Chapter 9
Privacy and Confidentiality
Privacy
• Protection of information and
data inside an organization
• Focus on personal information
about customers, employees,
suppliers, or business partners.
Confidentiality
• Protection of information and
data inside an organization
• Focus on organizational data and
the intellectual property of the
organization
Components of
Privacy and
Confidentiality
Controls
Importance of Employee Training

• Employees are big part of an organization

• Employee needs to know what information they can
share with outsider and what information they need
to protect
• Employees need to know how to protect information
Identity Theft
What is it?
Identity theft is the unauthorized use of
someone’s personal information for the
perpetrators benefit
How to protect from identity theft?
(examples)
• Shred all documents that contain personal
information, especially unsolicited credit
card offers, before discarding them.
• Securely store documents that contain
sensitive personal and financial
information
• Beware of e-mail, telephone, and print
requests to “verify” personal information
that the requesting party should already
possess.
• Limit the amount of other information
(address and phone number) preprinted
on checks, and consider totally
eliminating such information
Generally Accepted Privacy Principles
What is it?
10 internationally recognized best practices for
protecting the privacy of customers’ personal
information.
The Principles
1. Management Organizations need to
establish a set of procedures and policies for
protecting the privacy of personal
information they collect from customers.
2. Notice An organization should provide
notice about its privacy policies and
practices at or before the time it collects
personal information from customers, or as
soon as practicable thereafter.
3. Choice and consent Organizations should
explain the choices available to individuals
and obtain their consent prior to the
collection and use of their personal
information.
4. Choice and consent. Organizations should
explain the choices available to individuals
and obtain their consent prior to the
collection and use of their personal
information.
Generally Accepted Privacy Principles (Cont’d)
5. Collection. An organization should collect only
the information needed to fulfill the
purposes stated in its privacy policies.
6. Use, retention, and disposal. Organizations
should use customers’ personal information
only in the manner described in their stated
privacy policies and retain that information
only as long as it is needed to fulfill a legitimate
business purpose. When the information
is no longer useful, it should be disposed of in a
secure manner.
7. Access. An organization should provide
individuals with the ability to access, review,
correct, and delete the personal information
stored about them.
8. Quality. Organizations should maintain the
integrity of their customers’ personal
information and employ procedures to ensure
that it is reasonably accurate.
9. Disclosure to third parties. Organizations
should disclose their customers’ personal
information to third parties only in the
situations and manners described in the
organization’s privacy policies and only to third
parties who provide the same level of privacy.
10. Security. An organization must take reasonable
steps to protect its customers’ personal
information from loss or unauthorized
disclosure. Therefore, organizations must use
the various preventive, detective, and
corrective controls to restrict access to their
customers’ personal information.
11. Monitoring and enforcement. An organization
should assign one or more employees
to be responsible for ensuring compliance with
its stated privacy policies. Organizations
must also periodically verify that their
employees are complying with stated privacy
policies.