Data privacy focuses on the practices of making sure that data is only used for its intended purpose. With the rise of the internet, data privacy concerns have increased as access and usage of personal data has become an integral part of many organizations. In this blogpost, we will take a look at why data privacy is important and introduce some existing data privacy laws. We will also give some useful tips for how you can improve your own data privacy –whether in private or as an organization.
What is data privacy?
Unfortunately, there is no generally accepted definition of data privacy. This is because data privacy is a very complex topic. However, it can be understood as relating to the proper handling of sensitive data. Data privacy usually focuses on personal data, meaning any information relating to an identified or an identifiable individual. This could be anything from your name and social security number to data about your location or even physical characteristics. But data privacy can also include other data such as confidential data or intellectual property. In practice, data privacy is centered around three concerns:
-
Whether or how data is shared with any third party
-
How data is collected and stored
-
Compliance with privacy laws (e.g., GDPR)
It is good to remember that data privacy is grounded in the belief that individuals have the right to be left alone and have control over:
-
How their personal data gets collected
-
How much of their personal data gets collected
-
How their personal data gets used
Just as you might not want to have anybody overhear a private conversation, many will not want to have certain information collected about them or shared with unknown third parties. It is therefore important to understand what personal data is okay to collect and who should have access to the personal data.
Why is data privacy important for your organization?
In many places, privacy is viewed as a human right and many countries nowadays treat privacy as a legal right. It was for this reason that data privacy laws were first created. Data privacy laws aim to protect the right of privacy and help individuals remain in control of their personal data.
But besides privacy being viewed as a human and legal right, most individuals also have their own expectations of how their privacy should be respected. Of course, these expectations will vary from person to person. But everyone can relate to wanting some of their personal information to stay private and not be publicly available for anyone to see. For example, this could be information relating to political views or your personal health history.
Transparency in how your organization collects and manages data and stands by your privacy policies is therefore critical for building trust with customers and making sure customer’s personal data stays safe. For instance, did you know that one of the biggest costs of a data breach for organizations is loss of business? Understandably, this is because many customers lose trust in an organization after a data breach.
How can you balance everything?
It can be challenging for organizations to balance their own desire for using personal data with having to live up to individual’s expectations of how their information should be treated. It is therefore very important for your organization to make your own acceptable use policies and actively work with data privacy to find the right balance. A good starting point for this is to consider data privacy laws.
4 Data privacy laws you should know about
In recent times, governments all over the world have passed laws that regulate what data can be collected and how it can be used, stored and shared. And it is likely that even more will be created in the future. But as of now, what are the most important ones to be aware of?
- General Data Protection Regulation (GDPR) is a data privacy law created by the EU. This is the most comprehensive law of data protection in existence. The GDPR regulates how the data of residents in EU countries can be collected, stored and processed. The GDPR gives consumers certain rights over their data, while also placing security responsibilities on companies holding the data.
- California Consumer Privacy Act (CCPA) is a privacy law that protects the residents of the state of California in the United States. The CCPA requires that consumers be made aware of what personal data is collected about them. The CCPA also gives consumers control over their personal data.
- National data privacy laws are very common. Many countries around the world have their own data protection law, for example Brazil’s General Law for the Protection of Personal Data and the UK's Data Protection Act. Some of these national laws are similar to the GDPR.
- Industry specific privacy laws also exist in some countries. An example of this is the Health Insurance Portability and Accountability Act (HIPAA) in the United States.
None of the laws mentioned here provide a clear definition of what they mean by data privacy. So, what does this mean for your organization? Basically, you should consider going above and beyond the expectations of the laws to make sure that your data practices are compliant.
What are the consequences of non-compliance?
Failing to comply with data privacy laws can have serious consequences for your organization. Most data privacy laws require that organizations pay huge fines or penalties if they mishandle sensitive data. Non-compliance with GDPR can for example cost your organization up to 4% of your annual revenue.
But besides the potential big costs, non-compliance can also have a negative effect on your organization's reputation and your ability to hold your customers’ trust. Remember, customers usually have their own expectations of how their personal data should be treated and non-compliance with privacy laws is a sure sign that these expectations will not be met.
