YT YouTube2Text

YouTube2Text → Transcripts → YouTube transcript (sQBSVa4FicI)

YouTube transcript (sQBSVa4FicI) — Transcript

5,609 words · 924 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00should be used to identify that person.
0:03So what are some examples of personal
0:06data? Well, the most extensive list of
0:09personal data types comes from a
0:11regulation called GDPR or general data
0:14protection regulation
0:16which [clears throat] was introduced in
0:17Europe in 2018 and is was used as a
0:20basis for many other privacy laws around
0:22the globe including countries like the
0:25US, UK and Saudi Arabia which use it
0:28GDPR as a model for their own privacy
0:31regulations.
0:33GDPR gives us many examples of personal
0:35data which may be stored in electronic
0:37or paper format. This includes data such
0:41as name and address, email address, bank
0:44numbers, national insurance numbers or
0:46social security numbers in the states,
0:49employee ID numbers, driver license
0:51numbers, credit card and bank data,
0:55genetic data, biometric data, religious
0:58data, sexual orientation data, trade
1:02union membership, health information,
1:05criminal data, and IP and cookie
1:08information.
1:10While GDPR is fairly comprehensive, it
1:12does not cover every type of personal
1:14data that you may come across. Different
1:16industries, particularly in the US, have
1:18further types of personal data defined
1:20in healthcare, financial services, and
1:22education as examples. You may come
1:25across different terminology for
1:27personal data in these industries as
1:30personally identifiable
1:32personally identifiable information
1:34known as PII or you may hear the term
1:37NPI non-public information in the states
1:40quite regularly. While in health care
1:42settings you may hear the term PHI or
1:45EPHI which is electronic personal health
1:48information which refer to health
1:51patient information in the states.
1:54So where do we commonly find personal
1:56data? Well a better question is where is
1:59it not found in modern business setting?
2:02It's fair to say that the vast majority
2:03of it is stored in customer and employee
2:05databases and accessed via desktop and
2:08web-based applications. This
2:10particularly applies in business
2:12settings for larger organation
2:15organizations. These databases can be
2:17spread out across the globe as different
2:19applications require access to it. So
2:22what are some examples of these
2:24applications? Well, common ones might be
2:27customer relationship management tools
2:28like Salesforce,
2:30HR benefits applications,
2:33integrated integrated accounting and
2:35payroll packages like Sage, document
2:38management systems, and customer account
2:40management applications that you might
2:42see for utilities, online banking,
2:45airlines, education, and healthcare
2:47providers where customers can manage
2:49their own details.
2:51In addition to these applications, there
2:54are desktop applications like Outlook,
2:56Excel, and Word, which are commonly used
2:59to store and share personal data such as
3:01names, addresses, and other personally
3:03identifiable details.
3:06And lastly, then there are physical
3:08records stored in paper format which may
3:11be stored in filing cabinets or as
3:14patient forms, credit application forms
3:18um which we'll talk about uh later on in
3:20this in this training. But it's also
3:23important to note that this is only part
3:25of the picture for where person data is
3:27found. You have to factor in devices
3:29like mobile phones, thumb drives, laptop
3:32drives, smart devices, and many more
3:34locations where personal data can be
3:37stored. We will see more details in a
3:40diagram shortly on this matter.
3:45So it's also important to be aware of
3:47certain categories of personal data as
3:49they are treated differently by data
3:51protection authorities as they're
3:53considered more high risk and and
3:55require greater vigilance in handling
3:57it.
3:58So when we talk about sensitive data
4:00data, we tend to mean things like
4:02religious and political beliefs, sexual
4:04orientation data, trade me trade union
4:07membership data, genetic information,
4:10medical records, and in many states in
4:12the US, social security numbers are
4:14considered sensitive.
4:16Then we talk about special category data
4:19in GDPR. We're talking about personal
4:22data of minors and criminal conviction
4:24data which is required to be highly
4:26restricted in the EU. Access to criminal
4:30data is less restrictive in the US due
4:32to commercial reporting agencies who are
4:34permitted to to sell such information
4:36online in the form of background
4:38reports.
