Privacy and Security Terminology
Privacy and Security are not easy subjects. Here are some terms that may help you understand some of the laws and articles that are posted on privacy and security.
Personal Information (PI)
Personal information is defined as any information or combination of information that can lead to identifying an individual. Not all personal information is regulated. However, certain PI is, such as medical and financial. Examples of personal information are name, address, social security number, driver’s license number, financial account numbers, credit/debit card numbers, PINs and passwords, date of birth, etc.
Controller
The term controller came from the EU General Data Protection Regulation (GDPR) and is a term that identifies the entity (person, organization, etc.) that ultimately determines and holds responsible for why and how personal data is processed.
Processor
A data processor (also derived from the GDPR) is the entity that actually performs the processing of data on the controller’s behalf. Many third-party vendors are considered processors if they collect information on your behalf or if you transmit personal information for them to store and/or process.
Co-Controller
Also called a Joint Controller, these are entities that jointly determine the “means and purpose” of the processing of data. The means and purpose may take on different methods and forms and do not have to be equally shared.
Privacy Policy
A privacy policy is a statement or legal document that discloses all the ways you collect, use, disclose, and manage the data you collect. The policy is the internal version of this document, while a Privacy Notice is a public version that is usually published on a company’s website.
Vulnerability Scanning
The act of reviewing a “system”, usually automated, to determine what vulnerabilities are there based on a list of known/common vulnerabilities.
General Data Protection Regulation (GDPR)
The GDPR is a regulation in EU Law specific to data protection and privacy. The GDPR is a comprehensive meant to harmonize data privacy laws for all member states across Europe.
California Consumer Privacy Act (CCPA)
A California state statute intended to enhance privacy rights and consumer protection for residents of California.
Right to Private Action
The CCPA provides plaintiffs with the right to private action to pursue statutory damages following a data breach that impacts certain sensitive categories of personal information and are caused by the business’s failure to institute a reasonable and appropriate privacy and security program.
Data Subject Access Request (DSAR)
Regulations such as GDPR, CCPA and Virginia’s VCDPA provide individuals the right to request access, correct, and/or delete information collected by a business.