Personal Information Handling
Personal information handling is a major concern that has effect to both organization level and implication in individuals’ life when it comes to data handling. This is a complex case due to the use of high capability technologies with facilitation of user interface platforms such as social media, financial institution website or e-commerce websites. Failure to properly handle personal data result into concerns about individuals’ privacy and it remain a trending subject and the primary concern in regards to personal information because of data exploitation trend at all organization levels, from businesses to improve their marketing capabilities, social media companies that use to refine advertisement to government agencies to improve their services [9] It creates a great struggle in managing personal information and open the risk of information to be exploited.
Following the latest news on Optus recent Data breach that Optus were subject to where up to 9.8 million customers have been impacted by the breach and their personal information been compromised and exposed by hacker. [10] This is the great evidence which demonstrate that even large companies still need more controls on a daily basis to better handle and protect users’ personal information.
In terms of handling personal information, organization need to highly consider strengthen their security controls and policies and perform the review of existing controls and protocols in place to improve in accordance to the new technologies and innovations.
The problem with handling personal information is that often businesses, companies and organizations are using customers personal data to shape their marketing and campaign and these activities are mostly performed without customers or users’ permission which in my perspective and in respect to personal privacy and professional ethic, it represents a data exploitation by misusing personal data for their interest. In accordance with [11] This represents as well a violation of ACS (Australian Computer Society) code of professional conduct principal as it stated in the principal 1.2.1 (The primacy of the public interest) that the public interest should be put above all others such as personal, sectional or business,
To resolve this problem, organizations that handle individuals’ personal data need to design a strong framework or improve existing ones and work closely with the government and in compliance to government guidelines to avoid any risk that might occur in the process of handling sensitive personal data as this can cause harm to individuals as well as economic harm to the national economy.
To the individual’s perspective when it comes to handle personal information, there is a whole study that need to be understood by the public due to the trend of technologies that facilitate the usage and transaction of our data trough technology means. Awareness from entities that provides technology and platforms has a great importance to the society to guide them on how to wisely use the platform and protect themselves against any form of risk and attack that can be subject to. Organization to provide as well flexibility and access to control their information might facilitate individual to easily limit the exposure of sensitive information [8]
How information is being shared among organizations
Sharing of personal information either between organization or among individuals can be critical and can raise an ethical issue and even promote the risk of information being compromised or misused by malicious entities or in committing crime. This discussion is based on how users’ information is being collected and shared between organization to improve their marketing campaign
Referring to the analysis of this special feature in Facebook “Off Facebook Activity “This Facebook Tool Reveals How You Are Being Tracked Online” shows that Facebook reveal to users how their data are being shared between organization to help them improve their advertisement campaign which is ethically right for the user to know how their data are being used by the organization or any institution, but also organization needs user consent to fully share and use their data. Because according to Australia privacy Act 1988 [12] “As an individual, the Privacy Act gives you greater control over the way that your personal information is handled.” Again, the act argue that individuals need to know why their information is being collected, which entity will be disclosed to and even how that information will be used. This means that personal privacy is taken seriously, and users’ data cannot be shared with other organization without the user knowledge.
Scenario 1
How does this scenario work from this Facebook experience:
- Facebook connect and sync with various organization that handle and process user information or activities such as google, when performing search, usage of browsers stored cookies when browsing online for our daily activities as our activities depends mostly on our need or desire.
- So, any activity that we perform online during our day-to-day life is being tracked and saved in the browser by cookies capabilities, whether is navigating social media, browse our banking website, filling the online forms. This information is taken and shared to all organization in the agreement.
- Then all this information is taken and analyze by the organizations in accordance to their products then perform advertisement accordingly. This is why we can see Ads that suit our interest in just less than a minute after browsing from one device which is either connected to the same network or login with same account.
- This can escalate to all devices connected to the same network
Referring to the Visual argument bellow explain the fact about this feature with support attached
Figure 1
In this visual argument I demonstrate my support that user has right to know how their information are being used, this fact will be appreciated by the society as it gives people the hint of the kind of information to protect against online malicious activities. Furthermore, I expressed my dissatisfaction on the fact of sharing user’s data with other organization without user consent as this act represent a big risk to user personal information as it can be compromised or even hacked.
