Defining Data Privacy

• Data Privacy. Data privacy remains a major issue for CIOs, customers and governments are continuing to strengthen laws to protect this privacy

“Data privacy.” What is an otherwise commonplace term becomes complicated when we ask the question: what is data privacy exactly? Furthermore, what does it mean to protect your data in a technological landscape where regulations and user agreements have made it virtually impossible to know just what data belongs to whom? The term data privacy has a multiplicity of meanings, and in this article, we will address the most common of these. 

A mistake that many organizations and users make is viewing privacy as a singular concept. Instead, the term is a bit of a catch-all to describe an entire discipline used to establish and maintain required privacy compliance. As such, data privacy is the combination of the following six elements:

1. Current Legislation

Given major cultural shifts around technology, governments are still not where they want to be in terms of regulations and compliance. This means that more laws are being considered to protect users and regulate organizations, so it’s important to stay ahead.

2. Established Policies

All organizations have their own established legal policies to explicitly outline what data is collected and how it can be utilized. This can also take the form of a user agreement that must be signed prior to downloading or engaging with an application.

3. Best Practices

This refers to the general normative practices that guide IT infrastructure as well as data privacy. Examples of best practices include encrypting data, installing anti-malware on your systems, backing up your data and conducting risk assessments.

4. Compliance with Third-Parties

With the increasing usage of third-party applications (e.g., SaaS or PaaS), it is important for users and organizations to understand the established policies these third-party providers operate from. This becomes especially important when considering the rapid propagation of cloud service providers.

5. Data Governance

At first glance, data governance appears to work to similar aims as established practices. However, data governance is better understood as a more foundational aspect to data privacy, as it functions as the system by which members of an organization understand who has the authority to view and utilize particular data assets. 

6. Global Regulations

Current legislation becomes even more intricate when your organization begins operating in another country. One example of such a global regulation is The General Data Protection Regulation (GDPR) adopted by the European Union to oversee how personal data is utilized by every organization operating within its borders.

There are real stakes to data privacy and each of these six elements. And those stakes come with a price if not observed and followed. For example, we have recently seen how Instagram’s parent company, Meta, was fined €405m for violating user privacy by Irish regulators by having broken the GDPR. This penalty came after a two-year investigation into an aspect of Instagram’s data policy. The policy in question allowed users aged between 13 and 17 to show their phone numbers and email addresses when operating business accounts on the platform. The Data Protection Commission (DPC) also found that the platform was operating with a user registration system that set the accounts of these same teenagers to “public” by default. What this fine demonstrates is that even organizations like Meta are not immune.

By comparison, data privacy in the United States is still rather vacuous and undefined. However, that might be changing with the potential passage of The American Data Privacy and Protection Act. Having passed out of the House Energy and Commerce Committee with bipartisan support, this bill would redefine American legal conceptions of sensitive data to include income level, calendar information and voicemails. It would also include a duty of data minimization on covered entities (although there are exceptions to this rule). Finally, it would preempt all current state privacy laws. Meaning that, if this bill is passed by the Senate and signed by President Biden, your organization will need to shift its data privacy, so this is a development worth monitoring.

Ready to learn more? Contact us today to get started.