IB Computer Science A.3.6 Privacy of Personal Data Notes

1. Personal data refers to any information that can identify an individual.
2. This includes details like names, addresses, phone numbers, email addresses, and even more sensitive information such as medical records or financial data.

Methods to Ensure Privacy of Personal Data

1. Data Encryption:
   1. Encrypting data ensures that even if unauthorized individuals access the data, they cannot read it without the decryption key.
   2. Encryption should be applied both at rest (when data is stored) and in transit (when data is being transmitted over networks).
2. Access Control:
   1. Implementing strict access controls ensures that only authorized personnel can access sensitive data.
   2. This includes using role-based access control (RBAC), where users are granted permissions based on their roles within an organization.
3. Anonymization:
   1. Anonymizing data involves removing or masking personally identifiable information (PII) so that individuals cannot be identified.
   2. This is especially important when sharing data for research or analysis.
4. Regular Audits and Monitoring:
   1. Conducting regular audits helps identify potential vulnerabilities in the system.
   2. Monitoring access logs can detect unauthorized access attempts and ensure compliance with privacy policies.
5. Strong Authentication Mechanisms: Using multi-factor authentication (MFA) adds an extra layer of security, making it harder for unauthorized users to gain access.

Responsibility of Data Holders

1. Organizations that collect and store personal data have a legal and ethical responsibility to protect it.
2. This includes ensuring that data is not sold or disclosed without the individual's consent.