Answer To: COIT20263 Information Security Management (HT1, 2020) Assessment Item 2 - Group Discussion Due...
Akriti answered on May 04 2021
I. Two legal issues related to mishandling of information by the data analyst of F4F
Data analytics comprises of the program designed and deliberated to derive valuable and expedient information by acquiring, extracting and evaluating the data collected. The application of the Privacy Act, 1988 [1] read in juxtaposition with Australian Privacy Principles (APP) [2] has a crucial impact on how data analytical activities are legally required to be carried out. Interpretation of the same by the Office of the Australian Information Commissioner (OAIC) should also have a bearing on coming up with legally sound information security management decisions.
Data analyst of F4F is legally required to de-identify personal data as much as possible, give out clear notices of the usage of personal and sensitive data, etc. Legal fallouts on this count can be consciously and unconsciously done. In this segment, the author has tried to bring out how the data analyst can be at fault, legally, despite ‘not’ having acted with any mala-fide intention.
Arising out of these, following are the two prime legal issues, inter alia many others, related to incompetence in handling of information by the data analyst wing of F4F:
1. Problem of construction of personal information by data analytics
An inadvertent and an unconscious misuse of information can be caused by construction of personal information by data analytics. Explanatorily, such creation of information through data analytics is possible wherein the information develops into identified/identifiable in the process of analyzing non-identifiable information.
Another example of the same can be creation of information by a tracked pattern collected by fitness devices or fitness apps, which after a long time develops into a clear-cut pattern and leads to creation of personal information with respect to health of an individual. Considering the fact that the data analyst of F4F is engaging with huge volumes of data ranging from product information & sales data to client information, it is likely that he/she may come across collection of information.
Such “creation of information” is also covered under the ambit of collection of personal information. So, it needs to be checked that if the personal data, so created, could not be covered under APP 3, it needs to be either completely destructed or de-identified. De-identification or anonymization or confidentialisation is a process adopted after which the information is no longer categorized as personal information, such as, by removing personal information and instead assigning unique numbers to represent it. [3]
2. Usage of data outside the scope allowed by the Privacy Policy
Another hidden and usually the less emphasized issue wherein the data analyst can be held legally liable for mishandling information is by using the data outside the scope allowed by the Privacy Policy. It might be done intentionally, as well as unconsciously. The conscious mishandling can be unauthorized use of the information by selling off the information or by using it in marketing without prior consent, etcetera.
The unconscious mishandling is possible in a scenario if the data analyst of F4F has no clue in initial stages of processing the huge voluminous data around what exactly this data will be used for. Also, every stage of processing might unravel new prospects for usage of data. In such scenario, usage of data beyond previously stated privacy policy can be problematic. To deal with this, it is a better practice to try to emphasize the objectives of usage of data, even when their exact use cannot be determined.
II. Two ethical issues in InfoSec to be followed by the delivery staff of F4F
The delivery fleet of F4F is in contact with a lot of data which can include sensitive data as well, such as names, phone numbers of clients, their residential addresses, geo-political locations, preferred times of delivery, etc. Such information can be prone to be deployed to unethical and unfair use by the delivery staff, if it is not well managed.
1. Gaining unsolicited and unauthorized access to personalized information can lead to breach of the core right of privacy and confidentiality. This is one of the prime ethical issues while handling information by delivery employees, and comes off as a ‘creepy’ tactic.
2. Another major and very serious ethical issue is the risk of information sharing by the employees in contravention to the organization’s privacy policy and domestic information security laws. This information can be shared for money to anyone who might put it to use in a range of activities such as marketing, employing in behavioral study, blackmailing, etc., all without any adequate disclosure to the individuals whose information is being shared against their right to autonomy. Such practices on part of employees are bereft of loyalty to their organization (by breaching its privacy commitments made to clients and jeopardizing its integrity and trustworthiness) as well as fundamental ethic of respecting one’s right to personal space.
III. Two measures to prevent staff members of F4F from handling information unethically
The success of information security management efforts of an organization largely depends on conduct of its employees. In such cases, it is highly imperative to determine and establish strong measures to extract compliance to ethical information security practices from the staff members. Two measures to address the same issue are:-
1....