Securing your data involves understanding data privacy regulations and the principles behind those rules

by Graham Williamson

Editor’s note: This chapter is excerpted from chapter 11 of  Identity Management: A Business Perspective (MC Press, 2017).

Identity management has a direct impact on the security of identity data and regulatory controls over the collection, storage, and usage of identity information.

As we become more connected, organizations, both commercial and public sector, will increasingly store more data about us. This will be driven by the desire of companies to understand us so that they can sell us more products and services, and by governments that want to leverage their identity information to adopt a “digital first” strategy for providing services. As these organizations extend their data repositories, the general public expects this data to be adequately managed to protect their privacy. However, members of the public are becoming increasingly scared because they know systems are vulnerable and they doubt the capability of organizations, particularly government, to adequately protect it.

Organizations can therefore expect more, not less, regulation. Rather than resist this, we need to embrace it, plan for it, and deploy systems that are compliant. As with most regulatory issues, this needs to be done this before it has to be done.

Regulation Summary

The major regulations that affect data security are as follows:

PCI

The payment card industry (PCI) provides guidelines on the correct treatment of information such as credit card details and provides an auditable standard. It is most important that, as e-commerce continues to grow, organizations safeguard their credit card information handling to avoid revenue loss from repudiated transactions and violation penalties. Payment gateways must adhere to PCI guidelines and submit to periodic audits.

HIPAA

The purpose of the US Health Insurance Portability and Accountability Act (HIPAA) is to protect health information. While the main focus of health information protection has been embodied in personal health record controls, HIPAA goes beyond that to set regulation for security controls that manage access to protected health information. It stipulates how hospitals and health centers should ensure protection of sensitive data.

SOX

The Sarbanes-Oxley Act (SOX) in the US does not directly impinge on data privacy. It does seek to regulate, and provide useful guidelines for, corporate governance, including auditor independence and the need to disclose data loss that has detrimental effects.

FERPA

The Family Education Rights and Privacy Act (FERPA) seeks to manage public schools and colleges in the US and provides a framework for any educational jurisdiction to follow in the collection and management of student education records.

GLBA

The Gramm-Leach Bliley Act (GLBA) forms part of privacy regulation in the US and provides guidelines for the control of personal information, particularly in the financial industry. Banks, insurance, and wealth management companies are covered by the GLBA, which requires them to implement safeguards in regard to client personal information.

Privacy and Data Protection

Some countries have focused legislation specifically on privacy of sensitive data, while others have addressed privacy in the wider context of data protection.

Definition

The concept of privacy is quite broad. We all think we know what it means, but there are many viewpoints as to how best to define it. Although there are dictionary definitions of what it is, it is more meaningful to define what it means:

Privacy is the desire of individuals to control, or influence, the collection, usage, and disclosure of data about themselves.

The following terms are related to privacy, and need definition in their own right:

• Confidentiality—seeks to control the release of identity data
• Secrecy—is the intentional concealment of identity data
• Anonymity—is the ability to conceal identity data

Privacy is largely a Western construct, and even among the developed countries there is wide divergence on the desire for privacy and toleration of its violation. In many Western European countries, particularly those that have experienced occupation during wartime, the desire for privacy is tempered by the desire for efficiency of government services. In other countries such as the US and the UK, there is a skepticism of government and its ability to keep identity information private. In these geographies, privacy is highly regarded, and efficiency of government services will typically be subjugated to privacy protection.

Principles

Most privacy legislation has at its core certain principles that, if followed, will keep user information private and avoid contravention of privacy legislation, with its attendant costs. Table 1 lists these principles.

Table 1: Privacy principles

While an initial reaction might be that these requirements are onerous, they do in fact make good sense. Organizations are well advised to adopt these principles and avoid the cost and embarrassment of data loss that might otherwise occur.