4:39In any case, businesses must take extra
4:42steps to protect this kind of
4:43information by means of appointing data
4:46protection or chief privacy officers,
4:48which we'll discuss later.
4:50are implementing more stringent security
4:52safeguards, adding higher priority
4:55monitoring to sensitive data, and
4:58including more urgent components within
5:01incident response plans for treating
5:03sensitive data. From an individual
5:06sensitive data handler perspective, this
5:09means that extra care must be taken when
5:12processing this type of data.
5:19This chart is quite detailed, but it
5:21does show us the many places where you
5:23may be accessing personal data at the in
5:26the home or in the office. Viewers might
5:29be surprised at how many different
5:30places where personal data may be
5:32accessed from when using a laptop, for
5:34example.
5:36This makes it all the more important to
5:38be aware of when we talk about risks in
5:40upcoming lectures. So looking at this
5:44graphic at the top in section one, we
5:47show you some common desktop formats for
5:49how personal data might be saved and
5:51shared.
5:53Email messages may often be used to send
5:55attachments with personal data to
5:57customers, business partners, and
5:59service part providers alike.
6:02Users may often work with a variety of
6:04file types including Word documents,
6:06Adobe PDFs,
6:08Excel spreadsheets, and even image
6:10formats which may be stored or shared.
6:13And of course, we also have to consider
6:15physical formats like printouts that may
6:17also contain personal data as may be
6:20found in application forms and contact
6:22sheets.
6:23In section two of this graphic, we see
6:26an array of places where personal data
6:28may be accessed and stored uh from a
6:31typical computer. You'll see six common
6:33location categories where personal data
6:35may be stored and accessed. So if you
6:38work your way around from A to F in the
6:40graphic, you see drives, cloud
6:43locations, browser data, so so things
6:46like cookies, IP information, and
6:47downloads. And then wireless devices
6:50where personal data may reside. An
6:53example of wireless devices might
6:54include other computers, wireless
6:56cameras, fitness wearables, and home
6:58entertainment systems that may be
7:00sharing and storing personal data.
7:10In this slide, we're going to talk about
7:11hackers and the lure of personal data.
7:14Personal data breaches have mushroomed
7:16in quantity in the last decade to a
7:18point where the official statistic in
7:20the US stands at 3,500 recorded cases of
7:23data breaches in 2024.
7:26This represents a five-fold increase
7:28over a decade ago when there were just
7:30780 cases recorded in 2014. So
7:33practically every online business in the
7:35US has been affected by at least one
7:37incident in the last 3 years where
7:39personal data has been exposed or
7:41breached at some point. So why the
7:44dramatic increase of data breaches over
7:46the last 10 years? Well, there are a few
7:48reasons, but they're mostly traceable
7:50back to the market value of personal
7:52data and the increasing sophistication
7:55of online attacks. As an example, stolen
7:58health records can now fetch over $100
8:01per patient, while live credit card data
8:03can set up to $15 per card on the dark
8:06web marketplaces. When you factor in
8:09that many data breaches involve
8:10thousands of customers, you can see the
8:12potential for that illotten gains can
8:15rise quickly. Hackers have also realized
8:17that after personal data has been
8:19stolen, they can further hold businesses
8:21and individuals to ransom by demanding
8:23payment to pre prevent the data from
8:25being publicly released or infecting the
8:28victim's machines with ransomware. It
8:30doesn't end there, though. Cyber
8:32attackers regularly sell the tools and
8:34methods they use to hack businesses to
8:36other hackers on online marketplaces
8:38known as the dark web where they can use
8:40it for further crime like identity
8:42theft, intellectual property theft, and
8:44Medicare fraud. In effect, cyber
8:47criminals have created an expanding
8:49criminal ecosystem with multiple revenue
8:51streams and virtual an anonymity through
8:54the use of Bitcoin and other
8:56cryptocurrencies. So where does the
8:59anonymity factor in? Well, it comes in
9:02from the fact that the dark web
9:03everything is basically untraceable.
