Under Australia’s Privacy Act, organizations that hold people’s tax file numbers (TFNs) must securely destroy or permanently deidentify those TFNs once they no longer have a legal reason for storing them. This might happen when someone stops being a customer.
Australia’s privacy regulations pay particular attention to TFNs because of the potential for them to be used in fraud and identity theft.
RISKS AND CHALLENGES
Managing these risks can be challenging. In large organizations, TFNs can be stored within vast oceans of data, in many different locations and file formats. This may include scanned handwritten documents such as application forms.
Without powerful technology to find and redact TFNs, the task of compliance can be almost impossible. If not dealt with properly, this sensitive information can be exposed in an instant by an embarrassing and costly data breach.
BIG FOUR BANK
To help proactively manage these risks, one of Australia’s Big Four banks recently deployed Nuix Workstation and the Nuix Data Finder plugin to find and redact TFNs across more than 240 million documents.
Using the unmatched power and speed of the patented Nuix Engine, bank staff quickly scanned the documents and identified those containing TFNs, significantly reducing the bank’s compliance risk profile within a very short timeframe.
PRIVACY DATA IS A GLOBAL ISSUE
Australian banks aren’t the only organizations facing this challenge. Healthcare providers, insurers, professional services firms and government agencies often hold enormous amounts of private and sensitive data. Privacy laws around the world strictly require organizations to only hold private data they need for business purposes and to ensure they remove any personally identifiable information they no longer have use for.
As volumes of data in the world increase at a compound annual growth rate of 23% – doubling every three years – this will become an impossible problem very soon unless organizations invest in the right technology to solve it.
The sea of cubicles is quieter than normal. All eyes seem to be turned toward the conference rooms at the far end of the room, where strangers in suits approach carrying cases of computer equipment. They enter the appointed spaces and close the door, where a sign printed on plain white paper is taped.
“This room is reserved indefinitely.”
This isn’t fiction; it’s a scene I witnessed firsthand working inside the financial services industry. While the silence and anxiety were more centered around the fact that one of our most precious resources – a 10-person conference room – was likely out of circulation for months, there was definitely a sense of trepidation as the regulators went to work.
I recalled that scene several times as we worked on the 2021 Nuix Global Regulator Report alongside Ari Kaplan Advisors. How valuable would the insights in the report have been for our business unit during those months of meeting our obligations to the regulators? How much anxiety would have been put to rest? Most importantly, how quickly would we have gotten that conference room back?
RESPONDING TO REGULATORS MORE EFFECTIVELY
During a Q&A webinar about the report, chief report author Ari Kaplan and Stu Clarke, Regional Director – Northern Europe at Nuix, addressed the topic of corporations working more effectively with regulators.
Based on their conversations with regulators, it became clear that regulated corporations should take control of their environment. “Holistically, it makes life much easier when an inquiry kicks off,” Stu said. “They have a much better understanding of where risks lie and where employees are working inside the organization,” making it that much easier to respond to inquiries.
It also helps to look at regulators as guides who are there to advise the company, not just punish it when it goes astray. Summarizing some of the comments during the webinar, regulators have a role to inform and guide the organizations they are responsible for. There’s a desire amongst the regulators to work more collaboratively and build an ongoing relationship, not just swoop in during a one-time event.
It also helps to understand where the regulators are coming from. “The regulators are incredibly savvy and have experience in private industry,” Ari said. “They are well-versed in the various tools and they talk to each other.”
HANDLING A CONSTANTLY CHANGING ENVIRONMENT
The regulatory environment adapts as the realities of day-to-day business change. “Things change rapidly,” Stu said. For example, “we weren’t talking about Microsoft Teams two years ago, and we can’t stop talking about it or using it now.”
Those changes are just another set of reasons to better understand what the regulators are looking for. Download the 2021 Nuix Global Regulator Report to learn more about regulators’ approaches to their respective industries, preferred technology and enforcement practices, all of which can help you work more efficiently during a regulatory inquiry.