Two related but distinct concerns.
WHAT SECURITY RISK IS
The risk of unauthorised access, loss or alteration.
WHAT PRIVACY RISK IS
The risk of harm to individuals from how data is used, including authorised use.
WHY THE DISTINCTION MATTERS
Perfectly secure processing can still be unlawful or harmful.
WHAT EXAMPLES LOOK LIKE
Excessive collection, securely stored Profiling with discriminatory effects Data used for purposes people did not expect
WHAT SECURITY MEASURES DO NOT ADDRESS
Whether you should hold the data at all.
WHAT PRIVACY ASSESSMENT ADDS
Necessity and proportionality.
WHAT TO ASSESS TOGETHER
Both, at design time.
WHAT QUESTIONS SECURITY ASKS
How could this be accessed improperly What would that expose
WHAT QUESTIONS PRIVACY ASKS
Do we need this Would people expect it Could it harm them Can they object
WHAT TO DO ABOUT HIGH PRIVACY RISK
Reduce the data or change the design.
WHAT TO DO ABOUT HIGH SECURITY RISK
Add controls.
WHY THEY DIFFER
One is solved by holding less; the other by protecting more.
WHAT TO COMBINE
The registers, so both are visible together.
WHAT TO REPORT
Both, to whoever is accountable.
