A new frontier: Data protection and privacy in ESG

Data protection and privacy risks on vital infrastructure sectors such as energy, telecommunications, transportation, gas production and transmission, water and sanitation, can lead to unforeseen interferences and environmental damage on a large scale. Oversight on these risks - some of which include, data leakages, unauthorised access to data, cyber-attacks, data loss/theft or unintended destruction - can lead to fires, explosions, and the release of hazardous material. Subsequently, this can result in human injury, property damages, and hefty environmental reparation expenses and significant regulatory claims. Reduction of electronic waste and energy usage are also key considerations when examining compliance from an ESG perspective.

Linking data protection and privacy with ESG can enhance compliance with laws and regulations to ensure reduced incidents of breaches. Businesses can also promote greener ways to collect, process and store data, which in turn reduces their carbon footprint.

In 2021, PwC carried out a survey on what consumers and employees want businesses to do in relation to ESG. The survey revealed that consumers and employees want businesses to proactively shape ESG best practices, not just react and adjust. In fact, 83% of employees and 76% of consumers were seen as more likely to work for or buy from a company that stands up for social issues. Data privacy breaches negatively impact businesses by reducing trust and affecting their overall relationships with employees, community, and its regulators. Such breaches may also lead to the exposure, theft, and fraudulent activities towards consumers. For example, companies that have suffered cyber-attacks which result in serious data breaches have lost critical customer relationships, significant revenues, and in turn experienced the devaluation of their brand. We should also highlight the need for businesses to embed privacy and data ethics into their ESG strategies as well as design and use technologies that can achieve positive social outcomes.

Resilience against data privacy attacks is largely dependent on the willingness of the leadership in business to invest in data protection and privacy measures/mechanisms. Directors are likely to be held liable for data privacy attacks due to governance inconsistencies. 

To reflect the current global trend of including data protection and privacy in ESG compliance frameworks, boards and other business governance bodies must establish structures and strategies for value creation, risk management, monitoring and evaluation and business continuity. Entities that fail to incorporate the appropriate framework will be less resilient and sustainable which impacts other stakeholders and ultimately the government and the economy.