Security and privacy share a common goal – the protection of individuals and in many cases, the protection of individuals’ information. When there is a security breach, there can be a breach of privacy as well. The debate around security and privacy arises because sound security practices may not necessarily produce sound privacy practices.

Witness the national debate on wiretapping and intelligence gathering. While these practices may enhance security, they may do so to the detriment of privacy. But they don’t have to if privacy concerns are considered before implementing any security program or technology.

The consequences of not building privacy into security solutions may prove costly to the security industry. For example, legislation has been introduced in several states that would impose onerous requirements on those implementing security technologies, such as radio frequency identification, biometrics (including facial recognition software) and security video. These legislative solutions to the issue of privacy are absolute. Ignored are facts well-known in the security industry, such as the need for a layered security approach or a security risk analysis.

Assessing Privacy Impact

The convergence of physical and logical security presents an unprecedented opportunity to secure individuals and their information while simultaneously protecting privacy. Conducting a privacy impact assessment (PIA), actually a requirement in one of the proposed state bills, would help security professionals understand where privacy might be harmed – and, in some cases, enhanced – in the implementation of a security system.

A security system that uses personally identifiable information (PII) or what privacy advocates consider intrusive technology, such as security video cameras, raises privacy concerns. A PIA is a risk management tool that would examine the system to ferret out any potential privacy risks. To ensure the effectiveness of the PIA, it should be conducted early on, as part of the broader risk assessment and risk management process.

Some key questions to ask during a PIA include:

• Does the security solution use new or integrate existing information technologies that may affect privacy?
• For example, convergence opens up new possibilities for information sharing that may put PII at risk.
• How is the system identifying individuals?
• Unique identifiers have long been used in security systems in lieu of PII to recognize individuals. However, in some proposed legislation, these unique identifiers have been described as PII.
• How likely is it that these unique IDs can be tied to an individual outside of the security system?
• If you are using biometrics, how is that biometric information protected?
• Can the amount of PII being used by the system be minimized? For example, in an access control database, the amount of PII can be limited to only that which is absolutely necessary.
• When converging physical and logical access, will PII be exchanged across systems? To ensure data quality, data terms in converging systems should be reviewed so that all terms in disparate systems are reconciled.

This is by no means a complete list of the questions that should be asked during a PIA. Every PIA should be conducted with the particular intent and application of the security solution being implemented in mind. The PIA should also take into consideration the relevant privacy regulations that an organization is subject to on the state, federal and, in some cases, international level.

Do It Early On

Privacy and security are desired outcomes. Conducting a privacy impact assessment early on in the process can help organizations achieve these twin goals. Without such due diligence, problems may arise after the system is in place, significantly increasing the costs to address those problems. The security industry can avoid expensive fixes and onerous legislation by taking privacy seriously during the design and implementation of systems and solutions.