Recognizing Computer Threats – Data Breach Awareness, Part II

By Chris Williams

Recap from Part I

Large-scale data breaches are increasing in both frequency and magnitude, leading to an unprecedented threat to consumers’ confidential personal and financial information. Laws currently on the books concerning data breach notifications are fairly weak; compromised organizations often sit on information for weeks or months (occasionally years) before notifying affected customers that their data has been leaked—this is completely unacceptable yet seems to be common practice in certain industries such as web-based email.

Users should use unique passwords that are not shared among multiple accounts; re-using passwords creates a single point of failure that dramatically increases a consumer’s risk of private data being exposed during a hack.

There are a number of ways in which the average consumer can protect themselves from exposure, and it starts by understanding the companies you do business with; get to know their practices and policies, and make sure that they follow all applicable laws concerning what is done with your data.

Data privacy laws

How are organizations protecting your data? Do you have any recourse if you suspect they are not following these practices?

The Privacy Act of 1974 states that consumers have a right to determine how their personally identifiable information is used: more specifically, that they must give prior consent in writing before any of their PII is disseminated by a company (or organization/agency); they must be able to obtain copies of their personal records with that company upon request; and they must be provided with a means to amend or correct any incorrect information that exists in that company’s records. This doesn’t give users the level of granularity which many would like, but it’s a start.

Organizations that collect personal information of any kind should post their privacy policies online. Most do, even if these policies can be difficult to locate; alongside this, consumers can usually find the contact information for whomever is responsible for providing copies of records, and updating incorrect records. While creating an account or signing up for a service, email subscription, etc. the end-user agreement should also spell out the organization’s privacy and data collection policies—if not, that could be a potential red flag.

The Privacy act does include some provision for redressing violations in civil court: “The Privacy Act provides for four separate and distinct civil causes of action, see 5 U.S.C. § 552a(g), two of which provide for injunctive relief – amendment lawsuits under (g)(1)(A) and access lawsuits under (g)(1)(B) – and two of which provide for compensatory relief in the form of monetary damages – damages lawsuits under (g)(1)(C) and (g)(1)(D).” Litigation aside, there’s plenty of incentive for organizations to comply with these rules; among those incentives is simply public image. Customers can be very quick to turn upon companies that fail to meet privacy regulations; this can cascade quickly into widespread distrust and loss of reputation with consumers and/or industry peers. That in mind, contacting the organization to address a complaint might be more than sufficient—no need to call a lawyer just yet.

FERPA (Family Educational Rights and Privacy Act) is another federal law which governs disclosure and maintenance of information, this time dealing with the educational sector. Student records such as transcripts are protected, requiring express written consent from the student (or their legal guardian if under 18) before being disseminated for any reason, other than on official school business. Much like the Privacy Act, concerned individuals must follow a designated path to request corrections or amendments; additionally, the record owner has a right to request copies of those records as well as to receive them in a timely manner.

For information on understanding your FERPA rights, or for reporting suspected violations, visit the following: https://www2.ed.gov/policy/gen/guid/fpco/ferpa/students.html

HIPAA (Health Insurance Portability and Accountability Act) is another federal law; aimed at the healthcare sector, it is otherwise similar in concept to the previous two. Health insurance providers, doctors, hospitals, specialists, and anyone who deals with protected health information (PHI) of any kind must follow these rules. This also includes HR employees at organizations that offer health care plans as part of compensation packages.

If you have additional HIPAA questions or need to report a potential violation, the following page should help: https://www.hhs.gov/hipaa/filing-a-complaint/index.html?language=es

The takeaway

It’s extremely critical that organizations treat confidential consumer information with the respect it deserves. Many companies do not have policies or procedures that address this issue, however. Where possible avoid an unnecessary risk of doing business with organizations that have poor/nonexistent privacy policies; same holds true for companies that consistently disregard information security best practices. Laws such as the Privacy Act, HIPAA, and FERPA contain numerous measures to enforce compliance; it is important to report suspected violations for both your protection as well as the protection of other consumers.

Copyright © 2017 ParadoxPrime IA, All rights reserved

Leave a Reply

Your email address will not be published. Required fields are marked *