Tutor: Data Policies. 2 2
In this lesson, 3 3
we are going to talk more about data policies. 4 4
Specifically, we're going to cover purpose limitation, 5 5
data minimization, and data sovereignty. 6 6
First, let's talk about purpose limitation. 7 7
Now, when we talk about purpose limitation, 8 8
this is the principle 9 9
that personal information can be collected and processed 10 10
only for a stated purpose 11 11
to which the subject has consented. 12 12
For example, if you're working with the US Government 13 13
on a lot of different things, 14 14
we have something known as the Privacy Act of 1974, 15 15
and it will actually say that 16 16
if you're giving your name and your social security number 17 17
to this form to maybe get your driver's license 18 18
or something like that, 19 19
then it can only be used for that stated purpose. 20 20
They can't then use it for something else. 21 21
That's what we're talking about with a purpose limitation. 22 22
Now, a purpose limitation will restrict your ability 23 23
to transfer data to third parties 24 24
so you have to make sure you look at the way it's written 25 25
because if my purpose limitation says 26 26
that I can't transfer any data to third parties, 27 27
that means I can't outsource that part of my business, 28 28
I have to do it internally with employees that I own. 29 29
Also, you can't take the data 30 30
and then just give it to somebody else 31 31
so that they can market it to other people. 32 32
These are things you have to think about 33 33
when you look at what was the purpose that you used 34 34
to collect that information, 35 35
what did you tell your customers? 36 36
And then you need to make sure you follow through 37 37
keeping the promise that you made to them 38 38
in that purpose limitation. 39 39
Now, the secondary we want to talk about is data minimization. 40 40
Data minimization is the principle 41 41
that only necessary and sufficient personal information 42 42
can be collected and processed 43 43
for the state of purpose. 44 44
So what does this look like in the real world? 45 45
Well, I'll give you a great example from my own website. 46 46
Let's say you decide you want to buy your CySA+ voucher 47 47
by going to my website. 48 48
You're going to go to diontraining.com/vouchers. 49 49
You hit Enter and you're at the website. 50 50
You click on the button for CySA, 51 51
and it brings you up to a checkout page. 52 52
We're going to collect 53 53
the minimal amount of information from you. 54 54
What would be the minimal information do you think 55 55
if you wanted to buy a voucher from us? 56 56
Well, it would be your name, your email, 57 57
and your credit card information. 58 58
That's all I need. 59 59
I don't need to know your home address. 60 60
I don't need to know your mother's maiden name. 61 61
I don't need to know your date of birth. 62 62
I don't care about any of that. 63 63
It's outside the purpose that I need. 64 64
So for me, I need your name 65 65
so I can send you an email and say, 66 66
"Thanks, Jason, for buying your voucher. 67 67
I need your email 68 68
so I can send you the voucher that you're buying, 69 69
and I need your credit card 70 70
so I can get paid for the voucher I'm sending you." 71 71
That's it. 72 72
And so for us, 73 73
we collect the minimum amount of information possible 74 74
to give you the maximum freedom to protect your privacy. 75 75
Now, each process that uses personal data 76 76
should be properly documented. 77 77
We have all of our processes documented 78 78
and we say, "Here's what comes in, 79 79
here's all the different actions that happened, 80 80
and here's what comes out." 81 81
And that way, we can verify 82 82
that we are minimizing the data collected. 83 83
In the old days, 84 84
we used to actually ask for your mailing address, 85 85
and then we found out that we didn't need it 86 86
because we're not mailing you anything physically, 87 87
we're only using email, 88 88
and our credit card company said 89 89
they weren't even using 90 90
the shipping address of the credit card, 91 91
so we stopped collecting that information. 92 92
Again, you need to figure out what is needed for the process 93 93
so you can minimize it. 94 94
When you look at data minimization, 95 95
it's also going to affect your data retention policy 96 96
because if you have less data, 97 97
that is data that you may not need to keep as long, 98 98
or on the opposite side, 99 99
you might be able to keep it longer 100 100
because your data retention policy will allow 101 101
and you have enough storage 102 102
because you're collecting less data. 103 103
So either way could help you in your data retention policy. 104 104
For instance, if you bought a voucher from me 10 years ago, 105 105
do I still need to have your name and email? 106 106
Probably not, because if you only bought something from me 107 107
10 years ago and you haven't come back since 108 108
you're probably not interested. 109 109
So I don't really have a business case 110 110
for why I would keep that even longer. 111 111
And so you can look at your data retention policy 112 112
in terms of data minimization as well. 113 113
Now, the third main principle 114 114
we're going to talk about in this lesson is data sovereignty. 115 115
This is the principle that countries and states 116 116
may impose individual requirements on data collected 117 117
or being stored within their jurisdiction. 118 118
So, there are different rules in different areas. 119 119
We've already talked about this. 120 120
If you're in Europe, you have one set of rules. 121 121
If you're in America, you have another set of rules. 122 122
If you're in some other country, 123 123
you might have a third set of rules. 124 124
And so it's important to understand 125 125
what those rules are, where you are. 126 126
Now, how does this affect us 127 127
as people who work on the internet? 128 128
Well, all that data has to be stored someplace, right? 129 129
And so some states and nations 130 130
may respect data privacy more or less than others, 131 131
and based on that, 132 132
you can determine where you want to host your servers. 133 133
For example, if I choose to host my servers in America, 134 134
which I do, 135 135
that means I have to follow the American laws for it. 136 136
But if I decide to move it to some country in Africa, 137 137
or the Middle East, or Asia, 138 138
I have to follow their rules, 139 139
and their rules may not be as strict as the American rules. 140 140
Or if I moved it to Europe, they have stricter rules. 141 141
So for instance, if I move my server to Germany, 142 142
I'm now in the European Union, 143 143
so I now fall under GDPR. 144 144
If I'm dealing with GDPR, 145 145
these protections are actually extended 146 146
to any European Union citizen 147 147
while they're within Europe 148 148
or within the European Economic Area or the EU. 149 149
Now technically, if you're a European Union citizen 150 150
and you start traveling to a different area, 151 151
you now have affected your data sovereignty 152 152
because you're no longer protected by GDPR 153 153
while you're in, say, Thailand 154 154
because now you're following the Thailand rules. 155 155
And so if you're dealing with a local Thai company, 156 156
they don't have to deal with GDPR regulations, 157 157
even though you're a European Union citizen, 158 158
and that protection only protects you 159 159
within the walls of the European Union, 160 160
it doesn't protect you once you move outside. 161 161
And so this is the idea of data sovereignty, 162 162
and it affects you personally as you travel, 163 163
but it also affects companies 164 164
as we're deciding where to put our data 165 165
because the location of our servers 166 166
will help determine data sovereignty.