Karl Kopper Caltrans Privacy and Chief Information Security Officer
Four Questions Every Auditor Should Know the Answer To
What is What is PII? De- Identification? What is Re-Identification?
Privacy Internal Controls & Behavioral Analytics
1973 1973 First VoIP Call First Touch Screen First Computer Monitor First Ethernet Network First UPC Barcode System First Cell Phone Call
1973 1973 First VoIP Call Touch Screen Developed First Computer Monitor Ethernet Created First UPC Barcode System First Cell Phone Call Martin Cooper Martin Cooper
Personally U.S. Department of Health, U.S. Department of Health, Identifiable Education, and Welfare Education, and Welfare Information “HEW Report” of 1973 “HEW Report” of 1973 • No secret record-keeping systems • Individuals must know what and how • Individuals must be able to correct • Data about individuals must not be reused
Personally Privacy act of 1974 Privacy act of 1974 Identifiable Information The increasing use of computers and sophisticated information technology, while essential to the efficient operations of the Government, has greatly magnified the harm to individual privacy that can occur from any collection, maintenance, use, or dissemination of personal information.
Personally Identifiable Payment Card Industry – Information Data Security Standards Cardholder Data Sensitive Authentication Data Financial
Personally Identifiable Information Health Insurance Portability and Accountability Act of 1996 Individually Identifiable Health Information (IIHI) Health
Personally Office of Management and Budget Office of Management and Budget Identifiable M-17-12 2017 M-17-12 2017 Information To determine whether information is PII, the agency shall perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual.
Personally Identifiable California Consumer Privacy Act Information “You should have the right to know what personal information businesses collect about you and your children and what they do California with it, including to whom they sell it.”
Personally Identifiable California Consumer Privacy Act Information “It is almost impossible to apply for a job, raise a child, drive a car, or make an appointment without sharing your personal California information..”
Personally Identifiable California Consumer Privacy Act Information Consuming History or Tendency Browsing History Geolocation Data Audio, Electronic, Visual, Thermal, Olfactory or Similar Information California
Personally Identifiable California Consumer Privacy Act Information Consuming History or Tendency Browsing History Geolocation Data Audio, Electronic, Visual, Thermal, Olfactory or Similar Information California “Inferences drawn from any of the information identified above”
HIPAA State Gramm-Leach-Bliley GDPR Federa PCI l
Privacy
“The State of California is committed to unlocking the value of government data to propel innovation, improve the delivery of public services and empower the people of California while protecting privacy.” State of California Administrative Manual Section 5160
Privacy Innovation
Innovation 31% of fatal accidents involved alcohol 3,382 fatalities involving a distracted driver Men were drivers in 65% of accidents (2015-2017) 2,790 Lives were saved through the use of Airbags
Innovation De-Identification
Privacy
Governor William Weld Keynote Graduation Address Bentley College 1996
Voter List Health Data Name Visit Date Zip Address Diagnostics Birth Date Party Procedures Gender Voted Latanya Sweeney MIT Graduate Student
Re-Identification
Skiing in Salt Lake
Kiteboarding in La Ventana, Baja, Mexico
Burning Man
700 million activities 1.4 trillion latitude/longitude points 7.7 trillion pixels 5 terabytes data Activity duration = 100 thousand years Burning Man
“Our global heatmap is the largest, richest, and most beautiful dataset of its kind.” Burning Man
Soldiers, remember, rotate from one assignment to the next…
ITS and Locational Privacy: Suggestions for Peaceful Coexistence Hubert H. Humphrey School of Public Affairs University of Minnesota Frank Douma & Sarah Aue 2011 Speed/Red Light Camera Connected Vehicle Carpool Lane Infrared Scanner Privacy Concerns Automated Toll System Loop Detector Traffic Counter
What is What is PII? De- Identification? What does your What is organization do Re-Identification? to protect PII?
Security Information & Event Management
UEBA
U ser & E ntity B ehavior al A nalytics Executive Assets Accessed Insider Threat Compromised Credentials
What is What is PII? De- Identification? What does your What is organization do Re-Identification? to protect PII?
Recommend
More recommend
