{"id":15075,"date":"2019-04-11T10:10:02","date_gmt":"2019-04-11T18:10:02","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/04\/11\/news-8824\/"},"modified":"2019-04-11T10:10:02","modified_gmt":"2019-04-11T18:10:02","slug":"news-8824","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/04\/11\/news-8824\/","title":{"rendered":"What is personal information? In legal terms, it depends"},"content":{"rendered":"

Credit to Author: David Ruiz| Date: Thu, 11 Apr 2019 17:03:02 +0000<\/strong><\/p>\n

In early March, cybersecurity professionals around the world filled the San Francisco Moscone Convention Center\u2019s sprawling exhibition halls to discuss and learn about everything infosec, from public key encryption to incident response, and from machine learning<\/a> to domestic abuse<\/a>.<\/p>\n

It was RSA Conference 2019, and Malwarebytes showed up to attend and present. Our Wednesday afternoon session\u2014\u201cOne person can change the world\u2014the story behind GDPR<\/em>\u201d\u2014explored the European Union\u2019s new, sweeping data privacy law <\/a>which, above all, protects \u201cpersonal data.\u201d <\/p>\n

But the law\u2019s broad language\u2014and finite, severe penalties\u2014left audience members with a lingering question: What exactly is<\/em> personal data? <\/p>\n

The answer: It depends. <\/p>\n

Personal data, as defined by the EU\u2019s General Data Protection Regulation, is not the same as \u201cpersonally identifiable information,\u201d as defined by US data protection and cybersecurity laws, or even \u201cpersonal information\u201d as defined by California\u2019s recently-signed data privacy law. Further, in the US, data protection laws and cybersecurity laws serve separate purposes and, likewise, bestow slightly separate definitions to personal data. <\/p>\n

Complicating the matter is the public\u2019s instinctual approach to personal information, personal data, and online privacy. For everyday individuals, personal information can mean anything from telephone numbers to passport information to postal codes\u2014legal definitions be damned. <\/p>\n

Today, in the latest blog for our cybersecurity and data privacy series<\/a>, we discuss the myriad conditions and legal regimes that combine to form a broad understanding of personal information.<\/p>\n

Companies should not overthink this. Instead, data privacy lawyers said businesses should pay attention to what information they collect and where they operate to best understand personal data protection and compliance. <\/p>\n

As Duane Morris LLP intellectual property and cyber law partner Michelle Donovan said: <\/p>\n

\u201cWhat it comes down to, is, it doesn\u2019t matter what the rules are in China if you\u2019re not doing business in China. Companies need to figure out what jurisdictions apply, what information are they collecting, where do their data subjects reside, and based on that, figure out what law applies.\u201d <\/p>\n

What law applies? <\/strong><\/h3>\n

The personal information that companies need to protect changes from law to law. However, even though global data protection laws define personal information in diverse ways, the definitions themselves are not important to every business. <\/p>\n

For instance, a small company in California that has no physical presence in the European Union and makes no concerted efforts to market to EU residents does not have to worry about GDPR. Similarly, a Japanese startup that does not collect any Californians\u2019 data does not need to worry about that state’s recently-signed data privacy law. And any company outside the US that does not collect any US personal data should not have to endure the headaches of complying with 50 individual state data breach notification laws. <\/p>\n

Baker & McKenzie LLP of counsel Vincent Schroeder, who advises companies on privacy, data protection, information technology, and e-commerce law, said that the various rules that determine which laws apply to which businesses can be broken down into three basic categories: territorial rules, personal rules, and substantive rules. <\/p>\n

Territorial rules are simple\u2014they determine legal compliance based on a company\u2019s presence in a country, state, or region. For instance, GDPR applies to companies that physically operate in any of the EU\u2019s 28 member-states, along with companies that directly market and offer their products to EU citizens. That second rule of direct marketing is similar to another data privacy law in Japan, which applies to any company that specifically offers its products to Japanese residents. <\/p>\n

\u201cThat\u2019s the \u2018marketplace rule,\u2019 they call it,\u201d Schroeder said. \u201cIf you\u2019re doing business in that market, consciously, then you\u2019re affecting the rights of the individuals there, so you need to adhere to the local regulatory law.\u201d <\/p>\n

Substantive rules, on the other hand, determine compliance based on a company\u2019s characteristics. For example, the newly-passed California Consumer Privacy Act applies to companies that meet any single one of the following three criteria: pull in annual revenue of $25 million, derive 50 percent or more of that annual revenue from selling consumers\u2019 personal information, or buy, receive, sell, or share the personal information of 50,000 or more consumers, households, or devices. <\/p>\n

