preview

Privacy Law

Decent Essays
Open Document

1. What is the difference between privacy law and information systems security? How are they related?
• Privacy law stipulates what is public and what is private data. IS Security is required to comply with the laws, which is how they are related.
2. Was the employee justified in taking home official data? Why or why not?
• Uncertain. The employee had taken the work home for 3 years, and being as this is very likely to have gone unnoticed for this period of time, although unauthorized, it was apparently considered normal at that particular office.
3. What are the possible consequences associated with the data loss?
• At worst, identity theft on an unprecedented level, with 26.5 million records of PII of Veterans and Active Duty personnel. …show more content…

5. What action can the company take against the concerned employee?
• If found to be intentional he could be fined and serve time in prison, but being as it was unintentional his employment was terminated and his record permanently marked.
6. Would the response of the company have been different had the data theft occurred at work instead of happening at the employee’s residence? Why or why not?
• Yes, if the theft had occurred at his workplace, the event would have been a workplace issue and the employee would not have been responsible for the theft, but being as it occurred at his home, he was responsible for the lack of security concerning the assets.
7. Why were the VA Data Analyst’s two supervisors reprimanded and demoted by the VA Secretary? Do you think this was justified? Why or Why Not?
• For not reporting the theft to their superiors in a timely fashion. They were justified in this action and as the actual theft was not their responsibility they had no justification to fire the supervisors.
8. What was violated in this data …show more content…

11. What information system security and privacy security policies do you think would help mitigate this breach and loss of privacy data?
• Obviously, requiring all assets containing PII or PHI to be secured at the VA, with removal of those assets being a violation of employment and cause for termination.
• Modification of their Acceptable User Policy to reflect these requirements.
• Conducting training for all personnel that have access to sensitive information.
12. What or whom was the weakest link in this chain of security and protection of privacy data?
• Administration. With proper policies and requirements in place this incident would likely not have happened.
13. If the VA had performed a security and information assurance audit for compliance, what can the VA do on an annual basis to help mitigate this type of loose policy conformance?
• By identifying deficiencies in policies or practices they can address the issues directly and ensure that all policies are sufficient for information security compliance. Also, personnel with access to sensitive information must be made aware of the consequences of non-compliance, ensuring that accountability is in

Get Access