9:06Cryptocurrency is used, as I said, as a
9:08standard for payment, which is of course
9:10anonymous, while machines that connect
9:12to the dark web do not share their IP
9:14addresses or store any browsing history
9:16typically. So you might ask, are there
9:19particular individuals or kingpins
9:20responsible for most of the crime? Well,
9:23what we can say is that there's a higher
9:25likelihood that attackers are part of a
9:26criminal gang. based in an unfriendly
9:29nation like Russia, North Korea or China
9:31who may have links to the government.
9:33The link is usually very important to
9:34the survival of these gangs as the
9:37governments tend to overlook their
9:39activities if not actively support them
9:42for political reasons such as spying,
9:44intellectual property theft, monetary
9:46gain, and of course targeting
9:48adversaries.
9:52In the last slide, we took a look at the
9:54value of personal data and what happens
9:56to it. In this slide, we'll take a the
9:59top methods hack used to steal personal
10:02data. The most common method, as you may
10:04already know, is fishing. Fishing, of
10:06course, is a method of using email to
10:08invite users to click on a malicious
10:10link or to deceive readers into taking
10:12another action, usually for a financial
10:14gain. Fishing is the number one method
10:16for hackers in attacking individuals and
10:19businesses and it's evolving. Attackers
10:21are using the power of AI tools like
10:23chat GBT to automatically generate
10:26emails which are more likely to defeat
10:28email filters and convince users that
10:30the email is authentic. Fishing emails
10:32are a main cause for anom ransomware
10:35infections, personal data compromises
10:38and fraud fraudulent activities such as
10:40invoice payment fraud. As a result, end
10:42users need to be more vigilant than ever
10:44when handling emails, particularly from
10:46external sources. Next, we consider the
10:49term malware, which is an umbrella term
10:51for many types of malicious code such as
10:54viruses, Trojans, rootkits, key loggers,
10:57and others which may be a threat to
10:58personal data and delivered by different
11:01means such as fishing emails,
11:04downloading from untrust trustworthy
11:06websites, sharing infected media such as
11:09USB drives, and clicking on malicious
11:11links. Hackers know that the users will
11:13often be drawn in uh by internet search
11:16results like free download such as found
11:18on gaming and shareware sites. Hence
11:20again users need to be careful about
11:22their browsing habits. The next hacker
11:25uh method that was commonly used today
11:27is password compromise. This is perhaps
11:30the most preventable hacker crime. Users
11:32realize that weak passwords are akin to
11:34having no passwords and that the simple
11:36habit changes can deter privacy
11:39breaches. Hackers use automated attack
11:41tools to crack short and non-complex
11:43passwords in seconds. This is important
11:46to know for both your work and personal
11:48online accounts. Hackers know that many
11:50users will reuse many of their online
11:52accounts. So breaking one is like a
11:55skeleton key for breaking others. They
11:57also know that many users choose
11:59passwords with names, consecutive
12:00numbers, and easy to guess strings like
12:03password 1 2 3. You have to be careful
12:05about how you manage passwords basically
12:08online and in the workplace. Another me
12:10favorite method for hackers is social
12:12engineering uh which is a rapidly
12:14evolving again in the advent of AI
12:17tools. Hackers are increasingly turning
12:19to so-called things like roocalls with
12:22more natural human sending AI generated
12:25voices all in an effort to call
12:28customers or call businesses and fool
12:30them into believing that they're talking
12:32to a real person. These scams are
12:34designed to get people to divulge
12:36personal information like account
12:37numbers, passwords, and pin codes. They
12:39are all still, of course, real humans,
12:41often operating from scam call centers
12:44making these types of calls trying to
12:46get some information through different
12:47methods such as impersonation of being a
12:49bank rep, investment advisor, tech
12:52support, etc. And then yet another area
12:54of attack for hackers is the area of
12:56Wi-Fi. Public Wi-Fi is often used by
12:59hackers to eavesdrop on electronic
13:01communications uh from your laptop,
13:04tablet, or phone. Hackers are always
13:06active on publicly available Wi-Fi
13:08networks looking for personal and
13:10confidential information that they can
13:11exploit. This type of attack is is very
13:14difficult to detect, but fortunately is
13:16easier to defend against. Simply put,
13:18it's better to avoid public Wi-Fi and
13:20use private Wi-Fi with VPN software when
13:24possible. So looking at all these attack
13:26methods, there is a common theme and
13:28that is the hacker relies on people's
13:30lack of awareness and letting the guard
13:32down to get access to personal and
13:34confidential information. Ensure that
13:36you are taking action in your decisions
13:38every day to prevent attacks like
13:40double-checking emails, avoiding
13:42untrustworthy sites when you're
13:44browsing, choosing strong passwords for
13:46all your accounts, and only using
13:48private private Wi-Fi connectivity.
