- In lesson 26.2
we're gonna be talking about privacy principles
and compliance with privacy regulations.
Now, privacy is the right of an individual
to control the use of their personal information.
And we talked about this way back in our early, early lesson
where I said it's really important
that every cybersecurity practitioner
has a good understanding of privacy
and doesn't think about privacy issues
as somebody else's responsibility.
Right, it's our responsibility.
When we think about confidentiality,
integrity and availability as the fundamental principles
of information or cybersecurity,
I always want you to tack on privacy.
It's that important.
Now, individuals expect their privacy to be respected
and their personal information to be protected
by the organizations which they do business with.
Now, a strategy that's really good to adopt
is known as data minimization.
Data minimization approach limits our data collection
to only what's required to fulfill a specific purpose.
If we don't need something, don't collect it.
It's that simple, right?
Then we don't have to think
about how we're going to protect it.
The consequences of privacy breaches
include reputational damage, loss of stakeholder trust,
fines, could be extraordinary fines,
we've seen some really big fines
coming out of the European Union, and litigation.
So way early on a number of lessons ago
we talked about the OECD privacy principles,
and I wanna go through them as a refresher.
Remember, there are eight OECD privacy principles,
let's just look at the first five.
Collection limitation, data quality, purpose specification,
use limitation, and security safeguard.
The collection limitation privacy principle
is that collection of personal data
should be obtained by lawful and fair means,
and were appropriate with the knowledge and with the consent
of the data subject.
Data quality is that personal data should be relevant
for the purpose collected and should be accurate, complete,
and we have a responsibility to keep it up to date.
Purpose specification is the purpose
for which personal data is collected should be specified
no later than at the time of data collection.
Again, we don't just get to collect stuff
'cause we think it might be useful later on.
Use limitation is that the personal data
should not be disclosed, made available,
or otherwise used for purposes other than what was specified
except with the consent of the data subject
or by the authority of law.
And then number five is the security safeguard
which is that personal data should be protected
by reasonable security safeguards.
And here we're talking about confidentiality,
integrity and availability.
So an interesting component
of both current and some emerging privacy regulations
is the right to be forgotten.
Now, the right to be forgotten
pertains to an individual's right
to have their personal information removed
or deleted from online platforms,
search engine results, or other publicly accessible sources.
Now, the right to be forgotten is not an absolute right,
and it really needs to be balanced against other rights
such as freedom of expression,
public interest, and or legal obligations.
So the scope and the interpretation
of the right to be forgotten
really does vary across jurisdictions and legal frameworks.
Now, there are numerous privacy specific regulations
in the European Union, in Canada,
in Mexico, in Brazil, in Japan.
Sort of the foundational regulation, right?
The one that really started it all
and one that so many other regulations are modeled after
is GDPR.
And we're gonna talk about GDPR in just a sec.
And then here in the US,
we don't have any one overarching privacy regulation,
but California was first out
with a state level privacy regulation.
So I wanna review the California regulation as well.
Now, I know we talked about both of these earlier,
but they're really important
so we're gonna talk about 'em again.
GDPR, the General Data Protection Regulation,
the objective is to protect people in the European Union
and the European Economic Area, the EEA,
from unlawful data collection or processing,
and it also works to increase consent requirements
and to provide enhanced user rights.
Now, GDPR is based on those OECD privacy principles.
CCPA is the California Consumer Privacy Act
and its objective is to protect California residents.
Now, the CCPA draws the scope
of personal information really broadly,
and that's one of the things that's so interesting
about this particular regulation,
where it doesn't just say,
"Okay, we're looking at discrete personal
or personally identifiable information
like a social security number or date of birth."
But instead we're looking
at this really broad scope of personal information
which could include information that identifies,
relates to, describes,
or is capable of being associated with
or could reasonably be linked directly or indirectly
with a particular consumer or household.
So it just like blew up what we think about privacy.
It's not just these identity theft based things,
it's like everything almost they could gather about you.
But California is the first state in the US
to have a privacy regulation.
