The principle of security safeguards: Unauthorized activities

被引：2
作者：
Dayarathna, Rasika [1 ]
机构：
[1] Department of Computer and Systems Sciences, Stockholm University, the Royal Institute of Technology (KTH)
来源：
Computer Law and Security Review | 2009年 / 25卷 / 02期
关键词：
Data control; Information privacy; Information security; Information systems design; Password/passphrase; Privacy guidelines; Unauthorized data usage;
D O I：
10.1016/j.clsr.2009.02.012
中图分类号：
学科分类号：
摘要：
The principle of information security safeguards is a key information privacy principle contained in every privacy legislation measure, framework, and guideline. This principle requires data controllers to use an adequate level of safeguards before processing personal information. However, privacy literature neither explains what this adequate level is nor how to achieve it. Hence, a knowledge gap has been created between privacy advocates and data controllers who are responsible for providing adequate protection. This paper takes a step toward bridging this knowledge gap by presenting an analysis of how Data Protection and Privacy Commissioners have evaluated the adequacy level of security protection measures given to personal information in selected privacy invasive cases. This study addresses both security measures used to protect personal information against unauthorized activities and the use of personal information in authentication mechanisms. This analysis also lays a foundation for building a set of guidelines that can be used by data controllers for designing, implementing, and operating both technological and organizational measures used to protect personal information. © 2009 Rasika Dayarathna.
引用
收藏
页码：165 / 172
页数：7
相关论文
共 31 条
  • [21] PIPEDA 315, Web-centred company's safeguards and handling of access request and privacy complaint questioned, (2003)
  • [22] PIPEDA 253, A bank exceeds the time limit for answering an access request, (2003)
  • [23] PIPEDA 254, Daughter racks up long-distance charges
  • [24] mom blames phone company, (2003)
  • [25] PIPEDA 281, Organization uses biometrics for authentication purposes, (2004)
  • [26] PrivCmrA 10, L. v Commonwealth agency, (2003)
  • [27] PrivCmrA 17, R v Internet service provider, (2005)
  • [28] TJX, TJX Companies Inc. /Winners Merchant International L.P, (2007)
  • [29] Victoria, Website privacy - guidelines for the Victorian public sector, (2004)
  • [30] VPrivCmr 2. Complainant B v statutory entity
1234