Privacy Principles Melinda Clarke

Instructions and Game Introduction Everyone should have 3 things: a card BINGO board marker We’ll review the privacy principles Each scenario has associated data elements and uses Get 5 privacy principles in a row on the BINGO board to win!

Use, Retention, Disposal Privacy Principles Notice Choice and Consent Collection Use, Retention, Disposal Access Disclosure Security for Privacy Quality GAPP Privacy Principles: https://www.cippguide.org/2010/07/01/generally-accepted-privacy-principles-gapp/ Notice: The organization provides notice of its privacy policies and procedures. The organization identifies the purposes for which personal information is collected, used and retained. Choice & Consent: The organization describes the choices available to the individual. The organization secures implicit or explicit consent regarding the collection, use and disclosure of the personal data. Collection: Personal information is only collected for the purposes identified in the notice. Use, Retention, Disposal: The personal information is limited to the purposes identified in the notice the individual consented to. The organization retains the personal information only for as long as needed to fulfill the purposes, or as required by law. After this period, the information is disposed of appropriately. Access: The organization provides individuals with access to their personal information for review or update. Disclosure: Personal information is disclosed to third parties only for the identified purposes and with implicit or explicit consent of the individual. Security for Privacy: Personal information is protected against both physical and logical unauthorized access. Quality: The organization maintains accurate, complete and relevant personal information that is necessary for the purposes identified. Data Types: Postal mail address Phone number Use: Data Element Marketing: Name and Email address Billing: Bank Account Number Social Media: Name and Location Social Media: Username and User Generated Content

Data Elements: Name, User Generated Content, Location PRIVACY PRINCIPLES Notice Choice & Consent Access Disclosure Collection Use, Retention, Disposal Security Quality Data Elements: Name, User Generated Content, Location Use: Law Enforcement Requests Source: https://www.vice.com/en_us/article/xwnva7/snapchat-employees-abused-data-access-spy-on-users-snaplion Security: Controls were in place but may not have been implemented appropriately

Data Element: Bank Account Number Use: Billing PRIVACY PRINCIPLES Notice Choice & Consent Access Disclosure Collection Use, Retention, Disposal Security Quality Data Element: Bank Account Number Use: Billing Source: Quality: Data wasn’t accurate.

Data Element: Email Address Use: Account Verification PRIVACY PRINCIPLES Notice Choice & Consent Access Disclosure Collection Use, Retention, Disposal Security Quality Data Element: Email Address Use: Account Verification Source: https://www.businessinsider.com/facebook-uploaded-1-5-million-users-email-contacts-without-permission-2019-4 Collection: Collected it for a secondary purpose from what it was intended for Use, Retention, Disposal: Used for a secondary purpose, not deleted after use.

Data Elements: Name and Email Address Use: Marketing PRIVACY PRINCIPLES Notice Choice & Consent Access Disclosure Collection Use, Retention, Disposal Security Quality Data Elements: Name and Email Address Use: Marketing Source: https://www.zdnet.com/article/pregnancy-club-fined-400000-for-sharing-data-of-over-14-million-people/ Notice: Didn’t tell them what was their data was going to be used for Collection: Collected it for a secondary purpose from what it was intended for Choice/Consent: Didn’t give them an opportunity to choose what their info was used for Disclosure: Shared with a 3rd party without a business need or consent Use, Retention, Disposal: Used for a secondary purpose.

Data Elements: Name and Location Use: Social Media PRIVACY PRINCIPLES Notice Choice & Consent Access Disclosure Collection Use, Retention, Disposal Security Quality Data Elements: Name and Location Use: Social Media Source: http://pleaserobme.com/ Choice & consent: The ability to choose what you share and with whom

Data Elements: Username and User Generated Content Use: Social Media PRIVACY PRINCIPLES Notice Choice & Consent Access Disclosure Collection Use, Retention, Disposal Security Quality Data Elements: Username and User Generated Content Use: Social Media Source: https://www.businessinsider.com/people-who-got-fired-for-using-twitter-2014-7 Choice & consent: The ability to choose what you share and with whom

Takeaways Be mindful of what you choose to share. Configure your settings. Laugh at Mr. Clarke’s jokes.