There are other states that are starting to follow suit,
and California's really considered a a bellwether state
for regulations.
They were the first state
that had a Security Breach Notification Act.
And here we are, well, a number of years later,
and every US state and jurisdiction
has breach notification regulation.
Now, what's crazy about those, and I mentioned this earlier,
is that they all vary from each other
and some of them conflict.
It'd be really nice here in the US
if we had one overarching security regulation
and one privacy regulation.
But the bottom line is we don't
so it's left to the states.
Now, GDPR actually has some very defined
privacy roles and responsibilities
that I want you to be aware of,
a data controller, a data processor
and a data protection officer.
A data controller determines the purposes for which
and the means by which personal data is gonna be protected.
The data processor processes personal data
on behalf of a data controller.
Now, it's possible that the same organization.
You can be both the data controller and the data processor,
or those two roles can be split.
And then we have a DPO, a data protection officer.
And a data protection officer ensures that an organization
is in compliance with privacy regulations
as defined in GDPR,
and independence is required.
So let's talk about some privacy enhancing technologies.
We talked about two of these already
so it'll be a refresher, but two new ones.
Data masking, tokenization, anonymization
and pseudo anonymization.
The data masking is a technique used
to protect sensitive data
by replacing it with fictional or de-identified data.
Right, and we talked about this one early on
as well as tokenization.
Tokenization being the technique
to secure and desensitized data
by replacing the original data
with an unrelated value of the same length and format.
That's referred to as the token.
But here's two new ones for you,
anonymization and pseudo anonymization.
Anonymization is the process
in which individually identifiable data
is altered in such a way that it can no longer,
never, ever, ever be related back to a given individual.
And then we have pseudo anonymization.
The pseudo anonymization is a method
to substitute identifiable data
but it has a reversible consistent value.
So we could swap it back to the original individual.
So anonymization and pseudo anonymization.
Organizations that are in jurisdictions, right,
that have privacy regulations on them
need to have a privacy management program.
And there are three components
of a privacy management program.
The privacy program itself,
operations or operationally how do we deal with the data,
and then incident and breach response.
So what are some of the components of a privacy program?
Well, first of all, we wanna have executive sponsorship.
We're going to be doing privacy impact assessments.
I'll show you one of those in just a sec.
We want tools for data mapping,
meaning we need to find out where all of our data is
that would be considered you know,
that falls under a privacy regulation.
We need to identify our compliance
and our contractual regulations.
We'll wanna implement privacy by design,
which is privacy by design, automation and checklists.
And we'll wanna have a published privacy statement.
Then from an operations perspective,
while we wanna have cookie compliance,
now you've seen cookie compliance a lot,
right, every time you go to a website,
and you haven't been there before,
it says, "How do you want your cookies to be handled?"
That's really our cookie compliance.
We need consent mechanisms.
That's part of what you're being asked
when you go to the website.
But consent for whenever you're collecting information.
Communications mechanisms
for how you're going to communicate with the individuals
for who you have information about.
Compliance mechanisms for collection, uses,
sales and sharing.
So we wanna have mechanisms to ensure
that what we collect is what we said we were gonna collect,
that we're using it in the way we said we were gonna use it,
and that we are keeping it up to date and accurate.
And that if we are going to sell it or share it, right,
that we are doing that with consent and full disclosure.
Then we may wanna adopt some privacy enhancing technologies
like anonymization or pseudo anonymization or tokenization,
and then ways that we can report out
and knowing how we can assess our own operations
to make sure that we are doing the right things.
And then lastly, we have incident and breach response.
That's incident prevention, detection, management,
notification triggers, and reporting obligations.
So I mentioned as part of our privacy program
we need to do privacy impact assessments.
Let's go through the steps or the components of doing a PIA,
a privacy impact assessment.
So we're going to focus on a particular system.
So the first question we're gonna ask is,
what information is being collected?
What are we collecting?
What do we have?
Then we're gonna say, "Okay, well why do we have it?"
