What You Should Know About Data Privacy – And How to Get Started
Data privacy is an issue of significant concern in the digital age, in large part because data breaches keep occurring, revealing the personal data of millions of people worldwide. Even one isolated breach can have profound consequences. Individuals may be subjected to identity theft or blackmail, while companies might run the risk of financial losses as well as harm to the public, investors, and customer trust.
It can be difficult to balance the need to utilize personal data for business purposes against an individual’s right to data privacy. In this article, we’ll explore the significance of data privacy, how it relates to data protection, which compliance regulations are centered around data privacy protection, and what you should be aware of when implementing a data privacy policy.
What Is Data Privacy, And Which Data Is Involved?
Data privacy, also referred to as information privacy, centers around how data should be gathered, stored, controlled, and shared with any third parties, along with complying with all applicable privacy laws.
To properly characterize data privacy, it’s helpful to specify precisely what is going to be protected. Several types of data that are customarily regarded as sensitive, both by the general public and by legal mandates, include:
- Personally Identifiable Information (PII): Data that could be utilized to identify, reach out to, or track down an individual, or to differentiate one person from another.
- Personal Health Information (PHI): Medical history, insurance information, and other private data accumulated by healthcare providers and could possibly be connected to a particular person.
- Personally Identifiable Financial Information (PIFI): Credit card numbers, bank account details, or other data regarding a person’s finances.
- Student Records: An individual’s grades, transcripts, class schedules, billing details, and other academic records.
More generally, in its “Guide to Protecting the Confidentiality of Personally Identifiable Information,” the National Institute of Standards and Technology (NIST) offers the following examples of information that might be considered PII:
- Name: Full name, maiden name, mother’s maiden name, or alias personal identification numbers, such as social security number (SSN), passport number, patient ID number, or a financial account or credit card number.
- Address Information: Street address or email address.
- Personal Characteristics: Photographic images (particularly of the face or another distinctive characteristic), X-rays, fingerprints, or other biometric images or template data (e.g., retinal scans, voice signature, facial geometry, etc.).
- Information About an Individual That’s Linked or Linkable to One of the Above: Date and/or place of birth; race; religion; activities; geographical indicators; and employment, education, financial, or medical information.
Which Data Is Not Subject to Data Privacy Concerns?
There are two main categories of data that aren’t subject to data privacy concerns:
- Non-Sensitive PII: Information that is already in the public record, such as a phone book or online directory.
- Non-Personally Identifiable Information: Data that can’t be used to identify an individual. Examples include device IDs and cookies. (Note: Some privacy laws consider cookies to be personal data, since they can leave traces that could be used in conjunction with other identifiers to reveal a person’s identity.)
Personal Data Protection and Privacy Regulations
Data breaches continue to make the news all too regularly, and the public realizes they’re gradually losing control over their confidential information. Industry research demonstrates that 71% of Americans occasionally or frequently worry about their personal data getting hacked, and that 8 in 10 U.S. adults are concerned about businesses’ ability to protect their financial and personal information.
In light of escalating public concerns, governments are tirelessly working to establish and improve privacy data protection laws. Indeed, the need to confront modern privacy issues and safeguard data privacy rights is a worldwide trend. The EU’s General Data Protection Regulation (GDPR) is the most noteworthy law, but a number of nations – including Brazil, India, and New Zealand – have instituted new privacy regulations or reinforced existing regulations to govern how personal data can be collected, maintained, used, disclosed, and disseminated.
Currently, there are a number of prominent U.S. federal privacy laws in effect which obstruct companies from improper transmission of personal data, each designed to address particular types of data. These include:
- Health Insurance Portability and Accountability Act (HIPAA) / Health Information Technology for Economic and Clinical Health Act (HITECH): Intended to secure personal health information.
- Gramm-Leach-Bliley Act (GLBA): Limited to financial information.
- Children’s Online Privacy Protection Act (COPPA): Protects children’s privacy by enabling parents to manage what information is collected.
- Family Educational Rights and Privacy Act (FERPA): Safeguards students’ personal information.
- Fair Credit Reporting Act (FCRA): Regulates the collection and use of consumer information.
Data Protection vs. Privacy Protection
Data privacy is closely connected to data protection. Both share the same goal: shielding sensitive data from breaches, cyberattacks, and unintentional or deliberate data loss. Whereas data privacy focuses on guidelines for how organizations may gather, store, and process confidential information, data protection concentrates on the security controls that take into account the confidentiality, integrity, and accessibility of information. Furthermore, data protection typically involves protecting not only personal information but other all-important data as well, including trade secrets and financial information.
Strictly speaking, data protection demands enacting policies, controls, and procedures to uphold data privacy guidelines, such as the following standards outlined in the ISO/IEC 29100 framework:
- Accountability
- Accuracy and Quality
- Collection Limitation
- Consent and Choice
- Data Minimization
- Individual Participation and Access
- Information Security
- Openness, Transparency, and Notice
- Privacy Compliance
- Purpose Legitimacy and Specification
- Use, Retention, and Disclosure Limitation
How to Get Started with Data Privacy Protection
Merely putting into action one or more data security technologies doesn’t assure that you will bring about total data privacy. Rather, when framing your data privacy protection policies, make sure to observe these best practices:
Know Your Data
It’s imperative to understand exactly what information is being gathered, how it’s being used, and whether it’s being hawked to or shared with third parties. Since various types of PII and their manifestations are unequal in value and some personal data can become sensitive in certain circumstances, you must classify your data by way of a quality data discovery and classification solution.
Take Control of Your Data Stores and Backups
Be sure not to retain personal data without a clear purpose. Establish retention policies and moderate personal data in line with its value and risk.
Manage and Control Risk
Data privacy protection has to incorporate periodic risk assessment. Rather than creating a framework from the ground up, you can implement one that’s already well-established, such as the NIST risk assessment framework defined in Special Publication SP 800-30.
Hold Periodic Training Sessions for Users
Ensure that employees are familiar with the subtleties of data privacy and security. Clarify privacy basics from the outset, specifying which devices can be employed when working with sensitive data and how this data may be transmitted and shared. Occasionally, it’s appropriate to advise personnel that they aren’t permitted to alter other people’s records, whether out of curiosity or for personal reasons, nor are they at liberty to take proprietary data with them when they part ways with the organization.
Final Thoughts
In times past, individuals’ personal data could be gathered discreetly and shared freely – but those days are gone. Now, any organization that collects and utilizes financial, health, and other personal information must manage that data with regards to its privacy.
By applying the best practices detailed above, your organization can establish a baseline privacy structure for becoming a conscientious and principled steward of personal data.
If you need help implementing a data privacy protection plan, DataGroup Technologies can help! Give us a call at 252.329.1382 today!