Businesses that want to know what personal information to legally protect should look first to which laws apply. Only then should they move forward, because \u201cpersonal information\u201d is never just one thing, Schroeder said. <\/p>\n

\u201cIt\u2019s an interplay of different definitions of the territorial, personal, and substantive scopes of application, and for definitions of personal data,\u201d Schroeder said.<\/p>\n

Personal information\u2014what\u2019s included?<\/strong><\/h3>\n

The meaning of personal information changes depending on who you ask and which law you read. Below, we focus on five important interpretations. What does personal information mean to the public? What does it mean according to GDPR? And what does it mean according to three state laws in California\u2014the country\u2019s legislative vanguard in protecting its residents\u2019 online privacy and personal data. <\/p>\n

The public<\/strong><\/h4>\n

Let\u2019s be clear: Any business concerned with legal obligations to protect personal information should not start a compliance journey by, say, running an employee survey on Slack and getting personal opinions. <\/p>\n

That said, public opinions on personal data are important, as they can influence lawmakers into drafting new legislation<\/a> to better protect online privacy. <\/p>\n

Jovi Umawing, senior content writer for Malwarebytes Labs who recently compiled nearly 4,000 respondents\u2019 opinions on online privacy<\/a>, said that personal information is anything that can define one person from another. <\/p>\n

\u201cPersonal information for me is relevant data about a person that makes them unique or stand out,\u201d Umawing wrote. \u201cIt’s something intangible that one owns or possesses that (when combined with other information) points back to the person with very high or unquestionable accuracy.\u201d<\/p>\n

Pieter Arntz, malware intelligence researcher for Malwarebytes, provided a similar view. He said he considers \u201ceverything that can be used to identify me or find more specific information about me as personal information.\u201d That includes addresses, phone numbers, Social Security numbers, driver\u2019s license info, passport info, and, \u201calso things like the postal code,\u201d which, for people who live in very small cities, can be revealing, Arntz said.<\/p>\n

Interestingly, some of these definitions overlap with some of the most popular data privacy laws today. <\/p>\n

GDPR<\/strong><\/h4>\n

In 2018, the General Data Protection Regulation took effect, granting EU citizens new rights to access, transport, and delete personal data. In 2019, companies are still figuring out what that personal data encompasses. <\/p>\n

The text of the law<\/a> offers little clarity, instead providing this ocean-wide ideology: \u201cPersonal data should be as broadly interpreted as possible.\u201d<\/p>\n

According to GDPR, the personal data that companies must protect includes any information that can \u201cdirectly or indirectly\u201d identify a person\u2014or subject\u2014to whom the data belongs or describes. Included are names, identification numbers, location data, online identifiers like screen names or account names, and even characteristics that describe the \u201cphysical, physiological, genetic, mental, commercial, cultural, or social identity of a person.\u201d <\/p>\n

That last piece could include things like an employee\u2019s performance record, a patient\u2019s medical diagnosis history, a user\u2019s specific anarcho-libertarian political views, and even a person\u2019s hair color and length, if it is enough to determine that person\u2019s identity. <\/p>\n

Donovan, the attorney from Duane Morris, said that GDPR\u2019s definition could include just about any piece of information about a person that is not anonymized. <\/p>\n

\u201cEven if that information is not identifying [a person] by name, if it identifies by a number, and that number is known to be used to identify that person\u2014either alone or in combination\u2014it could still associate with that person,\u201d Donovan said. \u201cYou should assume that if you have any data about an individual that is not anonymized when you get it, it\u2019s likely going to be covered.\u201d <\/p>\n

The California Consumer Privacy Act<\/strong><\/h4>\n

In June 2018, California became the first state in the nation to respond to frequent online privacy crises by passing a comprehensive, statewide data privacy law<\/a>. The California Consumer Privacy Act, or CCPA, places new rules on companies that collect California residents\u2019 personal data. <\/p>\n

The law, which will go into effect in 2020, calls this type of data \u201cpersonal information.\u201d <\/p>\n

\u201cPersonal information,\u201d according to the CCPA<\/a>, is \u201cinformation that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.\u201d <\/p>\n

What that includes in practice, however, is a broad array of data points, including a person\u2019s real name, postal address, and online IP address, along with biometric information\u2014like DNA and fingerprint data\u2014and even their browsing history, education history, and what the law vaguely describes as \u201caudio, electronic, visual, thermal, olfactory, or similar information.\u201d <\/p>\n

