Building Effective Privacy Programs

Jason Edwards, DM, CISSP, is an accomplished cybersecurity leader with extensive experience in the technology, finance, insurance, and energy sectors. Holding a Doctorate in Management, Information Systems, and Technology, Jason specializes in guiding large public and private companies through complex cybersecurity challenges. His career includes leadership roles across the military, insurance, finance, energy, and technology industries. He is a husband, father, former military cyber officer, adjunct professor, avid reader, dog dad, and popular on LinkedIn. Griffin Weaver is the Managing Legal Director (Privacy, Cybersecurity, and Technology) at Dell Technologies. He holds a Juris Doctorate and is a Fellow of Information Privacy (FIP). Weaver specializes in digital law, privacy governance, and cybersecurity policy. He is a sought-after speaker and educator who has taught privacy and cybersecurity law at leading institutions, regularly contributes to industry publications, and presents at global conferences on privacy, data protection, and digital rights.

• Preface xiAcknowledgement xiii1 Introduction to Privacy 1Definition and Importance of Privacy 1Historical Perspective on Privacy 5Modern Privacy Challenges 10Recommendations 16Chapter Conclusion 17Questions 172 Understanding Personal Data 21Definition and Types of Personal Data 21Sensitive Personal Data 27Data Combinations and Anonymization 32Recommendations 37Chapter Conclusion 38Questions 383 Data Processing 41Definition and Types of Processing 42Legal Bases for Processing 48Data Processing Principles 54Recommendations 60Chapter Conclusion 60Questions 614 Roles and Relationships 65Data Controller vs. Data Processor 65Subprocessors 75Data Subjects and Their Rights 80Recommendations 84Chapter Conclusion 85Questions 865 Privacy Impact Assessments 89Purpose and Benefits of PIA 89Conducting a PIA 94Example of PIA 96PIA Templates and Examples 101Recommendations 107Chapter Conclusion 108Questions 1096 Roles in Privacy Leadership 113Chief Privacy Officer 113Chief Information Security Officer 116Data Protection Officer 118Privacy Champions 121Privacy Engineers 123Recommendations 127Chapter Conclusion 129Questions 1297 Data Subject Rights 133Foundational Frameworks 133Handling Data Subject Requests 140DSR Tools and Techniques 145Recommendations 151Chapter Conclusion 152Questions 1528 Privacy Frameworks and Standards 157NIST Privacy Framework: Mapping Organizational Practices to the Framework 157Iso/iec 27701 160Other Notable Frameworks: GDPR, CCPA, PIPL, and LGPD 166Recommendations 172Chapter Conclusion 173Questions 1749 Major Privacy Laws and Regulations 177Laws and Regulations 177California Consumer Privacy Act 185Health Insurance Portability and Accountability Act 190Comparative Analysis of Global Regulations 198Recommendations 200Chapter Conclusion 201Questions 20210 International Privacy Concerns 205Cross-Border Data Transfers 205Adequacy Decisions 213BCRs and SCCs 218Recommendations 223Chapter Conclusion 224Questions 22511 Regulatory Enforcement 229Role of DPAs 229Case Studies of Regulatory Actions 240Recommendations 244Chapter Conclusion 246Questions 24612 Privacy by Design and Default 251Principles of Privacy by Design 251Implementing Privacy by Default 255Case Studies and Best Practices 258Recommendations 262Chapter Conclusion 263Questions 26313 Privacy Technology and Tools 267PETs: Anonymization vs. Pseudonymization 267Data Masking and Encryption 270Privacy Management Software 275Recommendations 278Chapter Conclusion 280Questions 28014 Data Breach Management 283Identifying and Responding to Data Breaches 283Notification Requirements 288Postbreach Remediation 292Recommendations 296Chapter Conclusion 298Questions 29815 Emerging Privacy Trends 301AI and Privacy 301IoT and Privacy 305Blockchain and Privacy 310Recommendations 315Chapter Conclusion 316Questions 31716 Privacy Program Implementation 321Establishing a Privacy Governance Structure 321Developing Privacy Policies and Procedures 326Implementing Privacy Controls and Measures 333Monitoring and Reporting on Privacy Compliance 339Continuous Improvement of the Privacy Program 346Recommendations 354Chapter Conclusion 355Questions 35617 Privacy Training and Awareness 359Developing Effective Privacy Training Programs 359Engaging Employees in Privacy Awareness 364Training Tools and Resources 368Sample Annual Privacy Training Plan 369Recommendations 372Chapter Conclusion 373Questions 37318 Privacy Audits and Assessments 377Essential Program Components 377Using Assessment Tools 382Integrating Assessments with Risk Management 385Reporting and Follow-Up Actions 387Recommendations 389Chapter Conclusion 390Questions 390Answers 395Index 421