What Is Data Misuse?

Data misuse is the use of information in ways it wasn’t intended for. User agreements, corporate policies, data privacy laws, and industry regulations all set conditions for how data can be collected and used. Data misuse violates these requirements.

Unlike data theft, data misuse doesn’t necessarily happen as a result of a cyberattack or when data is collected without the owner’s consent. Although preventing data theft by employees—as covered in the Computer Misuses Act—is important to consider, misusing data often means that permissions are being ignored: a user might willingly provide a company with their personal data, only for the company to use or share this information for purposes that the user didn’t agree to.

Causes of data misuse

The misuse of information or information systems at an organisation can lead to unintentional data compromise.

• Often, data misuse happens when employees lack good data handling practices. As an example: when employees copy confidential work files or data over to their personal devices, they make that information accessible outside of its intended, secure environment. Without the proper protections in place, this data can be stolen or accidentally leaked.
• Collection errors can also lead to the misuse of data. Inaccurate algorithms can result in a company bringing in data it never meant to gather, endangering customers and leaving businesses outside of compliance regulations.
• Improper filing is another misuse of information. Depending on how your systems categorise it, some datasets may be stored in locations where they’re accessible to the wrong teams or users.

Even the innocent mishandling of information can open the door for data breaches. The silver lining? By learning how to securely use and manage data, you can shield your organisation from leaks and attacks.

What laws exist regarding data misuse?

Governments around the world are gradually implementing laws to protect their citizens from data misuse. Organisations should take care to understand and honour the compliance frameworks in each territory in which they operate. This is especially important for institutions that collect data from people around the globe.

The European Union’s General Data Protection Regulation (GDPR) is a leading piece of legislation when it comes to protecting personal data. The GDPR’s principle of purpose limitation addresses data misuse and mandates that organisations should:

• Clearly state what their purposes are for processing data.
• Document that intent and detail it in privacy information resources.
• Regularly review and, when necessary, update processing and documentation.
• Get individual consent or legal grounding before processing data for alternative outcomes.

California, meanwhile, has introduced the California Consumer Privacy Act (CCPA), which, among other measures, grants individuals the right to refrain from having their personal information sold to third parties, preventing potential instances of data misuse.

Examples of data misuse

Data misuse has frequently come up in the news, as instances of organisations using personal data for a variety of unauthorised purposes have increasingly come to light.

• Google has fallen afoul of multiple European data regulators. Previously fined €50m by France for unclear data consent policies, Ireland’s Data Protection Commission is investigating claims that Google fed personal data to advertisers in violation of the GDPR.
• Despite a privacy policy that forbade staff from viewing customer ride histories, Uber staff used a “God View” tool to track journalists, politicians, and celebrities. Since 2017, the company has been required to undergo regular third-party privacy audits—a process that will continue for the next two decades.
• The Information Commissioner’s Office in the U.K. fined two businesses under the same ownership—Leave.EU, a pro-Brexit campaign group, and Eldon Insurance—for using personal data interchangeably in marketing campaigns without consent.
• Back in 2015, Morgan Stanley announced the dismissal of a financial adviser for downloading account data on the firm’s wealth management clients and publicly posting a number of account details online.

Data misuse brings severe and long-lasting consequences to companies that practice it, from legal action and financial penalties to reputational damage and harm to customer well-being. Organisations that make efforts to improve their data literacy and governance practices can keep on the right side of the law and inspire customer trust.

How to prevent data misuse

Each organisation has unique challenges to address when it comes to data security. Here are some best practices to apply in your workplace to help prevent data misuse.

1. Implement identity and access management

Verifying the identity of each user that attempts to access your system is an essential measure to protect your data, be it information about your company or your customers. Implement multi-factor authentication (MFA) to make sure only trusted users can access your data. MFA secures the authentication process by requiring, in addition to credentials, something the user possesses (like a prompt on a smartphone) or something intrinsic to them (like biometric data) to verify identities.

Access management is particularly important for account holders who have extensive access to sensitive and valuable company data. These privileged accounts need an extra layer of protection against cyber attackers and insider misuse.

2. Establish need-to-know access

In order to detect and prevent data misuse, you’ll need to see what happens when each user accesses files or data. Activity logs allow you to track and contextualise every action that takes place in your network.

Activity monitoring solutions can complement logs and help security by continuously observing when and how each user interacts with data. With a well-informed view of user activities, admins can accurately determine if any user actions have harmful intent or otherwise threaten the confidentiality of your data.

3. Set up behaviour alerts and analytics

Continuously monitoring a workforce is a difficult task, particularly in large organisations. Seek out solutions with alert features that’ll notify security upon any potentially compromising events. Ideally, you can customise these alerts to hone in on specific behaviours—think new logins to a server, running certain applications, or external devices and drives connecting to your infrastructure.

Real-time analytics are essential for stopping data misuse as it happens. User entity behaviour analytic modules (UEBA) assess user actions and determine regular activities for each account holder. If employees do anything unusual, like attempting to access files and data they’ve never used before, security will get an alert.

4. Educate your teams

Keeping your employees up-to-date on data security can prevent accidental leaks and misuse. Outline your policies on data procedures and standards in easily accessible company resources. Regular training initiatives on data security can also help to raise awareness.

Cybersecurity training courses and knowledge-sharing sessions from the security team can promote good data practices, from keeping credentials confidential to recognising the latest phishing scams. Make clear why it’s important to properly care for sensitive data, and remind people of the legal, financial, personal, and reputational consequences of data misuse.

5. Build clear processes around data access

Customers want to be sure that their data is in safe hands, but they also want to use your services and apps without disruption. Providing a secure yet seamless customer experience means building identity and access management into your customer tools.

Explore features like account takeover protection, MFA, and integrated sign-ons for apps and social media channels to keep customer data secure at no cost to usability.

Where is data misuse headed?

Legislators around the world are attempting to define and act against data misuse. Right now, it’s a challenge to determine what rights individuals have over how companies and governments use their personal data. A global consensus is hard to reach, as countries and states take different approaches to data privacy (e.g., CCPA vs. GDPR).

As our legal requirements continue to evolve, we can all do our best to prevent data misuse by following best practices regarding data security and compliance.

Wondering where to begin? Start your GDPR and identity security journeys with Okta.