Information Privacy and Data Security

Abstract

Legal academic and policy discourse generally presumes that information privacy and data security are interchangeable goals. The conventional wisdom is that data security is a handmaiden of information privacy, and so what serves data security will serve information privacy. However, this view is an oversimplification of the relationship between the two fields. This Essay aids law and policy development in both fields by correctly defining their relationship to one another. Data security has separate objectives from information privacy that can be agnostic or even in opposition to information privacy. The law should acknowledge information privacy and data security as separate institutional objectives to prevent undesirable — or at least unpredictable — results in edge cases in which data security’s objectives run counter to those of information privacy.

Keywords: cybersecurity, data security, data breach, security breach, breach notification, privacy, regulation, consumer protection, chief privacy officers, Federal Trade Commission, data protection, new governance, organizational fields, professionalization