Legal and Ethical Guide by Cooper Sims

Slide 1: Professional Prospective

csims11_1 — 2024-05-02 14:54:01 UTC

My field of education is business administration and professionally I work in Youth Ministry. My topic is data privacy and the audience is those who rely on data in their companies for analysis and consumer information. In ministry, data concerning members is important so that I am able to contact members and analyze what the breakdown of attendees is. This helps me to know what schools and grades need more attention and which are in a sense self sustaining. Because of the importance of data to me and many other companies, I chose this topic so that I will be more aware of how to handle data privacy legally and ethically.

Slide 2: Governing Agency

csims11_1 — 2024-05-02 14:56:56 UTC

Federal

csims11_1 — 2024-05-02 15:19:17 UTC

The Federal Trade Commission is the governing agency on privacy and consumer protections. The FTC uses law enforcement, policies, and consumer and business education to protect consumer information(Staff in the Office of Technology, 2022).

The U.S. Department of State Privacy Office "safeguards privacy and promotes transparency through compliance, advice, training, and collaboration(Stein)."

State

csims11_1 — 2024-05-02 15:30:26 UTC

The Texas Department of Information Resources houses the Office of the Chief Data Officer who improves data governance and security state wide, and works cooperatively to develop policies, standards, and practices. They provide network security services (Office of the chief data officer).

Slide 3: Constitutional Laws

csims11_1 — 2024-05-02 15:31:58 UTC

Federal Constitution Law

csims11_1 — 2024-05-02 15:35:14 UTC

The 9th amendment is known as the inalienable rights amendment.
This includes the right to privacy and protection
We can conclude that personal data can be included in this (U.S. Const. Amend. IX).

State Constitution Law

csims11_1 — 2024-05-02 15:36:33 UTC

The Texas Constitution Article 1 section 9 protects citizens from searches of possessions.
With the advancements of technology there has to be determinations of what data is considered a possession and what is public information in order to fully protect the search of data and protect data privacy (Tex. Const. Art. I §9).

Slide 4: Statute and Administrative Law

csims11_1 — 2024-05-02 15:37:16 UTC

Statute

csims11_1 — 2024-05-02 15:38:15 UTC

Privacy Act of 1974

"requires agencies to comply with statutory norms for collection, maintenance, access, use and dissemination of records".
grants individuals the right to access records maintained about them
companies maintain a system of records of information held about individuals. (Privacy Act, 1974)

Administrative

csims11_1 — 2024-05-02 15:38:32 UTC

Respect Privacy of Customers
- Protect Security and Confidentiality of non-public personal information
Protect against unauthorized access to personal information
Insure the confidentiality and security of customer records (15 USC §6801).

Slide 5: Case Law

csims11_1 — 2024-05-02 15:39:19 UTC

Ruled a warrant is needed to access a person's cellphone location history.
Search without a warrant was found to be a violation of the 4th amendment
There must be probable cause to receive a warrant (Carpenter v. United States, 2018).
This is an important step in creating more laws that help in the protection of data privacy.

Slide 6: Federal Regulation

csims11_1 — 2024-05-02 15:41:52 UTC

Protect privacy and security of customer information

may only use, disclose, or permit access to CPNI information if
- required by law
- with customer approval (Telecommunications Act, 1996)

Federal Communications Commissions Regulations protect customer proprietary network information (CPNI). This information includes location services, phone numbers, calls made, and services purchased through the phone(Protecting your personal data, 2023).

Slide 7: Local Policy

csims11_1 — 2024-05-02 15:42:29 UTC

Google Privacy Policy

Update March 28, 2024
Tells what information is collect, why, and how to manage it.
- Information collected includes names, passwords, phone number, and payment information(if given)
- Information about use of browsers, apps, and devices used, and activity
- This information is used to better build google services provided and provide personal services
- Each individual is able to run a privacy check to see what information is accessed and turn off permissions to what they choose(Privacy policy – privacy & terms, 2024).

Slide 8: Risk Management

csims11_1 — 2024-05-02 15:42:54 UTC

Risk Management

What data is private?
- knowing what data could be or is considered private is the first step in risk management. This tells us what data to be more aware of the use of.
Risk Assessment
- Determine the risk associated with the use of the data and the importance of the use of it.
- If the risk outweighs the benefits of using the information, then there is no point in accessing it.
- This helps to determine what data is necessary and not accessing any more potentially private information than necessary.
Risk Response Plan
- A risk response plan should be created with an outline of what to happen should there be an issue with data privacy in the company.
- This plan should include procedures and a response that intends to mitigate privacy risk, and a post evaluation of the risk in order to prevent further risks of similar nature (Tang, 2020)

Slide 9: Ethical Priniciple

csims11_1 — 2024-05-02 15:43:33 UTC

One of the core ethical principals of business is to act with integrity. When we think data privacy, ethically you must act on the consumers wishes concerning their data. The issue that makes things more complicated here is that when it comes to data, we may not always know the consumers wishes. This is where acting with integrity is important. This means to "Hold ourselves to the highest ethical standards. To interact in an open, honest positive manner and be guided by what is right." In order to do that when it comes to data privacy, we must question ourselves and the information we are accessing to determine if we are guided by what is right in our decision making and holding ourselves to the highest standard(Code of Business Conduct and Ethics, 2009).

Slide 10: Personal Connection

csims11_1 — 2024-05-02 15:44:12 UTC

The application of data privacy laws touches every part of our lives. In education it has made me aware of the information and data that most companies have access to in some fashion, even the university. As I work through my MBA, I am aware that data is likely to become a key part of marketing in my future. I have seen in my education that these data privacy laws will likely grow in detail as time continues and create protections for consumers and be a tool for me to predict consumer trends in a legal and ethical way. As I move forward even after my education, I will continue to learn as these laws change and evolve so that I can always be fully aware of the laws and regulations with data. The most important connection now is that with the lack of detailed laws specifically for data privacy, ethics will play the larger role in decision making. Laws currently protect all privacies for the most part and there is a lack of specific details for data collected despite the large increase of data with technology, and I will need to consider with integrity, the use of data.

Slide 11: Recommendations and Best Practices

csims11_1 — 2024-05-02 15:44:54 UTC

Build a strong system of records that is easy to navigate and manage. This will help to ensure that all data is kept in the same place, kept secure, and updated when necessary to match changes to consumer wishes with data.
Create a Privacy Policy that details what information is collected and how it will be used.
Allow a way for consumers to elect to not allow certain information to be released and keep a not of this in the system of records.
Use up to date data protection measures to classify data and make sure these measures are updated regularly in order to best protect information.
Have a team to ensure data security and privacy and to ensure that all compliance standards are followed.
Create a data retention and removal schedule. This will tell consumers and employees how long each category of data is maintained and at what point the data will either be destroyed or no longer protected. Consumers should also be aware of what happens when data reaches the removal point of the schedule and if data is not destroyed and just released, they can request a different method of removal.
Anonymize sensitive data that does not require to be identifiable to help protect the individual and the information to a larger extent.
Document how all parties will be notified of a breach of data privacy. This can also be the method used for update to the privacy policy and the data retention and removal schedule.

References

csims11_1 — 2024-05-06 17:55:41 UTC

All articles used outside of laws. Laws are cited on the proper slide with full text and in text citations.