- [Narrator] Many of the laws that impact
information security professionals are designed
to protect the privacy of individuals
and protect individuals against both identity theft
and the unwanted disclosure of personal information.
In the United States we have a patchwork of laws
that affect different industries
depending upon the nature of their business
and the types of sensitive information that they handle.
Probably the most well known of these laws is the
Health Insurance Portability and Accountability Act or HIPAA
Passed in 1996 HIPAA places strict privacy
and security regulations on healthcare providers
health insurers and health information clearinghouses.
These three groups collectively known
as HIPAA covered entities
must insure the privacy and security
of protected health information or PHI that they handle.
HIPAA was updated in 2009 with the passage of the
Health Information Technology
for Economic and Clinical Health or HITECH Act.
the Family Educational Rights and Privacy Act or FERPA
regulates how educational institutions may handle
student educational records.
FERPA provides students and their parents,
if the student is under 18
the right to inspect educational records
and request corrections to those records.
FERPA also restricts the ways
that educational institutions may use
and release educational records
without the students consent.
The Gramm Leach Bliley Act GLBA
passed in 1999 covers the financial services sector.
GLBA requires that all financial institutions
have a written information security program
and designate a specific individual
who is responsible for information security.
GLBA also regulates the ways that financial institutions
may share private information
even when sharing it with other subsidiaries
of the same company.
The Children's Online Privacy Protection Act COPPA
protects the privacy of children under the age of 13
when they are accessing websites.
COPPA requires that websites
that knowingly collect information from children
have a written privacy policy
and provide parents with the ability
to review and delete information about their child.
COPPA also requires that parents
give concent for the collection of information
from children under the age of 13
before that collection takes place.
One often misunderstood law is the
Privacy Act of 1974.
The name of this act seems very broad
and people often misinterpret it
as applying to all organizations.
The Privacy Act does restrict
the sharing of personal information
but it only applies to federal government agencies
and has no affect on regulating
private individuals or organizations.
While the United States has a patchwork of laws
that cover very specific use cases
the European Union approaches data privacy
in a completely different way.
The European Union's Data Protections laws
cover many different types of personal information
in a very broad fashion.
EU law requires that organizations handling information
about EU citizens follow six principles
first personal information must be processed
lawfully, fairly and in a transparent manner
in relation to the data subject.
Information must be collected for specific
and legitimate purposes
and not further processed in a way
that's incompatible with those purposes.
Information collection must be limited
to the minimum information necessary
to achieve the specific purposes.
And information must be kept accurate and up to date.
Information must also be kept in a form
which permits the identification of data subjects
for no longer than is absolutely necessary.
And finally information processing must take place
under the responsibility and liability
of a designated data controller.
European Union law on data privacy
is currently in a state of transition.
As the EU adopts a new
General Data Protection Regulation or GDPR
which is scheduled to go into effect in 2018.