Solution Flyer

Voltage Powers Data Privacy CCPA/CPRA
Organizations must balance compliance with business objectives tocomply with global privacy regulations. Advanced privacy-enabling
technologies can help turn privacy into a catalyst for growth.
Voltage Data Privacy andProtection at a GlancePrivacy Compliance
Ensure that you can uncover sensitive andpersonally identifiable information.

Advanced Privacy-Enhancing Technology
Take protective action on data during
discovery to power faster decision-making
and establish data trust.

Drive More Business Outcomes
Beyond privacy compliance, Voltage
technology powers data minimization,secure cloud analytics, information lifecycle
management, greener IT and sustainability.

The California Consumer Privacy Act of 2018
(CCPA) and CCPA 2.0, also known as theCalifornia Privacy Rights Enforcement Act(CPRA), gives consumers more control overthe personal information businesses collectabout them, and regulations guide how to
implement the law. This law secures privacy
rights for California consumers, including:• The right to know about the personal
information a business collects about themand how it is used and shared;• The right to limit the use and disclose“sensitive personal information” (newprotected data category under CPRA),
including SSN, Driver licenses, Financial
accounts/ card numbers, Geo-locations,
Race/ethnic background, Religious
affiliation, biometric data, union
memberships and contents of an email,text messages;• The right to delete personal informationcollected from them (with some exceptions);• The right to opt out of the sale of theirpersonal information; and• The right to non-discrimination for exercising
their inherent rights.
• Businesses are required to give consumers
specific notices explaining their privacy
practices. The regulation applies to manybusinesses, including data brokers.

Advanced Privacy-Enhancing
Technology from Voltage

The California Privacy Rights and Enforcement
Act provides a framework for how organizations
can establish their privacy programs andpractices to comply with regulations andreduce risk. To augment these programs,
Voltage Fusion by OpenText™ delivers
advanced privacy-enhancing and privacypreserving technologies to help customers
not only drive compliance while ensuringthat the data can be securely and ethicallyshared across the business. Voltage also
helps drive cost containment; data retention
and disposition; and Environmental, Social,and Governance mandates such as reduced
power consumption, sustainability,and Green-IT.
Voltage Privacy-Enhancing andPrivacy-Preserving Technologies
Privacy-enhancing technology (PET) refers
to technologies designed to improve privacy
by reducing the amount of personal datacollected and shared. These technologies
include PII detection, de-identification,anonymization, and data minimization
techniques. The goal of PET is to reduce therisk of personal data being used or misusedin ways that could harm the user if nothandled ethically.
Privacy-preserving technology (PPT) refers toa subset of Privacy-enhancing technologies
that offers a variety of techniques and tools
designed to protect the privacy of individuals
and organizations when they share, collect, orpersonally process data. These technologies
are used in various contexts, including
consumer privacy, data analytics, and data
lifecycle management. The goal of PPT
is to ensure that personal data remains
secure and cannot be accessed or usedby unauthorized parties.

Voltage Powers Data Privacy CCPA/CPRA

Privacy-preserving technology include:• Encryption: Preserves data fromunauthorized use/ access or being able
to see the data in clear text.
• Masking/ Anonymization: Preserves
data by removing personally identifiable
information (PII) from data sets, making it
difficult to trace the data back to specificindividuals.
• Tokenization: Preserves data by replacing
sensitive data with a unique, reversible
token that can be used to represent thedata but cannot be used to reveal the data
itself without the presence of the token.
• Pseudonymization: Preserves data byreplacing PII with a pseudonym, or fake
name, that cannot be traced back to theindividual.
• Data minimization: Preserves data bycollecting and storing only the minimum
amount necessary to achieve a specificpurpose, reducing the risk of data misuseor abuse.
• Data access monitoring and controls:
Preserves privacy by ensuring thatunauthorized parties cannot access or
use personal data.
These privacy-preserving technologies are
critical to business operations. They enableorganizations to balance the collection
and use of customer data and meet their
obligation to protect individuals’ personal
information from being accessed, used,or shared without their consent.

Voltage Fusion Helps Organizations
with the Following:
The Right to Delete—Section 1798.105
Voltage Fusion enables the defensible
disposition of personal information inaccordance with policy, right to be forgotten
or other data deletion requests.

Right toDelete

BusinessPurpose

Data
Minimization

Data Security
and Protection

Data
Portability

Section 1798.105

Recital 39, 83

Sections 1798.100(c)and 1798.100(a)(d)Sections 1798.100(e)and 1798.150(a)Sections 1798.100(d)and 1798.130(a)(2)Business Purpose—Recital 39, 83
CPRA introduces new sections, including how
data is processed and governed, limitations
on storage, data minimization, and contract
requirements.
The regulation also calls out the limitation
on how long personal information canbe retained. Each category of personal
information should have a policy around“the length of time the business intends toretain each sensitive personal information,or for no longer than is reasonably necessary
for that disclosed business purpose.
OpenText™ Voltage Fusion can understandwhere duplicate and low-value data resides
and assign retention policies and tagging toensure ethical handling and processing ofpersonal information.
Data Minimization—Sections 1798.100(c)and 1798.100(a)(d)CPRA states that businesses must only retain
what they need and have policies to ensure
the proper disposition of that personal data.
CPRA also calls out minimization of personal
information collected, used and disclosed.
As a result, personal information deemed“necessary” must have a specific businessuse and retention period.

