As the Director of Business Development for a telecommunications company, data is something I deal with regularly. My company has large amounts of personal and business data flowing through its platforms each and everyday. The collection, handling, and storage of this data is something of utmost importance, as all of it is sensitive information. Prioritizing data privacy for our company has been a competitive advantage in entering new verticals such as healthcare and education. In terms of an education perspective, my undergraduate education was in Political Science, a very data rich field. This prior knowledge combined with my current aspirations of completing the Master's program in Business Administration has only reinforced the severity and importance of data privacy.

Audience:

The audience of this guide is very wide. Any employee that handles or collects personal data for their company, all the way up to business managers and executives. It can also be as an education tool for consumers who willing give their personal data up for services/products that companies provide.

Why This Topic:

I chose this topic because data privacy is a critical concern for both small and large businesses. With the increasing number of data points collected on consumers, so does the potential to mishandle this valuable information, potentially damaging the business and hurting the owner of that data. It is important that those who handle data, know the legal and ethical standards that are expected of them from various levels of government.

The FTC enforces laws concerning consumer protection - including the protection of personal data. It can investigate and take action against businesses that participate in deceptive practices concerning data privacy.

The FTC is the accountability agent at the federal level for any mishandling of data. They have the power to investigate, authority to impose fines and pursue other legal remedies if compliance is not met.

In Text Citation: (U.S. Const. amend. IV)

Link to Full Text: https://constitution.congress.gov/constitution/amendment-4/

• The Fourth Amendment protects individuals from unreasonable searches and seizures by the government.

• Applies to electronic communications and stored files.

• Built to hold government accountable, businesses cannot disclose data with warrant.

In Text Citation: (Tex. Const. art. I, § 9)

Link to Full Text: https://statutes.capitol.texas.gov/Docs/CN/htm/CN.1.htm

• Mirrors the Fourth Amendment of the United States Constitution.

• Applies to electronic communication and data storage.

• Upholds privacy for Texas citizens.

The Attorney General has the authority to investigate and enforce state regulations on businesses in the hopes of protecting the consumers/residents of Texas.

While the data laws in Texas are not as comprehensive as in other states, the Attorney General mandates that all businesses must disclose data breaches to consumers if their information is taken or lost. The Texas Attorney General's Office plays a central role in enforcing data privacy laws and holding businesses accountable if regulations are violated.

Gramm-leach Bliley Act (GLBA)

In Text Citation: (Gramm-Leach-Bliley Act, 1999)

Link to Full Text: https://www.ftc.gov/legal-library/browse/statutes/gramm-leach-bliley-act

• The GLBA regulates the privacy and security of consumers' personal financial information.

• Requires the implementation of safeguards to protect the security and integrity of customers' data.

Administrative

Health Insurance Portability and Accountability Act (HIPPA)

In Text Citation: (Health Insurance Portability and Accountability Act, 1996)

Link to Full Text: https://www.congress.gov/bill/104th-congress/house-bill/3103/text

• Established national standards for the protection of personal health information.

• Requires businesses/healthcare to obtain permission to release information and maintain safeguards.

• Allows consumers to file complaints if their privacy is violated.

Federal Trade Commission (FTC) vs. Wyndham Worldwide Corp.

In Text Citation: Federal Trade Commission (FTC) v. Wyndham Worldwide Corp. (2015).

Link to Full Text: https://www.ftc.gov/legal-library/browse/cases-proceedings/1023142-x120032-wyndham-worldwide-corporation

• FTC sued Wyndham World Wide Corporation alleging that it's failure in not having data security measures led to data breaches that exposed consumers' personal information.

• Set the precedent that the FTC has the authority to regulate and enforce data security practices in the United States. The Supreme Court confirmed the FTC's jurisdiction in holding companies accountable for poor data security.

Children's Online Privacy Protection Act (COPPA)

In Text Citation: (Children's Online Privacy Protection Act, 1998)

Link to Full Text: https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa

• Applies to commercial websites and services that are directed towards children, thus collecting data on the children if site is used.

• Requires verifiable parental consent before collecting, using, and then disclosing children's personal data.

• Gives authority to the FTC to enforce COPPA compliance through various means, civil fines being the most common.

Angelo State University Privacy Policy

In Text Citation: (Angelo State University Privacy Policy, 2024).

Link to Full Text: https://www.angelo.edu/privacy_policy.php

• Outlines Angelo State Universities' commitment to protecting the personal information collected from its students and staff.

• Provides information about a person's rights regarding their personal information and what mechanism they can use to access that information.

• Points to Texas Government Code for the consumers' authority to ask for information of Angelo State University.

• Encrypting the data you maintain as a business or entity helps prevent unauthorized access and disbursement of sensitive information, thus reducing the risk of data breaches. (HIPAA, 45 C.F.R. § 164.312).

• Through encryption, even when data is intercepted it remains unintelligible, meaning nothing can be gathered.

Security Audits and Assessments

• Businesses can/should conduct regular audits to assess their vulnerabilities, both in their data collecting hardware and their data collecting employees.

• These audits help find security weaknesses, gaps, and threats, allowing organizations to take corrective actions (GDPR, Article 32).

Employee Training

• Companies should provide trainings to employees on data privacy policies and procedures.

• Educating about safeguarding important data, recognizing phishing attempts, and following security protocols helps reduce the risk of human errors (COPPA, 16 C.F.R. § 312.5).

Children's Online Privacy Protection Act of 1998, Pub. L. No. 105-277, 112 Stat. 2681-728 (1998).

General Data Protection Regulation (GDPR), Regulation (EU) 2016/679

Gramm-Leach-Bliley Act of 1999, Pub. L. No. 106-102, 113 Stat. 1338 (1999).

Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. No. 104-191, 110 Stat. 1936.

American Marketing Association Code of Ethics - Confidentiality and Privacy in Data

In Text Citation: (AMA Statement of Ethics, 2021).

Link to Full Text: https://www.ama.org/ama-statement-of-ethics/

The code of ethics for the American Marketing Association underscores the importance of maintaining privacy when dealing with consumers' data and personal information. These ethical principles align with data privacy considerations for the business field as a whole. Thus, highlighting the importance of protecting data from unauthorized use and disbursement which helps build trust with potential clients and current consumers.

• Data Privacy in Coursework - As technology and data collection continue to evolve, universities should require their students to take courses that develop an understanding of their responsibilities and rights when it comes to personal data protection.

• Establish Clear Privacy Policies - Universities should develop and implement clear and consistent data handling procedures within their institution. These should apply to students, staff, and faculty.

• Provide Training - Universities should have yearly training for all staff that handle personal data regularly.

• Conduct Audits - Universities should conduct regular assessments of their data handling policies and mechanisms. Making room for improvement and technology advances.

• Increase Security - Universities should implement robust data handling practices. One example is encryption. Any identifying data being held by the university should be encrypted.

• Clear collection practices - When the university collects data, it should be clear to the consumer (student/faculty/staff) that their data is being collected. This helps ease the liability of the University if the consumer is against the data being collected, as they have a mechanism for it to be stopped.