Policy, Privacy, and Compliance

Learning outcomes:

  • Describe Massachusetts data privacy laws, and what they define as personal information
  • Explain how combining databases can reveal more than any single source
  • Describe good practices for data backup, data retention, and responding to a breach
  • Compare insider and outsider threats

Would you like to download my PowerPoint to follow along?

  • Privacy and computers
    • Business
    • Databases
    • Social media
  • Massachusetts data privacy laws
    • M.G.L. 93H
      • Defines personal information
      • Requires the state and affected people to be notified after a security breach or unauthorized use of personal information
      • The notice to residents must be sent as soon as practicable, and must say they can get a police report, how to freeze their credit, that a freeze is free, and what help the company is offering
      • The notice to residents must not say how the breach happened, or how many residents were affected
      • Read Section 3 of the law, and see the breach reports and letters Massachusetts posts
    • M.G.L. 93I
      • Requires personal information to be destroyed so it can't be recovered
      • Includes biometric indicators as personal information
    • 201 CMR 17.00
      • Requires checking that third party vendors with access to personal information don't add risk
      • Requires limiting the amount of personal information collected
    • Personal information is a name combined with a Social Security number, driver's license or state ID number, or financial account, credit, or debit card number
  • Organizations that protect privacy
  • Databases
    • Inferring from multiple data items
    • Combining sources: what picture can we get from multiple databases?
    • Who gets access, and who gets control?
  • Data breaches
  • AI and privacy law
    • Companies want user data to train AI
    • In 2024, Ireland's Data Protection Commission got Meta to pause training AI on EU users' public posts (Data Protection Commission)
    • Meta's use of AI chats for ads doesn't apply in the EU, UK, and South Korea, because of their privacy laws
    • The US has no federal privacy law requiring opt-in, so many companies make AI training opt-out
  • Data backup policies
    • What gets backed up, and on what medium?
    • Where is it stored, and how often does it happen?
    • Is it encrypted, and what kind of backup is it?
    • What are your written policies, and how often are they reviewed?
  • Data retention
    • What do you keep, and for how long?
    • What are your legal obligations?
    • What should you not keep?
  • Breach reaction
    • Bad examples: almost everyone
    • Best practices for breach disclosure: the FTC's Data Breach Response: A Guide for Business
      • Secure your systems, fix what went wrong, then notify people
      • Tell law enforcement, affected businesses, and the people affected
      • A good notice says what happened, what information was taken, what the company has done, and what people can do to protect themselves
      • Offer help, such as free credit monitoring
    • If your data is in a breach: check Have I Been Pwned, change passwords, turn on two-factor authentication, and consider a free credit freeze
  • Threats
    • Insider threats: people inside the organization, including mistakes as well as people causing harm on purpose
    • Outsider threats: attackers from outside, such as criminals or other countries

Suggested Activities and Discussion Topics:

  • In class activity: spend 5 minutes on Privacy Guides reading about one thing that interests you, then share what it was, why it's interesting, and what you'll do with it.
  • Discussion: which is harder to defend against, insider threats or outsider threats? Why?
  • Follow the instructions on this PDF (accessible HTML version)

Would you like to see some more classes? View all classes