Chapter 14 — Privacy foundations
Lesson map
Lesson 14 published. Map, example, EX040.
flowchart TD
N0["Learning outcomes"]
N1["14.1 Privacy and security"]
N2["14.2 Purpose and minimisation"]
N3["14.3 Retention"]
N4["14.4 Transparency"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX040"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["14.1 Privacy and security"]
N2["14.2 Purpose and minimisation"]
N3["14.3 Retention"]
N4["14.4 Transparency"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX040"]
[Learning outcomes]
|
v
[14.1 Privacy and security]
|
v
[14.2 Purpose and minimisation]
|
v
[14.3 Retention]
|
v
[14.4 Transparency]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX040]
Learning outcomes
You will (1) apply privacy principles to network data; (2) minimise collection; (3) set retention.
14.1 Privacy and security
Privacy concerns how personal information is collected, used and shared; security protects information from unauthorised access. They overlap but differ. A perfectly secure log store can still violate privacy if it collects more than needed or is used to watch staff for purposes they were not told about. At the clinics, network logs show when staff devices connect, which could reveal working patterns. Priya learns that security monitoring must itself respect privacy, or it loses staff trust and may break the law.
14.2 Purpose and minimisation
Collection should have a stated purpose, and only data needed for that purpose should be collected. For security monitoring, Priya specifies the purpose as detecting and investigating threats to clinic systems. That justifies recording connection source, destination, time and decision, but not the content of web pages visited by staff. Data minimisation reduces the harm if logs are leaked and simplifies compliance. It also improves analysis, since smaller, focused data are easier to search than large volumes of irrelevant detail.
14.3 Retention
Data should be kept only as long as needed. Security logs are useful for investigating incidents, which may be discovered weeks after they start, so a retention period of around ninety days is common for small organisations. Keeping logs for years increases risk and storage cost with little extra security benefit. Priya recommends ninety days for connection logs, with longer retention only for records of administrative changes, and an automatic deletion job so retention happens without anyone needing to remember.
14.4 Transparency
People should know what is collected about them. Priya drafts a short notice for clinic staff explaining that network connections are logged for security, what is recorded, how long it is kept and who can see it. Visitors using guest wireless see a brief notice on the registration page. Transparency costs little and builds trust. It also constrains use: once the notice says logs are for security, using them to track staff timekeeping would break that promise and should be refused.
Worked example
Priya's logging specification records five fields for connections, sets ninety days' retention and includes a staff notice.
Synthetic case. Specification is synthetic.
Errors and limits
Monitoring introduced without notice often damages trust even when its purpose is legitimate.
Exercises
- EX040 — Content logging. Why should connection logs not record web page content? Rubric: 3 = beyond security purpose, privacy harm;; 2 = unnecessary;; 1 = storage;; 0 = none.
- EX041 — Retention choice. Justify a ninety-day retention period. Rubric: 3 = incidents found weeks later, longer adds risk;; 2 = investigation;; 1 = arbitrary;; 0 = none.
- EX042 — Purpose limit. What should happen if a manager wants logs to check staff punctuality? Rubric: 3 = refuse; outside stated security purpose;; 2 = refuse;; 1 = allow;; 0 = none.
Synthesis
Purpose, minimisation, retention and transparency keep security monitoring respectful of privacy.
Continue studying — chapter 14 of 40
← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →