Confidentiality
Raisa Kanevsky
95-841: Info Assurance Policy
March 26, 2007
Data Privacy
Universal Declaration of Human Rights
states that:
"No one shall be subjected to arbitrary
interference with his privacy, family, or
correspondence, nor to attacks upon
his honor or reputation. Everyone has
the right to the protection of law
against such interference or attacks."
Privacy Issues
Privacy concerns arise when uniquely
identifiable data relating to a person is
collected and stored including:
Health Information
Criminal Justice
Financial Information
Genetic Information
Location Information
U.S. Privacy Law
Information privacy laws cover the protection of
information on private individuals from intentional or
unintentional disclosure or misuse.
Data privacy is not highly legislated or regulated in
the U.S.
No all-encompassing law regulating the use of
personal data.
Major legislation includes Children's Online Privacy
Protection Act and HIPPA.
Privacy often conflicts with the First Amendment.
Few states recognize an individual's right to privacy.
California Online Privacy Protection Act (OPPA)
requires operators of commercial web sites that
collect personal information to post a privacy policy
on the site.
ECPA
Electronic Communications Privacy Act of 1986 was
enacted by the U.S. Congress to extend government
restrictions on wire taps from telephone calls to
include transmissions of electronic data by computer.
Title I of ECPA protects electronic communications
while in transit.
Title II of the ECPA, the Stored Communications Act
(SCA) protects messages stored on computers, but
its protections are weaker than the ECPA's.
Title III prohibits the use of pen register and/or trap
and trace devices to record dialing, routing,
addressing, and signaling information used in the
process of transmitting wire or electronic
communications.
ECPA (continued)
"Interception" means real-time
interception, including a tap on a
computer line and monitoring what is
passed across the network.
“Disclose" means passing the contents
of the message on to someone other
than the one intended to receive the
message.
HIPPA
Health Insurance Portability and
Accountability Act (HIPPA) was enacted by
the US Congress in 1996.
HIPPA states that an individual who is
subject of identifiable health information
should have:
Established procedures for the exercise of
individual health information privacy rights.
The use and disclosure of individual health
information should be authorized or required.
P3P
Platform for Privacy Preferences
Developed by World Wide Web (W3C)
Consortium.
Standard for communicating privacy
practices and comparing them to the
preferences of individuals.
Patriot Act
Dramatically expanded the authority of
American law enforcement for the stated
purpose of fighting terrorism in the United
States and abroad.
It has also been used to detect and
prosecute other alleged potential crimes,
such as providing false information on
terrorism.
Federal courts have ruled that some
provisions are unconstitutional infringements
on civil liberties.
Sarbanes-Oxley
Ensures the completeness and validity of
financial reporting.
Covers issues such as auditor independence,
corporate governance and enhanced financial
disclosure.
Auditing processes and schedules “should be
developed to address the high-risk areas
within the IT organization. IT personnel
should perform frequent internal audits. In
addition, personnel from outside the IT
organization should perform audits on a
schedule that is appropriate to the level of
risk.”
Fourth Amendment
Protects the right to privacy.
These rights of "privacy" are decided
primarily in the context of criminal
cases, where the court must weigh the
interests of society against the interests
of an alleged criminal.
New implications as technology
improves.
European Union
The right to data privacy is heavily regulated and
rigidly enforced in Europe.
Article 8 of the European Convention on Human
Right (ECHR) provides a right to respect for one's
"private and family life, his home and his
correspondence."
Broad interpretation - collection of information
about an individual without his consent always falls
within the scope of Article 8.
Privacy interference only acceptable if “(1)
interference is according to the law, (2) pursues a
legitimate goal, and (3) is necessary in a democratic
society.”
European Union (continued)
Anyone processing personal data must ensure
that:
Fairly and lawfully processed
Processed for limited purposes
Adequate, relevant and not excessive
Accurate
Not kept longer than necessary
Processed with the data subject's rights
Secure
Not transferred to countries without adequate
protection
European Union (continued)
Personal data covers both facts and opinions about
the individual.
Processing includes concepts of obtaining, holding,
and disclosing information.
Since E.U. privacy laws are more restrictive, the
transfer of personal information from the E.U. to the
U.S. is prohibited when equivalent privacy protection
is not in place in the U.S.
Safe harbor arrangement developed by the U.S.
Department of Commerce to enable U.S. companies
to demonstrate compliance with European
Commission directives.
Case Study: Confidentiality
Loss of confidentiality can result in loss
of public confidence and decreased
participation with the organization.
Can result in public exposure of
sensitive data and physical security
risk, including individuals of high
prominence.
May lead to loss of sponsorship (critical
to ultimate success of meetings).
Case Study Issues
Monitoring & Auditing
Access Control
Private Meetings
Voting systems
Correspondence
Enforcement
Disclosure
Disposal of information (after the Event)
Leaks (from media and other attendees)
Monitoring & Auditing
Attendees should be made aware that
the Event will enforce mechanisms for
auditing and monitoring capabilities to
ensure compliance with policy.
"Technical Control and logging
mechanisms will be required to
reconcile, enforce and monitor privacy
policy rules (and laws) as information is
shared across systems to ensure
accountability for information use."
Access Control
Access to resources shall be restricted
to what is strictly required in
accordance with an individual’s
responsibilities for the Event, as
permitted by policy.
Private Meetings
Mechanisms shall be in place to ensure
that attendees have explicit
authorization for attendance and
appropriate clearances. Attendees of
private meetings shall be made aware
of disclosure and confidentiality
requirements.
Voting systems
Compromise of confidentiality (or
integrity) of Voting Systems may result
in loss of trust in decisions made at the
event.
Mechanisms must be in place to ensure
the confidentiality and integrity of
Voting Systems.
Correspondence
All correspondence regarding
individuals and the Event should be in
compliance with policy. Any
unauthorized disclosure about the
event is strictly prohibited and may
result in termination of privileges or
expulsion from the Event.
Whenever possible, encryption should
be implemented to ensure the
confidentiality of information.
Enforcement
All efforts must be made to ensure
compliance with Event policy and
legislation. The [responsible entity]
shall ensure that all requirements for
compliance with information assurance
and confidentiality are met and shall
delegate any enforcement procedures
to local, regional, or federal law
enforcement, if necessary.
Accuracy
All information regarding the Event and
participants must be accurate and up to
date.
Legal Requirements
All handling, collection, and use of
personal data must be in accordance
with federal, regional, and local law. In
addition, information collected about
individuals attending the event must be
adequate, relevant, and not excessive.
Disclosure
Personal data collected about an
individual cannot be disclosed to other
organizations unless authorized by law
or by consent of the individual.
Personal data covers both facts and
opinions about the individual.
Processing includes concepts of
obtaining, holding, and disclosing
information.
Disposal After the Event
Data shall be used only for the
purposes for which it was collected,
and it shall be used only for a
reasonable time period. Disposal of
personal data and event information
will be conducted in a secure and
timely manner.
Financial data
All financial information must be
handled in accordance with federal,
regional, and local regulation.
Conclusion
Confidentiality has a high impact on the
success of the Event.
Loss of privacy can result in loss of
public trust or sponsorship.
Anything else?
Bibliography
www.wikipedia.com
www.infosyssec.net/infosyssec/security
/seceth1.htm
www.ala.org