Jason: Legal Requirements.
In this lesson, we're going to talk about
some of the legal requirements around privacy.
Now, any type of information or asset needs to consider
how a compromise of that information can threaten
the three core security attributes of the CIA triad:
confidentiality, integrity, and availability.
And I mention this a lot in my courses,
but if you're thinking about CIA,
I like to think about confidentiality
usually has to do with encryption,
integrity usually has to do something with hashing,
and availability usually has to do
something with redundancy.
And so if you keep those three key words in mind,
it'll help you figure out what the right answer is
when you're dealing with CIA triad
and things associated with it.
Now, what we're going to really focus on in this lesson
is the difference between privacy and security.
Now, when we talk about security controls,
there is that focus on CIA attributes
of the processing system.
So if I say this data is encrypted,
well, that is a security control.
That's confidentiality.
If I say this data has been hashed
so I have a digital fingerprint of it,
that tells me we have integrity of it,
but that's all security,
that doesn't tell me whether or not that data is private,
if it's being kept private from other people.
And so that's something we have to think about.
When we talk about privacy,
we're really talking about a data governance requirement
that arises when you're collecting and processing
personal data to ensure the rights of the subject's data.
So if I collect information from you
when you sign up for my course,
I get your name, your email,
maybe your credit card information,
I have to keep that information private.
It doesn't necessarily mean that I have to have it encrypted
in my database, although we do that,
we just have to make sure that nobody else can get that data
who doesn't have a need to know inside our organization.
That's the idea of privacy.
Now, one of the things that I think is unique
is the way privacy is seen across the globe.
Depending on where you are and where you live,
privacy is either a bigger or less deal to you.
For instance, when you go to a website
and you look at the privacy policy,
do you actually read through all of the pages of legalese
to figure out what they're saying they can do
with your private information?
Most people don't, but if you're in some place like Europe,
they take privacy much more seriously,
and they have things like the right to be forgotten
and they have GDPR which says that you have to write
your privacy policy in a very clear
and easy to understand method,
not legalese like we do here in the States.
So even just the difference between European countries
and the United States has a big difference
in the way we view privacy.
Now, because of the cultural differences
and the cultural pressure that's been applied,
there are different legal requirements in different areas.
There are legal requirements that will affect
your corporate governance and policies
in regards to privacy of your user's data.
As a company that works worldwide with people,
we have students all over the world,
we have to be aware of that
and so we keep in mind what the legal requirements are
in the different areas we're operating in.
Now, one of the biggest requirements
and one of the best requirements
in terms of privacy is GDPR.
This is the General Data Protection Regulation.
And this says that personal data
cannot be collected, processed, or retained
without the individual's informed consent.
Now, when I talk about informed consent,
this means that the data must be collected and processed
only for the stated purpose
and that purpose must be clearly described to the user
in plain language, not legalese.
So if you go to a website and they say
give us your name, your email, and your home address
so that we can sell you this product
and then deliver it to your house,
that's the stated purpose.
That doesn't mean that they can now send you mailers
every single week to your home address
to try and get you to buy more stuff
unless that was part of their privacy policy
that you accepted.
So GDPR says they have to be up front with this.
Now, GDPR also provides the right for a user
to withdraw consent at any time.
It also gives them the ability to inspect, amend,
or erase data that's held about them.
We like to call this the right to be forgotten.
If you're a resident and citizen of the European Union,
you can call up the company or fill out their form and say,
I want you to forget everything you've ever known about me
and they have to go into their database
and scrub you out of it.
That is part of that law.
It gives you a lot of protections
if you're a European citizen.
Now, if you're an American citizen,
we don't have that right.
So if I'm sitting in Maryland
and I want to be forgotten, I can't do it.
That's just not something
that the companies have to do for me.
I can request they do that,
but they are not by law required to do it.
So there are different protections
depending on where you live in the world.
And as a company operating in different areas,
you need to be aware of this.
Now, what happens if you have a data breach?
Well, this depends again where you are
and what laws you fall under.
For instance, if you deal with GDPR,
you have responsibilities.
Within 72 hours, if you're doing business within Europe,
you have to notify the regulators and the users
that you had a data breach.
So once again, this is an area where the European citizens
have better rights than the Americans do
based on the laws that are in each of those countries
at the time of this filming.
Now, let me give you a quick word of warning.
Data breaches can happen both accidentally
and through malicious interference.
Just because you had a data breach
doesn't mean that some hacker got in.
It could have been a system administrator
did the wrong thing.
They entered the wrong command in the database
and they dumped it to the screen
and now people are able to see
everybody's social security numbers
or their dates of birth or their names.
This is all types of things that have happened in the past.
So just keep that in mind.
It's not always a malicious actor.
It's not always a hacker.
Sometimes it's our own internal staff who makes mistakes.
Now, I've mentioned GDPR a couple of times here
already in this lesson,
but I want you to remember when I'm talking about GDPR,
I'm talking about a law inside of Europe
and GDPR does provide stronger protections
than most federal or state laws in the United States.
Most of the laws here in the United States
are very industry-specific or state-specific.
So we might have laws that affect the financial industry
or the healthcare industry,
but we don't have ones that protect all of our citizens
all of the time.