Privacy Risk Management & Data Minimization

Let's consider a familiar fact pattern: a global ecommerce retailer, Plate Co, experiences a data incident as a result of a successful phishing attempt by a bad actor. The bad actor is able to access a server containing over 20 years of customer data. The incident is publicized on the dark web, which results in millions of customer data sets being made public, with a note that it was taken from Plate Co. As the company begins to investigate the incident, they realize that no one in the company knew that the data sat on the server that was accessed by the bad actor. The purchase history for some customers is from 2004, and includes credit card numbers and mailing addresses. The company expands its assessment of its systems and finds that they have been retaining other data, including email and the data for former employees, going back many years and have not been implementing any retention or disposal on that data. Concerned about the results of its investigation, and a potential FTC inquiry, the company decides that it must start to minimize its retention of data across the company. The company is also involved in a number of litigations and regulatory investigations that require it to preserve relevant data, including data going back several years. The company knows that it must take action, but is unsure where or how to start. In the meantime, the status quo persists and the data retained by the company continues to compound.