5.4 privacy

Question 1

Privacy legal implications

Answer 1

• A constantly evolving set of guidelines– We’re all concerned about privacy
• Local/regional– State and local governments set privacy limits– Legal information, vehicle registration details,
  medical licensing
• National– Privacy laws for everyone in a country– HIPAA, online privacy for children under 13, etc.
• Global - Many countries are working together for privacy

Question 2

GDPR - General Data Protection Regulation

Answer 2

• European Union regulation– Data protection and privacy for individuals in the EU– Name, address, photo, email address, bank details,
  posts on social networking websites, medical
  information, a computer’s IP address, etc.
• Controls export of personal data– Users can decide where their data goes– Can request removal of data from search engines
• Gives “data subjects” control of their personal data– A right to be forgotten

Question 3

Data subject

Answer 3

• Any information relating to an identified or identifiable
  natural person– An individual with personal data
• This includes everyone– Name, ID number, address information, genetic
  makeup, physical characteristics, location data, etc.– You are the data subject
• Laws and regulations– Privacy is ideally defined from the perspective of the data subject

Question 4

Data responsibilities

Answer 4

• High-level data relationships– Organizational responsibilities, not always technical
• Data owner– Accountable for specific data, often a senior officer– VP of Sales owns the customer relationship data– Treasurer owns the financial information

Question 5

Data Roles

Answer 5

• Data controller– Manages the purposes and means by which personal
  data is processed
• Data processor– Processes data on behalf of the data controller– Often a third-party or different group
• Payroll controller and processor– Payroll department (data controller) defines payroll
  amounts and timeframes– Payroll company (data processor) processes payroll and stores employee information

Question 6

Data inventory and retention

Answer 6

• What data does your organization store?– You should document your data inventory
• Data inventory– A listing of all managed data– Owner, update frequency, format of the data
• Internal use– Project collaboration, IT security, data quality checks
• External use– Select data to share publicly– Follow existing laws and regulations