Privacy & Regulatory Frameworks

Basics

Privacy = personal information handling. Controller decides; processor acts on its behalf. Privacy by design.

Privacy Management Framework (9 components)

Management · notice and agreement · collection · use, retention, disposal · access · disclosure to third parties · security · quality · monitoring and enforcement.

Laws

• General Data Protection Regulation (GDPR): lawful basis, rights incl. erasure, 72-hour breach notice, fines up to 4% of turnover.
• California Consumer Privacy Act (CCPA): know, delete, correct, opt out of sale or sharing.
• Health Insurance Portability and Accountability Act (HIPAA): health information; Privacy, Security, Breach Rules.
• Gramm-Leach-Bliley Act (GLBA): financial institutions (incl. tax preparers); Safeguards Rule.
• Payment Card Industry Data Security Standard (PCI DSS) 4.0: card data, 12 requirements, contractual.

Techniques

Minimization · anonymization (irreversible, not personal data) · pseudonymization (reversible, still personal) · tokenization · masking · encryption.

Exam traps

• GDPR also applies to organizations outside the European Union that offer goods or services to, or monitor, people in it.
• Consent is only one lawful basis under GDPR; others include contract, legal obligation and legitimate interests.
• Tax preparers are financial institutions under GLBA, so the Safeguards Rule requires a written information security program.