The international POV on Data Privacy laws

I promised back in July that I would provide some notes about data privacy legal impacts in the cloud. I started writing down such notes - but I came to realize very fast that I could not do so without gaining a better view on where there are specific provisions about data privacy and how these can be in conflict.
That took me some time. I guess it is a work in progress; every day new content is published, new questions seem to arise; but I feel it is a good start, and a necessary one before talking about the cloud.

I am sharing an overview of my findings here, always please bear in mind that this is personal research and I have no claim to any legal title - if in doubt, please do yourself a favor and seek legal counseling.

International law coverage
Lets start by looking at this map. It is based on what I know, and I just updated it with my most recent readings... but even if (IF) it should be complete now, readers beware: it will not be tomorrow, so lets consider it a starting point.

Did you know that the 28th of January is Data Privacy Day?*

*DataPrivacy Day

Ever since I have been working with HRIS in the context of global companies, I’ve been collecting notes on how the HR data, sensitive and private as it is, can be protected. I’ve decided to publish this blog, but here goes the DISCLAIMER: these notes are of a general nature, and share my personal ramblings and thoughts on the matter. It should not be construed as an attempt to offer or render legal opinion or engage in the practice of law. Please consult the advice of a licensed professional if you require it. 

What is what?

One of the modern-age most compelling frauds includes one form or another of identity theft (identity cloning, financial ID theft, medical ID theft); we have seen first-hand phishing attempts received by mail and e-mail, and are careful in shredding personal documents rather than just throwing them on the recycling pile. As HR professionals, working with HR information, we are aware of the sensitivity of the data entrusted upon us by our company; and as employees, we expect that our information will be appropriately protected and remain private. 

Governments have produced laws and guidelines, and since 1981, groups of countries have entered agreements to decide how data (and in particular, HR data) can be shared across borders.

Image from HERE

Plenty of information is available, often fairly indigestible and written in “legalese”. Several terms appear to be used in alternance, are they really synonyms? Not quite.

·       Data integrity addresses the concern that data should be correct and complete for the use we want to make. As a simple example, if the address held about your employee is not updated, correspondence will fail to reach him/her, and consequently data is trash.

·       Data security is focused in keeping information safe, seeking protection from access by unauthorized entities. The idea is to avoid hacking and intruders; both to prevent theft of ideas or valuable information and to protect the integrity of the data (as above) against corruption (either accidental or willful). To date, it relies as much on technical hacking prevention and on the strength of individual passwords... and that is a weak link, see below.

·       Data privacy is often confused with data security, but actually starts from data security,  spanning a wider area. Its concern is to ensure legal compliance with the multiple international regulations controlling and protecting the individuals’ rights to keep their data safe and private; it isn’t merely protecting against external intrusions, but supervising the way HR data is shared internationally, where it is stored, how it is accessed. It means providing adherence to data privacy guidelines and regulations, all around the world where your organization is active.