In early March, cybersecurity professionals around the world filled the San Francisco Moscone Convention Center’s sprawling exhibition halls to discuss and learn about everything infosec, from public key encryption to incident response, and from machine learning to domestic abuse.
It was RSA Conference 2019, and Malwarebytes showed up to attend and present. Our Wednesday afternoon session—“One person can change the world—the story behind GDPR”—explored the European Union’s new, sweeping data privacy law which, above all, protects “personal data.”
End Date: Tuesday Dec-24-2019 9:44:42 PST
Buy It Now for only: $0.99
Buy It Now | Add to watch list
End Date: Monday Dec-9-2019 6:00:35 PST
Buy It Now for only: $3.96
Buy It Now | Add to watch list
the law’s broad language—and
finite, severe penalties—left audience members with a lingering
question: What exactly is personal
answer: It depends.
data, as defined by the EU’s General Data Protection Regulation, is not the
same as “personally identifiable information,” as defined by US data protection
and cybersecurity laws, or even “personal information” as defined by
California’s recently-signed data privacy law. Further, in the US, data
protection laws and cybersecurity laws serve separate purposes and, likewise,
bestow slightly separate definitions to personal data.
Complicating the matter is the public’s instinctual approach to personal information, personal data, and online privacy. For everyday individuals, personal information can mean anything from telephone numbers to passport information to postal codes—legal definitions be damned.
Today, in the latest blog for our cybersecurity and data privacy series, we discuss the myriad conditions and legal regimes that combine to form a broad understanding of personal information.
Companies should not overthink this. Instead, data privacy lawyers said businesses should pay attention to what information they collect and where they operate to best understand personal data protection and compliance.
As Duane Morris LLP intellectual property and cyber law partner Michelle Donovan said:
it comes down to, is, it doesn’t matter what the rules are in China if you’re
not doing business in China. Companies need to figure out what jurisdictions
apply, what information are they collecting, where do their data subjects reside,
and based on that, figure out what law applies.”
The personal information that companies need to protect changes from law to law. However, even though global data protection laws define personal information in diverse ways, the definitions themselves are not important to every business.
For instance, a small company in California that has no physical presence in the European Union and makes no concerted efforts to market to EU residents does not have to worry about GDPR. Similarly, a Japanese startup that does not collect any Californians’ data does not need to worry about that state’s recently-signed data privacy law. And any company outside the US that does not collect any US personal data should not have to endure the headaches of complying with 50 individual state data breach notification laws.
Baker & McKenzie LLP of counsel Vincent Schroeder, who advises companies on privacy, data protection, information technology, and e-commerce law, said that the various rules that determine which laws apply to which businesses can be broken down into three basic categories: territorial rules, personal rules, and substantive rules.
rules are simple—they determine legal compliance based on a company’s presence
in a country, state, or region. For instance, GDPR applies to companies that
physically operate in any of the EU’s 28 member-states, along with companies
that directly market and offer their products to EU citizens. That second rule
of direct marketing is similar to another data privacy law in Japan, which
applies to any company that specifically offers its products to Japanese
the ‘marketplace rule,’ they call it,” Schroeder said. “If you’re doing
business in that market, consciously, then you’re affecting the rights of the
individuals there, so you need to adhere to the local regulatory law.”
rules, on the other hand, determine compliance based on a company’s
characteristics. For example, the newly-passed California Consumer Privacy Act
applies to companies that meet any single one of the following three criteria:
pull in annual revenue of $25 million, derive 50 percent or more of that annual
revenue from selling consumers’ personal information, or buy, receive, sell, or
share the personal information of 50,000 or more consumers, households, or
Businesses that want to know what personal information to legally protect should look first to which laws apply. Only then should they move forward, because “personal information” is never just one thing, Schroeder said.
an interplay of different definitions of the territorial, personal, and
substantive scopes of application, and for definitions of personal data,” Schroeder
The meaning of personal information changes depending on who you ask and which law you read. Below, we focus on five important interpretations. What does personal information mean to the public? What does it mean according to GDPR? And what does it mean according to three state laws in California—the country’s legislative vanguard in protecting its residents’ online privacy and personal data.
be clear: Any business concerned with legal obligations to protect personal
information should not start a compliance journey by, say, running an employee
survey on Slack and getting personal opinions.
That said, public opinions on personal data are important, as they can influence
lawmakers into drafting new legislation to better protect online privacy.
Umawing, senior content writer for Malwarebytes Labs who recently compiled nearly
4,000 respondents’ opinions on online privacy, said that personal
information is anything that can define one person from another.
“Personal information for me is relevant data about a person
that makes them unique or stand out,” Umawing wrote. “It’s something intangible
that one owns or possesses that (when combined with other information) points back to the person
with very high or unquestionable accuracy.”
Pieter Arntz, malware intelligence researcher for Malwarebytes,
provided a similar view. He said he considers “everything that can be used to
identify me or find more specific information about me
as personal information.” That includes addresses, phone numbers, Social
Security numbers, driver’s license info, passport info, and, “also things like
the postal code,” which, for people who live in very small cities, can be revealing,
Interestingly, some of these definitions overlap with some of the
most popular data privacy laws today.
