Data privacy is broadly considered to be the concept that personal information should not be shared without permission. When a data privacy rule is in place, individuals determine when, how, and to what extent their personal information can be shared.
Personal information encompasses a wide range of data, including a person’s name, address, phone number, email, Social Security Number, financial information, health or school records, and details related to their behavior and activities they engage in and any details related to their behavior.
Definition of data privacy
Data privacy, sometimes also referred to as information privacy, is a subset of data protection that focuses on maintaining the confidentiality, integrity, and accuracy of personal data as well as data that organizations depend on to operate (e.g., trade secrets, sales and marketing plans, and financial information). In practice, most work related to data privacy is driven by data privacy compliance requirements set forth by organizations and governments, such as those outlined below.
Data privacy processes and programs keep personal and sensitive information safe from:
- Alteration
- Improper access
- Loss
- Theft
The discipline of data privacy is comprised of a variety of elements, including:
- Data governance—provides standards and practices that direct how personal and sensitive information is collected, stored, secured, accessed, and used
- Legal frameworks—created by various entities and enforced with data privacy laws
- Policies—put in place by organizations to ensure that data privacy requirements are met for information that they collect, store, and process
- Practices—established best practices that guide how IT infrastructure and data security systems are implemented and used
- Third-party management protocols—used to direct how third-party organizations (e.g., vendors, service providers, and contractors) handle personal and sensitive information
Why data privacy is important
Aside from being a legal requirement, there are many reasons that data privacy is important, including the following.
Lowers data storage expenses
A key part of data privacy is data minimization and erasure. When data is no longer needed, it is eliminated, which reduces the operational burden and expense of storing it.
Prevents identity theft
It only takes a few key pieces of personal information to commit identity theft. The data protection systems and processes that accompany data privacy help minimize the risk of identity theft.
Mitigates misuse of personal and sensitive information
Without data privacy protections, personal and sensitive information can be misused, such as:
- Criminals can use personal data to commit thefts in a variety of ways (e.g., withdraw funds from bank accounts, use credit cards, or commit identity theft)
- Individuals’ activities can be tracked and monitored without their consent
- Personal data can be sold to third parties and advertisers without users’ consent, resulting in unwanted solicitations and marketing messages
Protects consumer and brand reputations
Data privacy is among the consumer protections that individuals expect. Policies, programs, and processes to support data privacy ensure this important consumer protection is in place. This also bolsters brand reputations by showing a commitment to taking individuals’ rights to privacy seriously.
Reduces the efficacy and impact of data breaches
The data protections that come with data privacy help prevent a data breach from happening, and if it is successful, information cannot be accessed.
Support business operations
When information is used within the confines of data privacy rules, businesses can leverage it in a number of positive ways, such as:
- Gain insights from data sets based on customers’ and prospective customers’ demographics and behaviors
- Identifying potential customers
- Understand customers’ needs and provide goods and services to meet them
- Use individuals’ information to train machine learning (ML) and artificial intelligence (AI) systems
Underpins the data economy
Data privacy assurances are critical for organizations that depend on collecting, sharing, and using data about customers or users. Many applications, social media platforms, and websites need to collect and store personal data about users to provide services.
Laws that govern data privacy
United States data privacy laws
Federal data privacy laws include:
- Health Insurance Portability and Accountability Act (HIPAA)—governs how personal healthcare data must be handled.
- Children’s Online Privacy Protection Act (COPPA)—restricts what information websites can collect from children under 13.
- Electronic Communications Privacy Act (ECPA)—extends government restrictions on wiretaps to include other electronic data.
- Video Privacy Protection Act (VPPA)—prevents unauthorized disclosure of personal information derived from the rental or purchase of audiovisual content.
- Gramm-Leach-Bliley Act (GLBA)—mandates how financial institutions handle individual’s personal information.
- Fair Credit Reporting Act (FCRA)—regulates the collection and use of individuals’ credit-related information.
- Federal Trade Commission (FTC) Act—includes provisions for the enforcement of data privacy laws.
- Family Educational Rights and Privacy Act (FERPA)—restricts access to educational information and records.
Several states have enacted data privacy laws, including:
- California Consumer Privacy Act (CCPA)
- California Privacy Rights Act (CPRA)
- Colorado Privacy Act (CPA)
- New York SHIELD Act
- Utah Consumer Privacy Act (UCPA)
- Virginia’s Consumer Data Protection Act (VCDPA)
International data privacy laws
Most countries have enacted data privacy laws. Examples of these laws include:
- General Data Protection Regulation (GDPR)
- Personal Information Protection Electronic Documents Act (PIPEDA)
- Personal Data Protection Act (PDPA)
- The Privacy Act of 1974
- Lei Geral de Proteção de Dados (LGPD)
- Personal Information Protection Law (PIPL)
- Protection of Personal Information Act (PoPIA)
What are fair information practices?
Many data privacy rules and laws are based on the principles and practices outlined in the Fair Information Practices adopted by the Organization for Economic Cooperation and Development (OECD) in its Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.
This international organization’s practices provide guidelines for data collection and usage. The eight principles that make up the Fair Information Practices are as follows.
- Accountability
A data controller should be accountable for complying with measures that affect the Fair Information Practices principles. - Collection limitation
There should be limits to the collection of personal data, and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject. - Data quality
Personal data should be relevant to the purposes for which they are to be used and, to the extent necessary for those purposes, should be accurate, complete, and kept up-to-date. - Individual participation
An individual should have the right:- To obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him;
- To have communicated to them data relating to him within a reasonable time, at a charge, if any, that is not excessive; in a reasonable manner, and in a form that is readily intelligible to him;
- To be given reasons if a request made under subparagraphs (a) and (b) is denied, and to be able to challenge such denial; and
- To challenge data relating to him and, if the challenge is successful, to have the data erased, rectified, completed, or amended.
- Openness
There should be a general policy of openness about developments, practices, and policies with respect to personal data. Means should be readily available to establish the existence and nature of personal data, the main purposes of their use, and the identity and usual residence of the data controller. - Purpose specification
The purposes for which personal data are collected should be specified not later than at the time of data collection, and the subsequent use is limited to the fulfillment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose. - Security safeguards
Reasonable security safeguards should protect personal data against such risks as loss or unauthorized access, destruction, use, modification, or disclosure of data. - Use limitation
Personal data should not be disclosed, made available, or otherwise used for purposes other than those specified in accordance with the Purpose Specification Principle except with the consent of the data subject or by the authority of law.
Data privacy challenges for the enterprise
Despite the many tools available, data privacy remains a challenge. Among the issues that enterprises must address concerning meeting data privacy requirements are:
- Complex web of data privacy rules and regulations
- Difficulty determining which data should be retained and which data should be eliminated
- Lack of control over third-party data sharing
- Poor visibility into sprawling data stores and devices
- Unwieldy volumes of data
Technologies that support data privacy
Many technology solutions are available to support data privacy initiatives, including:
- Anti-virus and anti-malware software
- Automated data discovery, mapping, and classification tools
- Data loss prevention (DLP)
- Device management and mobile device management solutions
- Encryption solutions, such as symmetric encryption, asymmetric encryption, and end-to-end encryption
- Endpoint protection systems
- Firewalls
- Identity and access management
- Multi-factor authentication, role-based access controls, and privileged access management
- Intrusion detection and prevention solutions
Data privacy matters
Data privacy is considered a human right by most governments. Beyond compliance requirements, organizations need to protect data privacy to meet the expectations of the individuals who engage with them.
You might also be interested in:
Unleash the power of unified identity security.
Centralized control. Enterprise scale.