Protect Privacy to Secure Assets
The concept of privacy is closely related to confidentiality, but is more specifically focused on preventing the unauthorized use or disclosure of personal data. Personal data, commonly referred to as personally identifiable information (PII) may include
- Contact information
- Social Security Number
- Financial account number
- Birthdate and birthplace
- Marital status
- Sexual orientation or lifestyle
- Credit history and other financial information
- Criminal records
- Employment records and history
- Health records and medical data (known as protected health information, or PHI; known as electronic protected health information, or ePHI, when in electronic form)
- Religious preference
- Political affiliation
- Other unique personal characteristics or traits
As with any other sensitive data, organizations must assign data owners and custodians (or processors) who are ultimately responsible for safeguarding personal data, and for the secure collection, processing, and use of the data. Anyone within an organization that has access to personal data in any capacity must be thoroughly familiar with established procedures for collecting, handling, and safeguarding such information throughout its entire lifecycle. This includes retention and destruction of private data, and technical issues such as data remanence.
Data remanence refers to residual data that remains on storage media or in memory after a file or data has been deleted or erased. Data remanence occurs because standard delete routines only mark “deleted” data as storage or memory space that is available to be overwritten. To completely eliminate data remanence, the storage media must be properly wiped, degaussed, encrypted, or physically (and completely) destroyed. Object reuse refers to an object (such as memory space in a program, or a storage block on media) that may present a risk of data remanence if it is not properly cleared.
Many privacy protection laws and regulations exist at regional (such as the European Union), country (or federal), state, and local levels throughout the world, as well as in various industries. Privacy protection laws are among some of the most rigorous laws enacted and legal requirements vary greatly. These laws also commonly limit the collection, use and retention of personal data, as well as trans-border information flows (or export) of personal data.
Finally, within an organization, certain employee privacy issues often arise regarding employee rights with respect to monitoring, search, drug testing, and other policies.
Monitoring commonly occurs in many forms within an organization including Internet, email, and general computer usage, as well as through surveillance cameras, access badges or keys, and time clocks, among others. Mandatory and random drug testing and searches of desks, lockers, work areas, and even personally-owned vehicles are other common policies that can evoke employee privacy concerns.
To reduce or eliminate employee privacy concerns, organizational policies should clearly define (and require written acknowledgement of) acceptable use policies (AUPs) for computer, Internet, and email usage. Additional policies should explain monitoring purposes, acceptable use or behavior, and potential disciplinary actions as a result of violations. Finally, organizational policies should clearly state that the employee has no expectation of privacy with regard to the organization’s monitoring and search policies.