This is what we have,
why do we have it?
Which is really another way of saying, do we need it?
Is there a reason?
So let's figure out why we have this information.
Let's figure out why we're collecting this information.
Then how will the information be used?
Let's understand how we're using the information.
How will the information be maintained?
Meaning how will it be updated, right?
How will it be modified if it needs to be modified?
You know, how will it be deleted
if we get a request for it to be deleted?
Then will the information remain internal?
And if not, is it being shared or sold?
Now, what are our compliance, our regulatory, contractual
or just ethical requirements and obligations
on that information?
And then how will that information be protected?
How will we be in compliance?
And how will we protect that information?
And those are the primary questions in that order
that we would ask in a privacy impact assessment.
Now, once we've adopted a privacy posture saying,
yep, we are committed to privacy,
or maybe we have to do this
because we have a regulatory requirement,
we issue a privacy statement.
Now a privacy statement will describe
how an organization collects, uses, shares
and protects personal information
collected from individuals.
Now, best practices
and in some cases are legal and regulatory requirements
dictate that whenever personal information
is being collected
there should be a corresponding privacy statement.
And the statement should indicate a mechanism for opting out
as well as for reporting real
or perceived breach of privacy.
That my friends, brings us to a three second challenge.
Five challenge questions, three seconds each.
Let's do it.
The role charge with ensuring
that an organization is following privacy regulations.
1, 2, 3.
That's a DPO, a data protection officer.
Number two, decision making tool
used to identify and mitigate privacy risks
at the beginning of and throughout the lifecycle
of a program or system.
Those are those questions that we asked.
1, 2, 3.
That's a privacy impact assessment,
we can use at the beginning of
or throughout the lifecycle of a program or a system.
Number three, limiting data collection
to only what's required to fulfill a specific purpose.
1, 2, 3.
That's gonna be data minimization.
Number four, replacing the original data
with an unrelated value of the same length and format.
That's one of our data protection techniques.
It is what?
1, 2, 3.
Tokenization.
And lastly, number five, public notice that describes
what information may be collected and how it'll be used.
1, 2, 3.
That's a privacy statement,
sometimes referred to as a privacy notice.
All right, let's talk about privacy collection
and processing in our Security-in-Action.
Your employer, Space Rockets,
has signed a contract with an HR company
to maintain payroll, benefits, tax filing,
and employee drug testing.
And outside lab provides the drug test results
and is required to keep the results confidential.
The employees enter their time
onto an online portal provided by the HR company,
and the HR company processes and stores the employee data.
For compliance purposes,
you have been asked to identify, okay, who's the data owner?
Who's the data controller or controllers?
And who is the data processor or processors?
So tell me about the privacy roles.
So we've got our company, which is Space Rockets, right?
Signed a contract with an HR company.
And that HR company is going to manage payroll, benefits,
tax filing, and employee drug testing.
Now, an outside lab provides the drug test results
and is required to keep the results confidential.
Our employees are entering the time into the portal
that's provided by HR.
The HR company processes and stores the employee's data.
And I have a lot going on here.
Put me on pause and figure out who are the data owners,
who's the data controller, and who is the data processor?
Space Rockets is the data owner and the data controller.
Ultimately, they are responsible for that information,
and they are making the decisions
on how that data is gonna be used
and who else might work on that data.
The data owner is responsible for protecting the data
in compliance with all applicable regulations.
And the data controller determines the purposes for which
and the means by which personal data is gonna be processed.
So what about the HR company and the outside lab?
Those are both data processors.
The data processor is going to process that personal data
on behalf of the controller.
So Space Rockets was our data owner and data controller,
the HR company and the outside lab
will be considered data processors.
So understanding privacy roles,
that my friends is Security-in-Action.
There's your word cloud.
There's a lot here.
Again, make sure you understand
that you know all about it, right?
You can speak to all of these confidently and comfortably.
If not, go back into the lesson.
It was a long lesson.
There was a lot there.
And when you're ready, come on over
I got a quiz waiting for you.