What is Data Privacy?

Achieving Data Privacy Amid a Forest of Compliance and Security Challenges

Defining data privacy may resemble dissecting the complexity of tree rings. However, as with trees, the concepts all fit together to comprise a sturdy and protective structure. In this case, think of a structure that consists of data. 

To understand how “tree rings” make up the inner workings of the overall structure, we must first learn what they’re made of. So we should start with defining the data itself. There are many different types that all work together and comprise our data-driven world. Without delving too deeply into data science, the most common types of data include these broad categories: 

• Quantitative data like test scores and temperatures can be expressed in numbers and measured.
• Qualitative data addresses “why and how” and can’t be expressed in a number. Think of words, colors, names, pictures, and symbols (not numbers). Qualitative data can’t be measured. 
• Nominal data is just a label with no order to it, like gender, hair color, and ethnicity. 
• Ordinal data shows the sequence and expresses where a number stands in a specific order or position on a scale. It’s qualitative data, like grades, winners of places in a competition, or ratings on a scale.
• Discrete data can’t be divided into parts. Think of test questions you answered correctly or the number of home runs in a baseball game.
• Continuous data can be divided and sometimes very precisely, like height in millimeters or inches or the exact speed of a car.

All of these various types play a role in understanding the richness of the world and managing one’s business and personal life.

What is Data Privacy?

Data privacy (information privacy) is an aspect of data protection that refers to the proper handling of all these types of data. We can think of data privacy in terms of personal data such as Personally Identifiable Information (PII), addresses, phone numbers, and credit card numbers. Data privacy extends to confidential health information and intellectual property as well. Data privacy involves rules and guidelines, practices, and tools, and of course, these bring in the concept of privacy compliance. 

Data privacy forms and encompasses legal frameworks like legislation; policies such as business rules that protect employees; practices that guide management of this information through best practices; third-party associations that deal with data, like a cloud service provider; data governance which covers storage, security, retention, and access to data according to standards; and global requirements or regulations that cover variables of data privacy set by legal jurisdictions such as the European Union (EU) or the United States.

The concept of data privacy comes under the umbrella of data protection and data security. Data protection is the way we ensure privacy, availability, consistency, and the immutability or integrity of data.  

Data privacy in the context of business is particularly relevant as it identifies customers, defines a business’s infrastructure, and even enables training of machine learning and AI systems—among many other uses.  

The Tree Rings: Data Privacy Seen Through Human Eyes

These numerical and legal definitions play a part in the structure of the tree itself. To continue and stretch the metaphor a bit, think of a breach of data privacy as an axe that cuts through the tree, breaks its integrity, and in many cases, is capable of destroying it. When data privacy is compromised, the tree is no longer a trustworthy structure and cannot hold itself up, shelter, or protect anything or anybody else. Its sovereignty is no longer valid. This is why data privacy is so important and forms the rationale for a dizzying span of complex laws and regulations.  

GDPR and other data laws

According to Wikipedia, "the General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area.” GDPR is widely considered the toughest privacy and security law in the world. Its purpose is to provide the widest and most harmonious aggregation of all the laws of EU member countries and protect the rights of individuals. But countless other laws apply to different areas, such as the Health Insurance Portability and Accountability Act (HIPAA) and the Electronic Communications Privacy Act (ECAP), which deals with wiretap restrictions and the transmission of electronic data. 

Data Security and Data Privacy are Not the Same Concepts

Data security and data privacy overlap but are definitely not two ways of saying the same thing. Data security focuses on the protection of a business’s technology and tools in order to deter cyberattacks. It protects sensitive information such as social security numbers, credit card information, or bank accounts from those who would steal or corrupt it.  

Data privacy focuses on individuals, such as what types of PII may be collected and what can be done with it. Businesses must ensure that only the proper level of access rights are granted to people, partners, and the general public.

Data privacy involves regulatory compliance with local and federal laws within and outside your industry. These safeguard sensitive data and make sure that a business follows the steps to carry that out. Data security measures include protections like multi-factor authentication and identity management. These protect the tree's integrity from the axes of cybercriminals and nation-state attacks. They prevent a breach and safeguard the data that is a company’s or an individual’s most valuable asset. They also protect the company or individual from being held accountable for data breaches of other entities or individuals that can harm them and cost them substantially.  

Data Privacy and Data Health

These two concepts go together and are important in keeping the “tree of data” viable and healthy. Healthy data means it is available to those who need it; it is trustworthy and accurate as it claims to be, and it will be reliable when used for decision-making. If customer data is not properly maintained or is siloed and not accessible to those who need it, the value of the “tree” will be impacted and will also place an entity in noncompliance—which can lead to complex lawsuits and hefty fines.  

Guaranteeing Integrity Throughout the Data Lifecycle 

Data lifecycle management is all about securing the impermeability and integrity of data throughout its lifecycle. That lifecycle is commonly defined as consisting of five stages: creation (such as data entry); storage; usage; archival; and destruction. The tools, technology, and devices that make up a business, as well as the company website and databases, must be safe and secure throughout all of these stages of the lifecycle. Data privacy ensures that you follow the appropriate industry, federal, or local regulations. It protects the “tree” of data and those who rely on it for various uses.  

Anjuna Enables Enterprises to Secure Data Privacy 

A company's responsibility to protect customer information is paramount and can cause significant problems if a company falls out of compliance. Anjuna Security provides the ability to protect data in use, in transit, and at rest. Protecting all three states helps companies shield customers’ private data from external hackers and malicious insiders, making complex regulatory compliance achievable. 

Anjuna Confidential Computing software uses enclave technology as a foundation for privacy by default: creating a trusted execution environment (TEE) that works off security features belonging to respective CPU vendors. The vendors enable encryption and decryption within the CPUs themselves, isolating data and memory. To simplify deploying TEEs, Anjuna innovated technology to ease and speed Confidential Computing implementation.  

Anjuna’s enterprise-ready solutions let customers implement Confidential Computing to create an isolated, hardened, hardware-encrypted Confidential Computing environment where businesses can run applications with confidence and minimal performance impact.