Security Featured Article

The Intersection of Privacy, Confidentiality and Personal Data Protection

By Kevin G. Coleman, Certified Management Consultant and Strategic Advisor with the Technolytics Institute

This week is starting out on a very interesting note that focuses on protecting sensitive personal information. I was brought into a conversation and asked my opinion on a somewhat offbeat legal issue. I was asked if an individual or organization could be held accountable for using / disclosing sensitive personal information of another person. This caused my eyebrows to rise and really tweaked my interests. 

 

First of all, we need to encapsulate sensitive personal information that is restricted/protected. I began to look at sensitive personal information or data that is not typically thought of or put into the same context as what we commonly think of as protected data like – full names, social security numbers, birth dates and so on. The following is not an all inclusive list of data that has been defined as sensitive personal information and therefore protected.

 

Restricted Sensitive Personal Data:

 

Employment records;

Military ID and record;

Driver’s license numbers;

Protected health information;

Confidential resume information;

Educational information and records;

Garnishments, tax levies, wage assignments;

Digital signatures (ink signatures that have been digitized);

Beneficiaries, retirement account allocations and investments;

General personal information such as date of birth and mother’s maiden name, etc.;

Unique biometric data, including fingerprint, voice print, retina or iris image or any other unique physical representation;

Passwords, security codes, access codes, biometric codes, personal identification numbers, and other unique account identifiers;

Proprietary computer applications or source code to which someone or organization holds a license that restricts further or public distribution;

Trade secrets or other proprietary business information owned by a third party and provided and protected under the promise of confidentiality; and

Research, testing, or training done for financial benefit or in connection with a potential investment or development or transfer of technology.

 

All too often confidential information has been maliciously disclosed and it appears now that those harmed are seeking legal and financial recourse. This is a significant game changing movement. Everyone needs to examine the data they collect, store and use to determine their exposure. Given the implications this type of litigation could have, I will be updating all of you as this progresses.

Kevin G. Coleman, a consultant and advisor with Technolytics Institute, writes the Data Security column for TMCnet. To read more articles by Kevin, please visit his columnist page.

Edited by Erin Harrison