Voltage Fusion capabilities support data
minimization efforts that reduce the costand complexity associated with applicationand data sprawl. These use cases include
application retirement and modernization,
cloud migrations and data archiving.
In addition, Voltage Fusion ensures that only
the appropriate data is retained to support
audit, legal and regulatory obligations.
Data Security and Protection—
Sections 1798.100 and 1798.185
CPRA states that a business that collectsa consumer’s personal information shall
implement reasonable security proceduresand practices appropriate to the natureof the personal information to protect thepersonal information from unauthorized
or illegal access, destruction, use,modification, or disclosure in accordancewith Section 1798.81.5.
From a privacy compliance standpoint,
Voltage can enable businesses to monitor
data access and implement de-identificationand encryption as technical safeguards
that can protect personal information andcorporate reputation in case of a breach.

2Data Portability—Sections 1798.100(d)and 1798.130(a)(2)CPRA states businesses that receive a
consumer request to access their personal
information shall promptly disclose anddeliver, free of charge.
Voltage Fusion search capabilities canquickly find associated personal informationand package responsive data as required tosupport data portability requests.

Privacy Compliance and Data Trust
Support Downstream Corporate
Objectives and Growth Drivers

As organizations embark on the journey toprivacy management and privacy compliance,
Voltage privacy-enhancing technology
helps them prepare to comply with global
regulations and support their existing
privacy processes and practices. Moreover,Voltage helps build data trust to support
many different business outcomes that drive
business growth, operational efficiency,and sustainability.

Sustainability
Many organizations have taken on corporate
objectives to support greater sustainability,
reduce their carbon footprint, and operate
an increasingly green business. “Green”
Voltage technologies help organizations
achieve these mandates by reducing thestorage, power consumption, and operationalcosts associated with managing legacy data.
In addition, data minimization efforts andarchiving and cloud migration capabilities
drive the business towards lower costs,
reduced data and application sprawl,
and streamlined operational expenses.
Data Protection
As information is continuously protected byVoltage, the unintended consequences ofaccidental exposure or an actual data breachcan be mitigated through encryption andtokenization. In addition, sensitive information
is protected from exposure if the data issubject to a breach. At the same time,
data protected by Voltage can be leveragedby data analysts and business users in

its protected state to derive value for thebusiness. For example, business intelligenceand cloud analytics tools can manipulate thedata to look for ways to grow the businesswhile maintaining the data’s referential
integrity. This enables business users tosource analytics workloads ethically, whilestill ensuring that data analysts can leverageinsights and trends.
Financial Risk
Understanding the risk exposure aroundsensitive data should go beyond simple
risk scoring. For example, Voltage provides
visibility into the financial risk of managing
and protecting large data estates byvisualizing the economic impact of managing
and protecting data. This data can be used
to better estimate cyber insurance premiums,
while monitoring data protection activities.
Secure Cloud Analytics
Voltage data-centric security integrates
with data analytics platforms such as Google
BigQuery, Amazon Redshift, Azure Synapse,
Snowflake, Cloudera, and Teradata. Voltage
enables high-scale secure analytics anddata science in the cloud and on-premises
using format-preserved tokenized data,mitigating the risk of data exposure while
enabling privacy compliance.
Defensible Disposition
Data privacy requirements for data deletionand the right to be forgotten can be disruptive
to IT and content owners. Having data
lifecycle policies applied to business-critical
data (mapped to its business purpose)can reduce the impact of these requests.
In addition, automating defensible disposition
based on policy further streamlines thisprocess, ensuring compliance and driving
down the cost of managing data.

Connect with Us
www.opentext.com

Data Minimization
Keeping what you need and ensuring thatwhat is preserved is protected and hasa business purpose is a core principle ofdata minimization. On collection, Voltage
can help organizations ethically process
consumer data and protect it while in use.
For legacy data, Voltage Fusion can drive
cost efficiencies and reduce the threat
landscape. By removing duplicate data anddata that serve zero value to the businessdata discovery, you can reduce the overall
storage footprint and application sprawl, while
reducing the personnel required to manage
data and the lead application or database.
ISO 27701
ISO 27701 is a data privacy extension of ISO
27001 (Information Security ManagementSystem). Voltage Fusion, hosting andinfrastructure services are certified to support
the ISO 27001 risk-based approach for

implementing security controls around people,processes & technology. Voltage Fusion
capabilities drive compliance and support
privacy management mandates coveredin ISO 27701, including privacy impact
assessments, ethical records of processing,data minimization, deletion requests, data
portability, and data protection.
Summary
Voltage Fusion provides privacy-enhancing
technology within a data trust frameworkfor data discovery and protection. Voltage
enables organizations to reduce information
risk, ensure data privacy, and secure
quick access to critical data that drives thebusiness. Voltage provides data protection
and preservation and mitigates the risk ofprocessing sensitive data while supporting
other corporate initiatives that drive
business growth, operational efficiency,and sustainability.

OpenText Cybersecurity provides comprehensive security solutions for companies and partners of all sizes. From prevention, detection and response to recovery, investigation and compliance,
our unified end-to-end platform helps customers build cyber resilience via a holistic security portfolio. Powered by actionable insights from our real-time and contextual threat intelligence,
OpenText Cybersecurity customers benefit from high efficacy products, a compliant experience and simplified security to help manage business risk.
761-000085-006 | O | 10/23 | © 2023 Open Text