- [Narrator] During the course of employment,
organizations gather all kinds of sensitive information
about their employees.
Much of this information employees would normally
prefer to be kept private.
This includes the results
of preemployment background checks, credit checks
and other screenings,
Social Security numbers collected for tax purposes,
salary and other payroll information,
health information and information
about other types of employee benefits,
and a large number of other pieces
of sensitive information that the organization collects.
Employers have both a legal and ethical responsibility
to protect employee information from prying eyes
and ensure that it is not lost or stolen.
Employees trust their employers
to preserve their privacy,
and there are many ways that the organization
can meet this responsibility.
First is the principle of minimization.
Organizations should collect only the information
that they need in the legitimate course of employment,
and they should store that information
only as long as it remains necessary
for a valid business reason.
Second, organizations should limit access
to sensitive information to those
with a valid need to know.
For example, an organization
requires Social Security numbers
for tax reporting purposes.
Only employees directly involved
in the tax reporting process
should have access to those SSNs.
Even then, access should be limited
to the smallest number of employees possible.
Finally, organizations should use encryption
and data masking whenever possible.
Encrypting records prevents them
from being accessed outside of normal channels,
such as when a laptop is lost or stolen
or someone gains direct access to a database,
bypassing the normal application channels.
Masking data allows it to be used
for identification purposes
without exposing sensitive records.
For example, an organization can replace
the first five digits of a Social Security number
with Xs in their records.
The last four digits can still be used
to distinguish one employee from another
with the same name.
But it doesn't expose the employee
to significant identity theft risk
if those last four digits are exposed.
All of these techniques help an organization
protect the privacy and security of their employees.