2018, the General Data Protection Regulation took effect, granting EU citizens
new rights to access, transport, and delete personal data. In 2019, companies
are still figuring out what that personal data encompasses.
The text of the law offers little clarity, instead providing this ocean-wide ideology: “Personal data should be as broadly interpreted as possible.”
According to GDPR, the personal data that companies must protect includes any information that can “directly or indirectly” identify a person—or subject—to whom the data belongs or describes. Included are names, identification numbers, location data, online identifiers like screen names or account names, and even characteristics that describe the “physical, physiological, genetic, mental, commercial, cultural, or social identity of a person.”
last piece could include things like an employee’s performance record, a
patient’s medical diagnosis history, a user’s specific anarcho-libertarian
political views, and even a person’s hair color and length, if it is enough to
determine that person’s identity.
Donovan, the attorney from Duane Morris, said that GDPR’s definition could include just about any piece of information about a person that is not anonymized.
“Even if that information is not identifying [a person] by name, if it identifies by a number, and that number is known to be used to identify that person—either alone or in combination—it could still associate with that person,” Donovan said. “You should assume that if you have any data about an individual that is not anonymized when you get it, it’s likely going to be covered.”
California Consumer Privacy Act
June 2018, California became the first state in the nation to respond to frequent
online privacy crises by passing
a comprehensive, statewide data privacy law. The California Consumer
Privacy Act, or CCPA, places new rules on companies that collect California
residents’ personal data.
law, which will go into effect in 2020, calls this type of data “personal
“Personal information,” according to the CCPA, is “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”
that includes in practice, however, is a broad array of data points, including
a person’s real name, postal address, and online IP address, along with
biometric information—like DNA and fingerprint data—and even their browsing
history, education history, and what the law vaguely describes as “audio,
electronic, visual, thermal, olfactory, or similar information.”
from protecting several new data types, the CCPA also makes a major change to how
Californians can assert their data privacy rights in court. For the first time
ever, a statewide data privacy law details “statutory damages,” which are legislatively-set,
monetary amounts that an individual can ask to recover when filing a private
lawsuit against a company for allegedly violating the law. Under the CCPA,
people who believe their data privacy rights were violated can sue a company and
ask for up to $750.
This is a huge shift in data privacy law, Donovan said.
“For the first time, there’s a real privacy law with teeth,” Donovan said.
if individuals wanted to sue a company for a data breach, they needed to prove
some type of economic loss when asking for monetary damages. If, say, a
fraudulent credit card was created with stolen data, and then fraudulent
charges were made on that card, monetary damages might be easy to figure out. But
it’s rarely that simple.
“Now, regardless of the monetary damage, you can get this statutory damage of $750 per incident,” Donovan said.
data breach notification law and data protection law
If we stay in California but go back in time several years, we see the start of a trend—California has been the first state, more than once, to pass data protection legislation.
In 2002, California passed its data breach notification law. The first of its kind in the United States, the law forced companies to notify California residents about unauthorized access to their “personal information.”
previous definitions of personal information and data that we’ve covered—GDPR’s
broad, anything-goes approach, and CCPA’s inclusion of heretofore unimagined “olfactory,” smell-based
personal data—do not apply here.
Instead, personal information in the 17-year-old law—which received an update five years ago—is defined as a combination of types of information. The necessary components include a Californian’s first and last name, or first initial and last name, paired up with things like their Social Security number, driver’s license number, and credit card number and corresponding security code, along with an individual’s email address and password.
if a company suffers a data breach of a California resident’s first and last
name plus their Social Security
number? That’s considered personal information. If a data breach compromises
another California resident’s first initial, last name, and past medical
insurance claims? Once again, that data is considered personal information,
according to the law.
In 2014, this definition carried somewhat over into California’s data protection law. That year, then-California governor Jerry Brown signed changes to the state’s civil code that created data protection requirements for any company that owns, licenses, or maintains the “personal information” of California residents.
to Assembly Bill No. 1710, “personal information” is, once again, the
combination of information that includes a first name and last name (or first
initial and last name), plus a Social Security number, driver’s license number,
credit card number and corresponding security number, and medical information
and health information.
The definitions are not identical, though. California’s data protection law, unlike its data breach notification law, does not cover data collected by automated license plate readers, or ALPRs. ALPRs can indiscriminately—and sometimes disproportionately—capture the license plate numbers of any vehicles that cross into their field of vision.
one year later, California passed a law to strengthen protections of ALPR-collected
now, it’s probably easier to define what personal information isn’t rather than
what it is (obviously, there is a legal answer to that, too, but we’ll spare
the details). These evolving definitions point to a changing legal landscape, where
data is not protected solely because of its type, but because of its inherent
importance to people’s privacy.
as there is no one-size-fits-all definition to personal information, there is
no one-size-fits-all to personal data protection compliance. If a company finds
itself wondering what personal data it should protect, may we suggest something
we have done for every blog in this series: Ask a lawyer.
us again soon for the next blog in our series, in which we will discuss
consumer protections for data breaches and online privacy invasions.
The post What is personal information? In legal terms, it depends appeared first on Malwarebytes Labs.
Powered by WPeMatico