Scenario 2
Another scenario demonstrating how financial institution share our personal data.
Financial or landers institutions such as bank, mortgage lander or credit card issuer can share any information at any time with credit report agencies and they also have no requirement to do so. The credit report agencies act as a warehouse of our personal and financial information that all these financial institutions can send report to and refer from about how the client pay their bill or credit to determine the eligibility of the client. When the agency has collected individuals’ data it generates a credit report and sale them to landers institutions.
On the other hand, the client is covered by the low regarding accessibility of your information.
When your information is reported to the reporting agencies you have immediately considerable amount of rights under the Fair credit reporting act [13]
There is a security concern about this method of information sharing due to the fact that credit report agencies are a central point of all our data in relation to financial. If the system is compromised or the agency become a subject to cyber-attack, can cause a major damage to the public and risk of customers information being disclosed. Looking back to the massive data breach of Equifax Credit Report where millions of customers personal and sensitive data have been disclosed.
How information is shared between individual and organization
For organization to better serve users and clients, individuals’ information is needed to recognize the person to be served. Example of purchasing online where you have to enter personal information as identifies to recognize who has perform the purchase.
According to [14] in their research they demonstrate different Hypothesis around sharing of personal information, the way information is exchanged between individuals and organization. In our case, we focus on the 2nd hypothesis where people value their personal data differently depending on the data type. The authors demonstrate the level of utility of various data type and list some top records as the one showing the lowest utilities. They mention data such as financial data, credit card data and health record. Therefore, these data are considered private. Furthermore, the author argue that consumers appear to be highly protective and have the less will to share these data and consider them highly sensitive data. And on the network perspective is considered the most confidential data type that should be taken care and highly secured while traveling on the network. Again, the author state in the finding that the majority of social network users do not behave in accordance to their privacy concerns.
In my point of view, I agree with the author hypothesis on the fact that financial data, credit card data and health record constitute the Most sensitive information that is attached with the highest risk of compromising and negatively impacting individuals. People have worries to share such information which result in being more protective against financial theft, cyber bullying that can result from individual medical record being disclosed to third party.
In that case throughout this research, in most literatures majority of authors focus on the privacy, securing sensitive information applying necessary security control internally inside the organization but forget about another very sensitive aspect of data type that is the “User Access Credentials”.
With the today trend and revolution of technology, most business, organization and government institution have adopted the usage of technology as the easiest solution for customer to access the services but as this access is through online platform and the user need to be identified to make sure the service is delivered to the right person, in this case, access level and user credential need to be generated for each user to access the service, example: accessing your Bank account, medical information, check you purchase online and so on. This revolution makes this type of data more sensitive and confidential because now with just a hand on someone credentials such as username and password, one can be able to access sensitive information of a person and miss use them.
There is a major security concerns discovered here:
How user access this information and modify the information when needed.
I will start with a common scenario from organization perspective when the user wants to modify their information or access a service.
- In case of login online, client is prompt to enter the Username and password and nowadays systems have another layer of security a multifactor Authentication if client has set it up, and in most case they don’t due to limitation in technology wise.
- When the user ring a company to modify or access sensitive information,
The client is asked a combination of question to constitute a strong security layer in order to access information, data such as:
- First name and last name
- Date of birth
- Mobile phone number and this is read for you to confirm the last 3 digit.
- In some cases, you are asked to provide the address
- In case of insurance, you are asked the member number or car Registration number.
When analyzing this way of performing security checks in the organization, I found the result of this as the very basic method of performing security check, why? Because:
- Many of these information is publicly exposed, almost everyone knows each other first and last name and we can hear even from presentation on different activities
- Everyone celebrate birthdays nowadays and nothing is hidden on that aspect
- The car plates number are open to public on the road due to the help that it provides to the government to identify vehicle and owners
- Social media exposures, big part of these information is commonly exposed on social media and people are posting more information of daily activities which identifies them more
With this represent a high risk of mis presentation or impersonation and can easily give access to unauthorized people on others information,
I propose that businesses and organization to improve or adopt a different Authentication and authorization approach such as:
- Biometric Authentication: where the person can be identified and authenticated based on recognizable and verifiable data, unique and specific. Example voice recognition system, fingerprint system
- Authenticate users based on what they know such as Security questions upon access request, provision of unique security code that some can easily be kept in mind. Like many banks does which I strongly encourage
- Application of the Multi factor Authentication method and preferably using mobile number or email or a combination of both rather than authentication mobile application as if the user gets hacked or compromised can easily be locked out of the app and won’t get back in.
