Privacy, Regulations, and Cybersecurity

The Essential Business Guide

Chris Moschovitis

• Editorial: Wiley
• Año: 2021
• ISBN:
  9781119660118
• Edición: 1
• Categoría: Computer Science
• Categoría: Cyber Security

Protect business value, stay compliant with global regulations, and meet stakeholder demands with this privacy how-to

Privacy, Regulations, and Cybersecurity: The Essential Business Guide is your guide to understanding what "privacy" really means in a corporate environment: how privacy is different from cybersecurity, why privacy is essential for your business, and how to build privacy protections into your overall cybersecurity plan.

First, author Chris Moschovitis walks you through our evolving definitions of privacy, from the ancient world all the way to the General Law on Data Protection (GDPR). He then explains—in friendly, accessible language—how to orient your preexisting cybersecurity program toward privacy, and how to make sure your systems are compliant with current regulations.

This book—a sequel to Moschovitis' well-received Cybersecurity Program Development for Business —explains which regulations apply in which regions, how they relate to the end goal of privacy, and how to build privacy into both new and existing cybersecurity programs. Keeping up with swiftly changing technology and business landscapes is no easy task. Moschovitis provides down-to-earth, actionable advice on how to avoid dangerous privacy leaks and protect your valuable data assets.

• Learn how to design your cybersecurity program with privacy in mind
• Apply lessons from the GDPR and other landmark laws
• Remain compliant and even get ahead of the curve, as privacy grows from a buzzword to a business must
• Learn how to protect what's of value to your company and your stakeholders, regardless of business size or industry
• Understand privacy regulations from a business standpoint, including which regulations apply and what they require
• Think through what privacy protections will mean in the post-COVID environment

Whether you're new to cybersecurity or already have the fundamentals, this book will help you design and build a privacy-centric, regulation-compliant cybersecurity program.

PART ONE
Privacy

What man art thou that, thus bescreened in night, so stumblest on my counsel?

—William Shakespeare, Romeo and Juliet

CHAPTER 1
Understanding Privacy

Bene vixit, bene qui latuit.

—Ovid, Tristia

In case your Latin is rusty, Ovid's quote above translates to: “To live well is to live concealed.” My interpretation is different: “To live well is to live in privacy.”

But let's not get ahead of ourselves here. What, exactly, is privacy? What does it mean? What do we understand when we describe something as “private”?

Do we mean secret? Is something private also secret? Certainly, the reverse is not true: we can have many secrets that are not private! They may be secrets of others, secret negotiations, secret deals, and so on.

Do we mean personal? Is it data coupled with our personhood? If so, is all personal data private? What about our name? Are there degrees of privacy?

Defining privacy has puzzled minds far greater than mine, and the definitions for privacy have been just as grand and diverse. Let's start with our perennial friends at Merriam-Webster. They define privacy as:

---

1. a: the quality or state of being apart from company or observation: SECLUSION
   b: freedom from unauthorized intrusion
2. a: SECRECY
   b: a private matter: SECRET
3. archaic: a place of seclusion

---

The Oxford English Dictionary, on the other hand, defines privacy as:

---

1. A state in which one is not observed or disturbed by other people.
   • 1.1 The state of being free from public attention.

---

And, one of my favorites, Wiktionary's definition, covers all the bases, albeit sometimes cyclically:

---

1. The state of being secluded from the presence, sight, or knowledge of others.
2. Freedom from unwanted or undue disturbance of one's private life.
3. Freedom from damaging publicity, public scrutiny, surveillance, and disclosure of personal information, usually by a government or a private organization.
4. (obsolete) A place of seclusion.
5. (obsolete, law) A relationship between parties seen as being a result of their mutual interest or participation in a given transaction, contract, etc.; Privity.
6. (obsolete) Secrecy.
7. (obsolete) A private matter; a secret.

---

Not to be left out, of course, is the legal definition of privacy. Black's Law Dictionary defines privacy as:

---

The right that determines the nonintervention of secret surveillance and the protection of an individual's information. It is split into 4 categories:

1. Physical: An imposition whereby another individual is restricted from experiencing an individual or a situation;
2. Decisional: The imposition of a restriction that is exclusive to an entity;
3. Informational: The prevention of searching for unknown information; and
4. Dispositional: The prevention of attempts made to get to know the state of mind of an individual.

---

It's worthwhile to pay attention to those four categories: physical, decisional, informational, and dispositional. We'll be returning to those in more detail when we take on the meanings of privacy for your business.

It's not that I have something to hide,

I have nothing I want you to see.

—Amanda Seyfried

Definitions of privacy have evolved over time, and our understanding of the concept is constantly changing. Therefore, it would be naive to assume that Privacy with a capital P can be rendered via a legal definition, complex or not, or a dictionary entry.

Privacy has been, and remains, the subject of rigorous academic study. Anthropology, sociology, psychology, history, and other disciplines have been looking into the concept and developing their own definitions and models to describe Privacy.

It is clearly out of scope for this book to get into details on the academic research on privacy or do a literature review. For our purposes a few drops from the ocean will suffice.

The two giants in privacy research are considered to be Alan Westin (1929–2013), professor of public law and government at Columbia University, and Irwin Altman (1930), professor and chairman of the Psychology Department of the University of Utah, now emeritus.

Westin's book Privacy and Freedom (1968) is considered to be the foundational text on the subject. Westin defines privacy as follows:

---

Privacy is the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.

---

Westin goes on to describe four states of privacy, and four functions or purposes of privacy. He defines the privacy states as solitude, intimacy, anonymity, and reserve, and the purposes as personal autonomy, emotional release, self-evaluation, and limited and protected communication.

Westin's position is that privacy operates at three levels: The individual, the group, and the organizational level. He also constrains his theory of privacy as applicable to western societies only. In 2002, Westin proposed what's known as the Westin segmentation, classifying the public into three groups: the privacy fundamentalists, who place a premium on privacy and make up about 25 percent of the population; the privacy unconcerned, who couldn't care less about privacy and make up about 20 percent of the population; and the privacy pragmatists, the remaining 55 percent, who are aware of the trade-off between privacy and external offerings.

For his part, Altman outlined his privacy regulation theory in The Environment and Social Behavior (1975). Put very simply, privacy regulation theory has to do with the fact that people have different privacy standards at different times and in different contexts. For example, your definition of what constitutes “private information” in your relationship with your spouse is clearly different than in your relationship with your children, and it's also different with your boss and yet again with your coworkers.

According to Altman, this phenomenon is due to “the selective control of access to the self,” which has five properties:

---

• Temporal dynamic process of interpersonal boundaries (feelings about privacy change based on context);
• Desired and actual levels of privacy (what we hope for and what we get can differ);
• Non-monotonic function of privacy (what constitutes the “optimal” amount can increase or decrease);
• Bi-directional nature of privacy (privacy involves both “inputs” and “outputs”); and
• Bi-level nature of privacy (individual privacy is different from group).

---

Altman went on to d...