13:58Sharing personal data. As you've seen in
14:01earlier slides, personal data may be
14:03stored and accessed from many locations
14:05locally and across networks and regions.
14:08And the larger the organization is, the
14:10more complex the picture it becomes. As
14:13an example, a large multinational
14:15corporation might have several global
14:17call centers where customers can call in
14:19to discuss their account details and
14:21request documentation such as statements
14:24or make account detail changes. Other
14:26examples may include well-known
14:28companies like ADP and Salesforce which
14:31process employee and customer data in
14:34their data centers all over the globe.
14:36There may be in fact hundreds of
14:38entities which companies share personal
14:40information with such as legal firms for
14:42contracts and litigation files service
14:45providers such as mobile phone companies
14:46for employee cell phone service along
14:48with business partners, tax authorities,
14:50regulators and accountancy firms for
14:52example. So how are these records shared
14:55with third parties? Most of the personal
14:57data shared by businesses in and out of
14:59organizations is done through
15:01application update requests which are
15:03transmitted automatically via secure
15:05protocols over local and wide area
15:08networks. There's also a lesser
15:09percentage of personal data transmitted
15:11man manually via email, telephone, and
15:13regular mail with customers, employees,
15:15and vendors. It's not uncommon for
15:18employees to email spreadsheets,
15:20documents, and scanned forms with
15:22personal details to one or more third
15:24parties for further processing or
15:26review. So, what do we mean by third
15:28party risks? Well, as we as we've seen,
15:30businesses may use many established
15:32third parties to process their data from
15:34suppliers like ADP and Salesforce. But
15:37there are lesserk known suppliers like
15:39reward program providers and marketing
15:41firms that may also use customer
15:43personal data to do business, but they
15:45may not have as strong security and
15:47privacy safeguards. Security lapses at
15:50these third-party companies have
15:52generated major problems in the past
15:54main companies as damaging and
15:56embarrassing breaches have occurred and
15:58caused customers and regulators to
16:00question everyone involved in processing
16:02the data. The message is that businesses
16:05must ensure that their third party
16:06suppliers respect data privacy laws and
16:09be checked regularly for compliance.
16:12Accidental disclosure and leakage. Well,
16:14not all personal data incidents are
16:16hacker related or deliberate in nature.
16:19In fact, it's very common to see cases
16:21where personal data such as personnel
16:22records being accidentally published
16:24online or customer information being
16:27sent to an old address or emailed to
16:29someone with a similar name. There are
16:31also many cases of access permissions to
16:33sensitive files and folders,
16:34particularly in the cloud, been set to
16:36public accidentally. In the vast
16:38majority of cases, these are preventable
16:40mistakes which could be avoided through
16:42training and further checks and
16:44balances. So, what about sharing
16:46riskrevention steps? Well, it's not
16:49possible to mitigate every risk with
16:51third parties or from accidental
16:53disclosure, but it is possible when
16:55you're working with personal data to
16:56contemplate and avoid a lot of them.