- Usage of Single sign on system as it helps securely login and authenticated through organization website.
privacy concerns about personal information
In personal information handling, privacy is the main concern that has been there for years and still remain the main concern up to date. As all battle start from knowing information about the adversary, all cyber-criminal and attackers start from finding about the victim. According to [5], they demonstrate different levels of privacy concerns and explore it impact in different variables represented as dependent including the willingness to disclose or provide information to an entity or to deliberately transact the information either online or peer to peer. Then again, the author here argues that there are four major concerns about privacy which include Privacy, Accuracy, accessibility and property but with strong argument on the Privacy as the major concern. This led my argument to confirm that it remains the very major concern at all levels including organization as well as individuals.
Referring back to [8] they pose arguments that control over personal information in social network is negatively associated with the disclosure of information. However, they show the strong side and positive impact of security notification as well as user awareness when information is being disclosed or shared.
In my perspective on privacy concerns, I strongly urge organizations to establish control with a combination of both security mechanism over transaction of personal information and user awareness in order to come up with best and strong measures to protect the user information.
Without organization improving the way of securing personal information and providing strong user awareness, data will remain dangerous risk to the society as well as to national security and economy.
Comparing the Equifax credit report agency Data breach where customers sensitive information was exposed and around 143 million users were affected including names, social security numbers, dated of birth, driver’s license as well as the credit card number that was stolen [15] [16] and the recent Optus data breach, Optus as Big among the largest Internet Service Provider in Australia, But has been subject to the cyber-attack on the 22 September 2022 where personal information of their customers of around 9.8 million has been compromised and disclosed such as: Driver’s licenses, Medicare card information, names, date of birth, passport number. [10] . This definitely shows that strong security control must be put in place and review from time to time and improvement of security over information privacy is highly needed.
Following the Interview of Information and Privacy Commissioner ANGELINE FALK at ABC television, [17] argues on the fact that the privacy act stipulate that the organization need to collect only necessary information for their function and usage because collecting information can be a benefit, create innovation and economic value but can also create a risk for the economy and the community. This is due to the significant amount of personal data that Optus was handled.
Information classification
As mentioned in information sharing section that people value information depending on the type of information needed by the organization, several types of information has been considered as private and sensitive as well as confidential. financial data, credit card data and health record has been identified as the most sensitive data but also argued on the fact that user credentials is also the most critical type of data.
For better handling personal information, it is very important to know every type of data organization possess and transact as well as the ones that need to be destroyed. Knowing these types of data and categorize them shape the way security can be implemented in the organization level over personal data.
According to [7] information is classified according to it level of confidentiality listed in category: Level 1, Level 2 and Level 3 where we have Confidential data, Sensitive data and public data. And describe the way this information can be interacted with in terms of accessibility, disclosure safeguard of information in transit, security of stored as well as disposal of information.
This author categorizes information depending with the level of need and integrity of data as such:
- Confidential: considered high need and level 1 protection and that special care is required
- Sensitive: has medium need as level 2 and urge people to be cautious about it
- Public: as lowest needed data and mark as level 3 and this requires awareness.
After deep analysis and research on best personal data handling procedure, I realized this is a critical and complex duty to organizations due to the trend of technologies today which incite people to disclose their information even unconsciously as well as the value that everyone gives to information. That led my research to construct a considerable way of data classification that can be adopted by organization before implementing security over personal information.
- Confidential information: this type information has a highest volume of risk; therefore, it requires a maximum level of security implementation. It is a dangerous sort of data that has significant consequences over personal information. The data can be such as User login credentials, security pin or code. And can be shared with a very limited number of people or among the user and organization.
