The state of California may bring actions for civil penalties of $2,500 per violation, or up to $7,500 per violation if intentional. However, the CCPA also grants businesses a 30-day cure period for violations that have been detected.

Consumers have a private right of action to seek the greater of actual damages or statutory damages, ranging from $100 to $750 per consumer per incident. Courts may also impose injunctive or declaratory relief.

In the context of application security, GDPR has more explicit requirements for data security that organizations need to take into serious consideration.

If you have an application that processes personal data, then the GDPR requires that organizations follow security "by design and by default" for data protection (Article 25). Data protection considerations should be embedded into the application, which is much cheaper to do during the earlier stages of the application lifecycle. GDPR-mandated approaches (encryption, classification, etc.) should be embedded and discussed starting from the design stage. In later stages of the lifecycle, technologies for automating protection against attacks and testing for security vulnerabilities during development and deployment should be considered—they offer a way of operationalizing a protection-by-design mindset and approach.

When the application is operational, data protection and security of processing (Article 32) ensure that the application is handling data securely, and that no vulnerabilities threaten personal data. This same GDPR article (Article 32-d) also requires having a clear understanding of your current vulnerabilities by establishing "a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing."

GDPR Articles 33 and 34 require transparency in case of a breach, with notifications to the regulator and the end user. For example, it requires the controller to report a breach within 72 hours, which means you need to have 24/7 visibility into your applications.

The CCPA does not have similar data security requirements, as it is more focused on consumer privacy rights. However, one of the drafts of the CCPA mentioned NIST standards as a guideline for data security practices. So from an Application Security point of view, you can use NIST frameworks such as SAMATE (Software Assurance Metrics And Tool Evaluation) to make sure you are putting adequate security controls in place.

Additionally you can check our guide for securing web applications if you want to get a high-level understanding of the actions necessary to achieve integrated application security.