Witness the national debate on wiretapping and intelligence gathering. While these practices may enhance security, they may do so to the detriment of privacy. But they don’t have to if privacy concerns are considered before implementing any security program or technology.
The consequences of not building privacy into security solutions may prove costly to the security industry. For example, legislation has been introduced in several states that would impose onerous requirements on those implementing security technologies, such as radio frequency identification, biometrics (including facial recognition software) and security video. These legislative solutions to the issue of privacy are absolute. Ignored are facts well-known in the security industry, such as the need for a layered security approach or a security risk analysis.
Assessing Privacy ImpactThe convergence of physical and logical security presents an unprecedented opportunity to secure individuals and their information while simultaneously protecting privacy. Conducting a privacy impact assessment (PIA), actually a requirement in one of the proposed state bills, would help security professionals understand where privacy might be harmed – and, in some cases, enhanced – in the implementation of a security system.
A security system that uses personally identifiable information (PII) or what privacy advocates consider intrusive technology, such as security video cameras, raises privacy concerns. A PIA is a risk management tool that would examine the system to ferret out any potential privacy risks. To ensure the effectiveness of the PIA, it should be conducted early on, as part of the broader risk assessment and risk management process.
Some key questions to ask during a PIA include:
- Does the security solution use new or integrate existing information technologies that may affect privacy?
- For example, convergence opens up new possibilities for information sharing that may put PII at risk.
- How is the system identifying individuals?
- Unique identifiers have long been used in security systems in lieu of PII to recognize individuals. However, in some proposed legislation, these unique identifiers have been described as PII.
- How likely is it that these unique IDs can be tied to an individual outside of the security system?
- If you are using biometrics, how is that biometric information protected?
- Can the amount of PII being used by the system be minimized? For example, in an access control database, the amount of PII can be limited to only that which is absolutely necessary.
- When converging physical and logical access, will PII be exchanged across systems? To ensure data quality, data terms in converging systems should be reviewed so that all terms in disparate systems are reconciled.