16:59When sharing personal with data with
17:01thirdparty processors, ask yourself the
17:03following questions. Am I sharing the
17:05minimum amount of data necessary to
17:07perform the required task? Has the
17:09customer consented for this data to been
17:12shared? The consent still current? Is
17:14there a legal basis for sharing the data
17:16such as contractual obligations which
17:18we'll cover shortly in legal basis? And
17:21is there a mechanism to purge the data
17:23when it's no longer needed? Data
17:25retention then as if you will. So, when
17:27it comes to avoiding accidental
17:28disclosure, the key to success is
17:30practicing thoughtfulness. This means
17:33more double-checking of email and
17:34physical addresses for accuracy and
17:37checking permissions on files and
17:38storage locations before sharing them
17:40with anybody else.
17:45Protecting customer data. In the last
17:48slide, we looked at procedural steps you
17:50can take to protect personal data. In
17:53this slide, we'll look at more technical
17:55steps that are essential in protection
17:57of this data. The first of these is
17:59encryption. But why is this important?
18:02Well, in some cases, you may be sending
18:04personal data via email, which could
18:07present a problem if the information
18:08were publicly disclosed or hacked. It's
18:11important in a case like this that the
18:12email is encrypted via an improved
18:14method or service to protect its
18:16contents from hackers and preserve its
18:19confidentiality. Many organizations may
18:22encrypt email automatically via
18:23technical means, but it's not always the
18:25case. So, you should ensure that
18:27encryption is enabled for all emails
18:29containing personal data. The same can
18:31be said for wireless connectivity at
18:33home. It's important to ensure that the
18:35strongest form of encryption is enabled,
18:37usually WPA2 or 3 in the home office
18:41Wi-Fi setting, and that you use long
18:43complex Wi-Fi passwords, which are
18:45changed frequently. I would actually
18:47recommend some form of password manager
18:50to manage all of your online account
18:52credentials as it's not uncommon for the
18:54average user to have more than 40 online
18:56accounts. Remember that having a short
18:58password or one with names, dates, or
19:00consecutive numbers is no different than
19:02having no password at all as they can be
19:04cracked very quickly with hacker tools
19:06today. This brings us to two-factor
19:08authentication which is yet another
19:10important security feature which has
19:12become an essential part of personal
19:14data security. It's likely that you
19:16already have come across this feature
19:17when using banking apps or when
19:20requesting remote access into work when
19:22you're pro prompted to enter a PIN or
19:24password along with the secondary
19:26approval steps such as a text message
19:29with the code. The point here is that
19:31passwords on their own are not
19:32trustworthy enough and a second way of
19:34verifying your identity is required. If
19:37you're presented with an option for
19:38setting up two-factor authentication for
19:40accounts such as social media, Google,
19:43Amazon, etc. then go ahead and take the
19:45time to apply it. Safe storage and clear
19:47desks. Whether you're in the office or
19:49at home, it's important to be aware of
19:51physical data security around your desk
19:53area. What does this mean? Well,
19:55confidential material can be found on
19:57phones, printouts, printer trays,
19:59handwritten notes, along with portable
20:01devices, including thumb drives, cell
20:03phones, laptops, which could all be
20:05vulnerable to snooping, copying, or
20:07theft. It's important, therefore, to
20:08keep a clear workspace and lock away
20:11documentations and devices when finished
20:13with them. The risk associated with this
20:15kind of vulnerability only increases the
20:18more public your workspace is. So, such
20:20as a front desk or a high people traffic
20:23area or conference room, for example.
20:25Software updates are yet another
20:27important part of keeping malware at
20:30bay. This applies to all desktop and
20:32mobile devices, which includes
20:34applications, the operating system
20:35updates, anti virus, and browser
20:38updates. Why is this important? Well,
20:40hackers move quickly to exploit
20:42weaknesses in software, which means that
20:44the older the software is on your
20:46device, the more time they have to build
20:48malicious code to get onto your machine
20:50and extract personal data.
