This is the slide deck from the presentation given at SQL Saturday event in Louisville, October 2011. A modified version of this presentation was given at the Indianapolis SQL Saturday in May 2011.

1. John Magnabosco

2. ◦ Data Coach at Defender Direct
◦ Author of “Protecting SQL Server Data”
◦ Contributing Author to “SQL MVP Deep Dives Vol.2”
◦ SQL Server MVP 2009 & 2010
◦ Co-Founder of IndyPASS
and IndyTechFest

3.  Data Privacy in a Nutshell
 Laws and Stuff
 Your Data Footprint
 Weapons of Mass Protection
Please DO ask questions as we progress!

4. Somewhere out these someone is
storing data about you!

5. The relationship between the handling of personally
identifiable and other sensitive data in regard to the
legal right, or public expectation of privacy.
◦ Collection
◦ Storage
◦ Accessibility
◦ Use
◦ Disclosure

6. Information that presents a compromise in the
confidentiality, privacy or overall security of the data
subject in the event of loss, unauthorized access, or
modification.
◦ Racial or ethnic origin
◦ Religious or philosophical affiliation
◦ Financial records
◦ Medical and health information
◦ Biometric information

7. Information that can be used to uniquely identify,
contact, or locate a single person or can be used with
other sources to uniquely identify a single individual.
◦ Federal identification number (SSN)
◦ Driver’s license number
◦ Date of birth
◦ Full name – especially if uncommon
◦ Email Address
◦ IP Address (in debate)

8. I am not a lawyer, nor do I play one
on television.

9. ◦ Federal laws (HIPPA, FISMA)
◦ State laws (Indiana Code 24-4.9-2)
◦ Industry regulations (PCI DSS)
◦ Foreign laws (PIPEDA – Canada)
◦ Corporate privacy policies

10. ◦ How was the data collected?
◦ What is the purpose of the data?
◦ Is the data adequate for its purpose?
◦ How is the data protected?
◦ How long should the data be kept?
◦ Is the data available to the data subject?

11. To the world we are data

12. Who has personal information about you?
◦ Loan applications and bank accounts
◦ Registration cards for products
◦ FacebookTwitterLinked-In
◦ Discount cards
◦ Government CensusMarketing Surveys
◦ iTunesAmazonEbay
◦ The Internet

13. What are you exchanging data privacy for?
◦ To obtain credit
◦ To qualify for services
◦ To socialize and public expression
◦ To gain discounts and benefits
◦ For convenience and funding
◦ For the ability to trade with others
◦ To gain access to information

14. Data is viral and enduring. It goes way beyond your
database:
◦ Electronic disclosure
◦ Verbal disclosure
◦ Snail Mail
◦ Photo copying and printing
◦ Long-term offline storage
◦ Social media
◦ File deletion – or is it?

15. Data loss events are not only embarrassing, but they
can be expensive for the business and the victim.
10 million consumers are a
victim of identity theft per year.
The April Sony data loss was an
estimated 100 million records.
Symantec, the Ponemon Institute
and SpamLaws.com.

16. “There is no security on this earth;
only opportunity.”
- Douglas MacArthur

17. The process of categorizing data elements in the
effort of applying standardized data handling
policies.
◦ Simplified example of sensitivity classification
 Low (general public)
 Medium (internal disclosure only) <-- default
 High (restricted to specific personnel)

18. This feature provides a means to document and
query data classification and other valuable
information.
◦ Add: sys.sp_addextendedproperty
◦ Update: sys.sp_updateextendedproperty
◦ Query: fn_listextendedproperty

19. This feature provides a means to logically group
database objects together. This provides the ability
to manage access at the schema level.
◦ The default schema is “dbo”
◦ You can create custom schemas
◦ Use fully qualified references to objects
◦ Employ role based privileges to schemas

20. “Process of transforming information using an
algorithm to make it unreadable to anyone except
those processing special knowledge.” - Wikipedia
◦ Encrypting data in transit and at rest
◦ Cell-level encryption
◦ One-Way encryption
◦ Key hierarchy:

21. The most powerful weapon in your arsenal is you!
◦ Understand how sensitive data is handled
◦ Support privacy and data handling policies
◦ Be familiar with privacy laws and policies
◦ Advocate for the data privacy of others
◦ Raise awareness of data privacy

22. • Basics of data privacy
• Laws and policies
• Data footprint awareness
• Tools for protection
• Spirit of guardianship

23. Exploring Data Privacy
John Magnabosco
Blog: JohnMagnabosco.com
Twitter: johnnydata
Email: john_magnabosco@live.com