- Sensitive information: the organization has responsibility to Highly secure this type of information as they are attributes attached to the personality of a person and can trigger bias or prejudice. This information can be such as political opinion etc. once this information is compromised individual can be subject to cyber bullying or other form of cyber-attack. Can also be a combination of information handled by the organization such as financial data etc.
- Private information: when the organization need some private information from individuals in order to constitutes the right amount of information to better serve the customer, we end up sharing with them an amount of personal or private information such as date of birth, first and last name, drivers’ licenses, Medicare information and this can result into many attacks. So, the right amount of protection is needed in terms of accessing this information, sharing of the information, storing these info as well as when disposing this information.
- Critical information: This is the information that can quickly cause ham or lead to big consequences. This mostly regards individuals and need their attention in order to know what to share online with others because cyber-criminal can put together all information publicly available to constitute an attack. It requires the organization to provide a proper user awareness on what information to share to public and when to share that information.
- Important information: this is the information that is important to the user and limited to specific group of people of entity.
- Public information: This information can be made publicly available and considered by both organization and individual to have low risk of causing harm.
Once the organization categorize each available information to the right position, security measures and controls can be implemented accordingly. This will allow the right protection to be applied to the right information.
Rights and Responsibilities in information handling
For the personal information to be handled in a quality manner and securely, everyone associated to personal data has number of responsibilities toward the management of personal data. After analyzing the flow of personal data during it transaction, we distinguished each concerning party that play a role which are follow:
In accordance with the Australian privacy act regulation, [2] individuals are given control over the way their information is being handle by organization, this give power to individuals to be able to monitor how their information is being used. The act state that:
- As an individual you have right to know the reason why your personal information is being collected, how it will be use and to which entity it will be disclosed
- Gives the flexibility to not identify yourself or using the pseudonym when necessary
- Having right to access your personal information and modify it when necessary
- Individual has also the right to report any agency that handle personal data if they misused them.
In regard to responsibilities, after research I come to conclusion that individuals have responsibility of control the type of data they want to disclose or share with either organization or public, to avoid any sort of risk to information.
- Organizations and Government agencies
When it comes to responsibilities, organizations that handle personal data have the major responsibilities toward security of personal information. They need to establish and apply security from the bottom ground when they start collecting personal data, secure data at rest, in transit, and at disposal of data.
The Australian privacy act state that all government agencies and organization with an annual turnover more than $3 million have responsibilities under the privacy act.
Security measures and mechanisms to use in personal information handling
Following is proposed mechanism that can be used in managing personal data:
- Entities can put in place additional controls to protect their customers against identity theft
- Need to review security control that was set at the time of data breach and improve to protect from future breach
- The government need to put in place a centralize approach to provide enough expertise in handling the data breach
- All business needs to make sure they have in place the right protection for users’ personal information
- Nee to elaborate strong privacy policies and notices
- From the low perspective it is recommended for the government to have a positive obligation to all organization on how to handle personal data in a reasonable way depending on the sensitivity level of data and the risk attached to it
Proposed Security framework on handling personal information
- When collecting the information organization need to focus on getting only necessary information they need, this will help avoid the risk in relation to data at rest, because when the data is sitting in the disk storage or database without being used can be vulnerable to data loss or exploitation. The reason for this risk to happen is that these unused data will not benefit from security update and latest framework for active data.
- Perform a classification of personal information in accordance to it level of sensitivity such as highly sensitive, medium, private and public. This will allow a better implementation of security and access control level to personal information.
- Perform a risk assessment to each data classification by defining the sensitivity level of data, analyze to find all the risk associated to it, how vulnerable is the type of information, determine possible threat and attacks attached to the type of information.
- Find all possible solution to risk raised according to each type of data.
- Develop security controls accordingly, both Technical and administrative controls
- Develop policies that protect both this framework and data handling procedure from being violated.
- Apply encryption to personal information, either the data is at rest or in transit.
- Develop a user’s and employees awareness program for them to have enough knowledge about the system, risk attached to personal information, privacy concerns, type of attacks and how to protect both individual and organization from these attacks.
- Develop a notification channel for when the data breach or security event happen
- Develop an incident response plan to make sure the data is taken a good care in case of data breach.