-: One of the largest privacy concerns
inside most organizations today
is how you're going to collect, process and store PII,
known as personally identifiable information.
Now, whether this data is on your employees
or your customers, if you're collecting and using this type
of data, it is your corporate responsibility
to provide adequate protections for it.
Your policy should address, at a minimum,
what PII can be shared, with whom it can be shared,
how you're going to transmit and exchange this type of data,
how you're going to maintain the confidentiality of it
and how the owner of that information can opt out
of collection, if they desire.
Now, the first step in protecting PII
is to understand what constitutes this class of information.
If a piece of data can be used either by itself
or in combination with some other piece of data
to identify a singular person, then it's considered PII.
Now, what are some examples of PII?
Well, this is things like your full name,
your driver's license number, you social security number,
your date of birth, your place of birth,
digital versions of your biometric features
like your fingerprints or your retina scans,
financial account numbers, your addresses,
your email addresses and even your social media usernames.
Now, different countries and different governments
are going to hold companies to different levels of protection
and you're going to be able to classify
what constitutes PII based on those different regulations.
Therefore, it's important to check with your legal team
during the development of your security policies
to ensure you're meeting any legislative
or due care requirements that are associated
with personal information.
This includes ensuring that you're meeting any local,
state, national or even international laws
that are regarding the protection
of this type of sensitive data
and this data is going to be about your employees,
your customers or any other person
who interacts with your information systems.
Now, do you need to be an expert in all
of the various laws and regulations and standards
that may apply to your organization?
Well, of course not.
You're in IT, you're not a lawyer.
But, you should be able to at least associate the name
of a particular law with its stated intent.
And these laws were all designed to help protect
against the disclosure of data
including personal identifiable information
and protected health information.
The first one is Federal Privacy Act of 1974.
This affects any U.S. government computer system
that collects, stores, uses
or disseminates personally identifiable information.
If you work for the government or one of its contractors,
then this law is going to apply to your organization.
The second regulation you need to know is called HIPAA.
HIPAA is the Health Insurance Portability
and Accountability Act and it affects health care providers,
facilities, insurance companies
and other medical data clearinghouses.
If your organization is processing or storing medical data,
you're likely going to be affected by HIPAA.
It's enforced by the Department of Health and Human Services
in the United States and it provides you
with the standards and procedures that have to be used,
at a minimum, for storing, using
and transmitting medical information and healthcare data.
The third law you should know is Sarbanes-Oxley
or SOX, as it's also known.
This was originally enacted by Congress back in 2002
as the Public Company Accounting Reform
and Investor Protection Act of 2002,
but you're almost always going to hear it referred to
as SOX or Sarbanes-Oxley.
If your organization is a publicly traded U.S. corporation,
it's affected by this regulation
and it has to follow certain accounting methods
and financial reporting requirements.
Now, the important thing to keep in mind with Sarbanes-Oxley
is that if you fail to follow it,
your senior leadership, like your CEO,
can actually receive jail time for it.
So, Sarbanes-Oxley is a big deal
and all of those accounting methods and financial reporting,
that's all data that's being stored on your IT systems,
so you're going to get involved with this
as an IT professional.
The next regulation we're going to talk about
is known as GLBA or the Gramm-Leach-Bliley Act of 1999.
Now, this affects banks, mortgage companies, loan offices,
insurance companies, investment companies
and credit card providers.
Basically, if you work for a financial institution,
this is going to affect you.
GLBA directly affects the security
of personal identifiable information
and it prohibits sharing of financial information
with any third parties and it also provides guidelines
for securing that financial information.
Another law that affects you if you're working
for the federal government
is the Federal Information System Security Management Act
of 2002, also known as FISMA.
Now, FISMA requires each agency in the government
to develop, document and implement
an agency-wide information systems security program
to help protect their data.
Basically, FISMA is all about cyber security.
The goal here is to create more secure networks
across the entire U.S. government.
Now, the final thing we're going to talk about here
is a standard, not an actual law or regulation.
But it's one that affects you
if you take credit card payments.
It's known as PCI DSS
or the Payment Card Industry Data Security Standard.
This is an agreement that any organization
who collects, stores or processes credit card information
for a customer has to follow.
Again, this isn't a law or regulation,
but it is a contractual obligation or agreement
and it's a standard that must be followed
if your organization wants to be able
to handle credit card transactions.
To prove compliance with this, you have to make sure
your organization receives an external audit
at least annually.
Now, another federal law that you should know about
is known as HAVA,
which is the Help America Vote Act of 2002, or HAVA.
Now, it was designed
to help replace the old punch card systems back
in the voting machines that we used
and it provides regulations that govern the security,
confidentiality and integrity of the personal information
that's collected, stored or processed
during the election cycle and the voting process.
Now, the last law we're going to talk about
is actually a California law, so it only affects businesses
that operate in California as a California corporation.
Now, why are we covering it then?
Because this doesn't even apply to my company.
Well, it's because a lot of IT companies out there
do business in California or they're based out there
and this makes them a California business under this law.
This law is called the SB 1386, which is the number
that was assigned to this regulation.
Now, it was created in 2003
and requires any California business
that stores computerized personal information
to immediately disclose any breach of security
that it becomes aware of.
So, let's consider the example of Facebook,
which is a California business.
Now, if Facebook got hacked,
your personal information could be disclosed.
And if that happens, Facebook has to notify you,
the consumer, immediately about their data breach.