You are required to educate your employees on data protection, no matter which market you operate in. The world's most important data privacy laws explicitly or implicitly require you to ensure that your employees are aware of the risks associated with data security and can effectively implement data protection principles in their work. These laws include the EU's General Data Protection Regulation (GDPR), California's California Privacy Rights Act (CPRA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Brazil's General Data Protection Law (LGPD), and others.
Therefore, if you work in the online markets of Europe, the US, Canada, or South America, you have no choice but to educate your employees on data protection. As you will see from the penalty examples we will discuss later, data protection authorities will take into account whether you have trained your employees when evaluating your violations and penalties.
In this article, we will delve into the specific requirements for employee training in various privacy laws. For GDPR and PIPEDA, we already have specific cases with penalties that could give you a better idea of what is expected of your business.
By reading this article, you will learn:
- The GDPR requirements and how EU companies have been penalized for not training their employees on GDPR
- The UK GDPR and UK DPA requirements, as well as the recommendations of the UK ICO
- The CCPA's explicit requirements for training personnel
- The PIPEDA requirements in Canada for data security and how employee training is an integral part of it
- The LGPD requirement in Brazil to train your staff.
GDPR Employee Training Requirements
The GDPR mentions employee training only once as a task for the data protection officer (DPO). One of their main tasks is to raise awareness and train staff involved in processing operations. However, this does not mean that only businesses required to appoint a DPO should educate employees on data protection and GDPR requirements. All businesses need to train their staff.
We can draw this conclusion by referring to the EDBP Guidelines on Privacy by Design and Default principles, which are mandatory for any organization processing personal data. These principles require businesses to implement technical and organizational measures that protect the personal data of data subjects, including processing only the minimum set of data, processing data only for necessary purposes, pseudonymizing when possible, and retaining data only as long as necessary. These principles are fundamental GDPR principles.
You may think that employee training is not a requirement, but you would be mistaken. In the EDPB Guidelines on data protection by default and design, the EDPB clearly states that technical and organizational measures and necessary safeguards can be anything from advanced technical solutions to the basic training of personnel. In addition, lack of appropriate organizational measures can undermine the effectiveness of a chosen technology.
In simple words, the technical measures may not work if your employees do not know how to use them. Thus, training your employees in personal data protection is essential.
The EDPB takes the same stance in the Guidelines on Data Breach Notification Examples, stating that training and awareness on data protection issues of the staff of the controller is essential for the controllers. This training should be regularly repeated, depending on the type of processing activity and size of the controller, addressing the latest trends and alerts coming from cyberattacks or other security incidents.
Thus, even though there is no explicit requirement for employee training, businesses are expected to train their employees. If they do not know how to handle personal data properly, they may violate the GDPR, resulting in fines for the business. For example, the Romanian DPA fined a bank EUR 100,000 for unlawful disclosure of personal data and insufficient employee training. The Bulgarian Supreme Administrative Court found that a courier service did not train personnel on data protection properly and disclosed customers' personal data to unauthorized third parties.
In contrast, the Spanish DPA did not fine the Spanish football club Real Madrid for a data breach because they had implemented technical and organizational measures for data protection, including training their staff in handling personal data.
In conclusion, employee training is essential for businesses to comply with GDPR regulations and avoid potential fines.
UK GDPR and UK DPA Employee Training Requirements
If you operate in the UK market, employee training can also pay off. For example, the UK ICO fined the Cabinet Office GBP 500,000 for publishing the 2020 Honours List along with the postal addresses of Honour recipients. The ICO found that the breach was caused, among other things, by a lack of sufficient data protection training. Although some Cabinet Office employees had undergone GDPR training classes, not all had completed the training.
The UK ICO recommends that all organizations train their employees to handle personal data and provides an Accountability Framework to help ensure compliance with the laws. Training and awareness are crucial components of the framework, which includes induction and refresher training, training for specialized roles, monitoring, and awareness raising. The ICO also recommends keeping records of training.
Furthermore, the ICO clarifies that organizations have a legal responsibility to identify and handle data subject requests appropriately, and that employees who regularly interact with individuals may require specific training to recognize and handle such requests.
It is clear that the ICO expects organizations to train their employees on data protection.
CCPA/CPRA Employee Training Requirements
Section 1798.130(a)(6) of the CCPA mandates that businesses covered by the act must ensure that all individuals responsible for handling consumer inquiries about the business's privacy practices or compliance with the act are informed about the requirements outlined in Sections 1798.100, 1798.105, 1798.110, 1798.115, and 1798.125, as well as this section, which regulate consumer requests, and how to direct consumers to exercise their rights under those sections.
In simpler terms, it is mandatory to train your employees to receive and comply with CCPA consumer requests. This is not a choice but an obligation.
To date, the only CCPA fine was imposed on Sephora. Non-compliance with consumer requests was among the violations, and the settlement required Sephora to comply with several CCPA sections, including 1798.130. While the settlement text did not explicitly state that businesses need to educate their employees on how to handle personal information, it is safe to assume so.
In any case, the CCPA explicitly requires businesses to comply with these regulations.
LGPD Employee Training Requirements
The Brazil LGPD includes employee training in a similar manner to the EU GDPR. Section 41 lists the tasks of the Data Protection Officer (DPO), and it specifies that the DPO's responsibilities include "guiding the entity's employees and contractors on practices to be adopted in relation to personal data protection."
The Brazil National Data Protection Authority (ANPD) is preparing to enforce the LGPD more strictly. Although no companies have been fined yet, it is important to remember the requirements outlined in the law.
Canada PIPEDA Employee Training Requirements
In Canada, PIPEDA relies on 10 fundamental principles, with safeguarding personal data being one of them. To effectively safeguard personal data, it is necessary to train employees to do so on a daily basis.
Section 4.1.4 of PIPEDA Schedule 1 explicitly states that organizations must "implement policies and practices to give effect to the principles, including...training staff and communicating to staff information about the organization's policies and practices..."
Section 4.7.4 further states that "organizations shall make their employees aware of the importance of maintaining the confidentiality of personal information."
According to the Privacy Commissioner website, organizations are required to communicate their safeguard procedures to their employees and provide them with training to ensure that these procedures are correctly implemented.
The Privacy Commissioner has also listed some investigations and findings related to insufficient employee training on PIPEDA. For example, an insurance company was directed to introduce safeguards, including employee training, due to unauthorized sharing of data, and Google was recommended to re-examine the privacy training of employees to increase awareness of Canadian data privacy laws.
It is clear that employee training on data protection is essential in Canada.
Final Thoughts
Employee training on data protection is not just a luxury, it is a necessity. When you handle personal data, your users trust you to take the matter seriously and act responsibly. Your employees are the backbone of your business, so it's crucial to ensure that they are aligned with your vision of data protection responsibility.
Remember, your business is only as strong as its weakest link. To avoid penalty risks and protect your reputation, you must ensure that your weakest link is knowledgeable about data protection requirements and capable of upholding them effectively.