Aside from protecting several new data types, the CCPA also makes a major change to how Californians can assert their data privacy rights in court. For the first time ever, a statewide data privacy law details \u201cstatutory damages,\u201d which are legislatively-set, monetary amounts that an individual can ask to recover when filing a private lawsuit against a company for allegedly violating the law. Under the CCPA, people who believe their data privacy rights were violated can sue a company and ask for up to $750. <\/p>\n

This is a huge shift in data privacy law, Donovan said. <\/p>\n

\u201cFor the first time, there\u2019s a real privacy law with teeth,\u201d Donovan said. <\/p>\n

Previously, if individuals wanted to sue a company for a data breach, they needed to prove some type of economic loss when asking for monetary damages. If, say, a fraudulent credit card was created with stolen data, and then fraudulent charges were made on that card, monetary damages might be easy to figure out. But it\u2019s rarely that simple.  <\/p>\n

\u201cNow, regardless of the monetary damage, you can get this statutory damage of $750 per incident,\u201d Donovan said. <\/p>\n

California\u2019s data breach notification law and data protection law<\/strong><\/h4>\n

If we stay in California but go back in time several years, we see the start of a trend\u2014California has been the first state, more than once, to pass data protection legislation<\/a>. <\/p>\n

In 2002, California passed its data breach notification law<\/a>. The first of its kind in the United States, the law forced companies to notify California residents about unauthorized access to their \u201cpersonal information.\u201d <\/p>\n

The previous definitions of personal information and data that we\u2019ve covered\u2014GDPR\u2019s broad, anything-goes approach, and CCPA\u2019s inclusion of heretofore unimagined \u201colfactory,\u201d smell-based personal data\u2014do not apply here. <\/p>\n

Instead, personal information in the 17-year-old law\u2014which received an update five years ago\u2014is defined as a combination<\/em> of types of information. The necessary components include a Californian\u2019s first and last name, or first initial and last name, paired up with things like their Social Security number, driver\u2019s license number, and credit card number and corresponding security code, along with an individual\u2019s email address and password. <\/p>\n

So, if a company suffers a data breach of a California resident\u2019s first and last name plus<\/em> their Social Security number? That\u2019s considered personal information. If a data breach compromises another California resident\u2019s first initial, last name, and past medical insurance claims? Once again, that data is considered personal information, according to the law. <\/p>\n

In 2014, this definition carried somewhat over into California\u2019s data protection law. That year, then-California governor Jerry Brown signed changes<\/a> to the state\u2019s civil co<\/a>de<\/a> that created data protection requirements for any company that owns, licenses, or maintains the \u201cpersonal information\u201d of California residents. <\/p>\n

According to Assembly Bill No. 1710, \u201cpersonal information\u201d is, once again, the combination of information that includes a first name and last name (or first initial and last name), plus a Social Security number, driver\u2019s license number, credit card number and corresponding security number, and medical information and health information. <\/p>\n

The definitions are not identical, though. California\u2019s data protection law, unlike its data breach notification law, does not cover data collected by automated license plate readers, or ALPRs. ALPRs can indiscriminately\u2014and sometimes disproportionately<\/a>\u2014capture the license plate numbers of any vehicles that cross into their field of vision. <\/p>\n

Roughly one year later, California passed a law to strengthen protections of ALPR-collected data. <\/p>\n

The takeaway<\/strong><\/h3>\n

By now, it\u2019s probably easier to define what personal information isn\u2019t rather than what it is (obviously, there is a legal answer to that, too, but we\u2019ll spare the details). These evolving definitions point to a changing legal landscape, where data is not protected solely because of its type, but because of its inherent importance to people\u2019s privacy. <\/p>\n

Just as there is no one-size-fits-all definition to personal information, there is no one-size-fits-all to personal data protection compliance. If a company finds itself wondering what personal data it should protect, may we suggest something we have done for every blog in this series: Ask a lawyer. <\/p>\n

Join us again soon for the next blog in our series, in which we will discuss consumer protections for data breaches and online privacy invasions.  <\/p>\n

The post What is personal information? In legal terms, it depends<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: David Ruiz| Date: Thu, 11 Apr 2019 17:03:02 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
What exactly is the “personal information” that companies need to legally protect? Learn which data points organizations need to secure, from Social Security numbers to olfactory, smell-based data (!), to comply with the law.<\/p>\n

Categories: <\/p>\n