Comparing Data Security and Data Privacy
Read time: 15 minutes
Today, we will discuss differentiating factor between data security & data privacy and the various factors such as encryption, tokenization, & masking affecting both of them.
Data Security Vs. Data Privacy
Data Security and Data Privacy vs. Compliance
- PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) provides a framework for protecting the payment card information and cardholder data. PCI DSS is fundamentally associated with standards provided for the security controls about the storage, processing, and transmission of payment data, including the personal data such as name, address, etc., This standard applies to merchants, banks, any third parties involved, and any other entity handling cardholder data.
- CCPA
The California Consumer Privacy Act (CCPA) aims for the consumer to retain ownership, power, and security of your personal information if you are a citizen of the state of California by establishing the significant rights to consumers such as:
- The right to know what and where personal information is being collected, sold, and disclosed about them
- The ability to deny the sale of personal information.
- The right to have equal service and price if one decides to exercise their privacy rights.
- The right to be able to have personal information deleted
- HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) provides a set of standards to protect the sensitive data of patients across the US. This regulation standard is complex as it includes a vast amount of health care data of US citizens. Companies dealing with Protected Health Information (PHI) must have administrative, physical, and technical security measures to be HIPPA compliant. There are covered entities providing treatment, accepting payments, operating in healthcare, or business associates, including anyone who has patient information and provides support in treatment, payments, or operations. General Security Rules require covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting PHI.
- Ensuring confidentiality, integrity, and availability of all PHI covered entities create, receive, maintain or transmit.
- Identify and protect against reasonably anticipated threats to the security or integrity of the information.
- Protect against reasonably anticipated, impermissible uses or disclosures.
- Ensure compliance by covered entities’ workforce.
- GDPR
The General Data Protection Regulation (GDPR) is a digital data privacy standard for EU citizens. GDPR states the general guidelines for personal data, such as whose data should be protected, type of personal data, and how the data should be managed and protected. GDPR applies to all companies, which collect and process EU resident’s data. Non-EU companies would need to appoint a GDPR representative and be held liable for all fines and sanctions.
- NYDFS
The New York Department of Financial Services (NYDFS) cybersecurity regulation is a set of rules applicable to the covered financial institutions. NYDFS applies to all the financial institutions operating under DFS licensure, registration, or charter or DFS regulated. The NYDFS Cybersecurity Regulation states the strict guidelines for cybersecurity rules and detailed cybersecurity plan designed by CISO, implementation of cybersecurity policy, and an ongoing maintenance and reporting system for cybersecurity incidents.
- HITECH
The Health Information Technology for Economic and Clinical Health Act (HITECH) was mandated to embrace the purposeful usage of electronic health records (EHR) technology by U.S.-based healthcare providers and their business associates. HITECH means healthcare providers need to show that they are using certified EHR technology to avoid data breaches of unencrypted electronic health records.
The HITECH Act also encouraged the stricter enforcement of the Privacy and Security Rules of HIPAA by making security audits of all healthcare providers compulsory. These audits are performed to investigate and determine whether health care providers meet minimum specified standards or not to conclude if they comply with the HIPAA’s Privacy Rule and Security Rule.
Let’s discuss how Data Security and Data Privacy can be achieved with the help of the following security technologies:
- Encryption
- Tokenization
- Masking
- Encryption for Data Security and Data Privacy:
Encryption provides data security for various forms of confidential data such as cardholder data, protected health information (PHI), personal identifiable information (PII), etc., by encrypting/decrypting with a mathematically derived key possessed by an authorized party. Data security becomes critical in the present environment when there are bad actors present everywhere on the internet. Many encryption applications protect personal data during data-at-rest and data-in-transit, however, leaving sensitive data unguarded in plain-text during processing.
Although encryption became defacto standard for all data-in-transit and data-at-rest use cases, it still alone doesn’t provide the complete data privacy solution for sensitive data throughout its lifetime.
- Tokenization for Data Security and Data Privacy:
Tokenization plays an important and vital role while providing Data Security and Data Privacy as it has the capabilities to satisfy the requirements of both. Since the tokenization provides the functionality of pseudonymization, it can be treated as a redundant safeguarding mechanism to protect in the event of a security breach. With this technology’s help, even if the data in the organization’s system is compromised, it’s not much of use for bad actors as pseudonymization desensitizes the data by deidentifying it and making useless for cybercriminals.
Since the data is desensitized in the organization’s system, the risk associated with data privacy is countered. So, it is clear that with the help of tokenization, our data security gets the needed strength, and on the other hand, data privacy also becomes robust because of the desensitization of personal data.
- Masking for Data Security and Data Privacy:
Data masking plays an instrumental role in data privacy by guarding the confidential information such as credit card information, PHI, PII etc., by replacing the actual data with the functional fictious data to be used in scenarios when the actual data is not needed. Gartner describes it as a technology that “can dynamically or statistically protect sensitive data by replacing it with fictitious data that looks realistic to prevent data loss in different use cases.” Data masking uses various mechanisms to alter the data using character or number substitution, character shuffling, or encryption algorithms. So, data masking, also known as data obfuscation or data pseudonymization, helps in handling data privacy issues for personal data to a great extent.