While being aware of privacy laws is very important, organizations should also know what counts as data privacy, and what doesn’t.
Understanding the difference - Data security vs privacy
To help with this, we will examine a common confusion about data privacy and data security. It is not strange that many confuse privacy with security. But even though data security and data privacy can seem very similar, the two terms are not the same and should not be used interchangeably. To better understand why, let’s take a moment to define the two terms to figure out what the difference is.
Data privacy definition
Data privacy focuses on the rights of individuals regarding their personal data. It is all about the policies and procedures your organization apply when handling personal data. This includes collecting and storing data, avoiding unauthorized access to data, and being compliant with data privacy laws. For instance, how does your organization make sure that you only collect data you have a lawful right to? And do you handle this data once inside the organization?
Data security definition
The core of data security is the methods your organization uses for protecting sensitive data that you are already holding. It is the measures taken to prevent unauthorized access to digital data by any third-party or malicious attacks. It is also about how your organization prevents exploitation of data once stolen.
Which one is more important for you to consider?
Both data security and data privacy are important for organizations. To ensure data privacy, you also need to have a healthy security stance, otherwise you would not be able to establish best practices for handling sensitive data. In short, data protection is not possible without data security.
Although data security is technically not dependent on data privacy, it is still in the best interest of your organization to make sure that the data you are protecting has been collected through lawful means and is not in violation of data privacy laws.
For these reasons, it is difficult to say that one is more important than the other. Rather, they are like two pieces of a puzzle that together create a stronger all-around foundation for the protection and handling of data.
5 Tips for improving your data privacy
Now that we know that data privacy can be viewed as an individual’s right and that data privacy is one of the biggest concerns for your organization in successful handling of data, let’s have a look at some helpful tips and technologies you can use for improving data privacy.
-
Training employees in data privacy. This step is important for ensuring that every employee in your organization is aware of data privacy and privacy concerns. This can be achieved through awareness training. Awareness training will provide your organization with a strong cyber security culture that ensures best practice in handling sensitive data.
-
Data loss prevention (DLP). These are solutions that usually include tools that help you avoid data from being stolen, lost or accidentally deleted. In short, DLP helps sensitive data stay where it is supposed to be.
-
Two-factor authentication. This technology is great for regular users as well as organizations. It makes it much harder for cyber criminals to gain access to personal accounts.
-
Encrypted storage solutions, VPNs and password managers. These are all tools that are easily available and simple to use for both individuals and organizations. They can make a big difference in your defense against cyber-attacks.
-
Strong password. Even with tools like two-factor authentication and password managers, it is always important to use strong passwords. To help you with this, we have made a guide on how to make a strong password you can remember.
Conclusion
In this blogpost we have highlighted why data privacy is important and presented some key data privacy laws to be aware of. We have also given a short explanation of the difference between data security and privacy, so that you will know how to keep the two terms apart in the future. Finally, we have given you some useful tips for how you can work with data privacy to make sure that you respect individuals' right of privacy while also staying compliant with privacy laws.
CyberPilot publishes a lot of content about the GDPR, awareness training and cybersecurity. If you are curious to read more about how your organization can work towards being GDPR compliant, build a stronger cyber security culture or actively work with awareness training, CyberPilot has many useful articles on our blog page.
People also asked
What is data privacy?
Data privacy refers to the protection and proper management of sensitive and personal information collected from individuals by organisations, ensuring that it is not shared, accessed or used inappropriately or without the consent of the data owner.
How long can personal data be stored?
The length of time personal data can be stored depends on the purpose for which it was collected. In general, it should not be kept for longer than necessary. Data controllers should have a data retention policy outlining how long different types of data will be kept.
Who can have access to personal data?
Only individuals or organizations who have a legitimate reason to access personal data, such as employers, healthcare providers, or law enforcement agencies, can do so. Data protection laws also require them to ensure the data is kept secure and not used for any other purposes without consent.