20:55There are a few other data protection
20:57practices to consider when handling
20:59personal data which we'll briefly
21:00discuss here. The first of which is
21:03media disposal. Media disposal is a key
21:06but sometimes overlooked element in
21:08protecting personal data as some may see
21:10old data and material as of no value.
21:13But that's not always the case. Of
21:14course, as a precaution, it's important
21:16to cross cut shred documents or at least
21:19use confidential bins if available to
21:21dispose of old documents. Remember that
21:24end of life electronic media and devices
21:26need to be considered too in the
21:28disposal process as they often contain
21:30gigabytes or even terabytes of data.
21:32Basically, it's never okay to dispose of
21:34devices in regular bins as it could
21:36easily be targeted by opportunistic
21:38thieves. It's also extremely important
21:40to consider backups. Data backups are
21:42often the first and best form of
21:44restoration in cases of ransomware or
21:46hardware loss and failure. This is
21:48particularly important with customer and
21:50confidential data. They may exist in the
21:52home office environment. You should
21:54consider backups to both a local and
21:56remote destination such as a local
21:58backup drive in your workspace and then
22:00a remote cloud backup as a secondary
22:03measure. It's also best practice to test
22:06doing a restore as well to validate that
22:09the whole backup process works. Privacy
22:11screens are obiscation filters. These
22:14may be a recommended addition for
22:16computer computer monitors so that
22:17visibility is restricted to only users
22:20who are close and directly in front of
22:21the monitor. This can be useful for
22:23computer users who work a lot with
22:25personal data on the screen in public
22:27areas or when data is highly sensitive
22:30on a regular basis. Another critical
22:32area to consider in customer data
22:34protection is incident reporting. It's
22:36like the old saying says, if you see
22:38something, say something. It's critical
22:40that incidents are reported quickly,
22:42even if they may seem insignificant, as
22:45they often can be telltale signs of
22:47something bigger and more sinister a
22:49foot. Examples might be suspicious
22:51emails, pop-up security warnings on the
22:53desktop, or slow PC performance, or
22:56suspicious movements by office visitors.
22:58Vigilance is the key when it comes to
23:00prevention of security incidents. And
23:02then, of course, there's regulatory
23:03awareness, which is a sizable part of
23:06maintaining data privacy in the
23:07workplace. We'll delve more into privacy
23:09regulations in lecture six, but in
23:12preparation for that, it's important for
23:14data handlers to realize that there are
23:16many regulatory requirements such as
23:18only sharing the minimum amount of data
23:20necessary form the task being used and
23:22the concept of consent when using
23:24customer personal data. Most regulatory
23:26fines today are related to ignoring
23:28rules like these and not being
23:30transparent when c with customers on how
23:32their data is being used.
23:35Now it's time for a quick three question
23:38multiplechoice quiz. Be ready to select
23:40your answer on each slide.
23:46Question one, which one of these is not
23:49an example of personal data? Choose your
23:52answer.
23:56And the answer is website address as
23:59it's not public information.
24:04Question two, how many breaches were
24:07reported in the US in 2024? Select your
24:10answer.
24:14The answer is 3500.
24:20Final question. Question three. Which
24:23one of these is critical when deciding
24:25when to share personal data with third
24:27parties?
24:32The answer is authorization.
24:36Data senders must ensure that any
24:38transfers are authorized with a valid
24:40legal basis.
24:49Social media privacy risks. Social
24:52media, as you may know, does not have a
24:54great track record on the privacy front.
24:56Back in 2015, Facebook shared the
24:59personal data of over 87 million of its
25:01users with a company called Cambridge
25:04Analytica in London, who later sold the
25:06data for political ads targeting voters
25:09in the Trump election campaign in 2016.
25:12Cambridge Analytica went out of
25:14business, but not before it drew a lot
25:16of scrutiny from regulators everywhere.
25:19As a result, the seemingly neverending
25:21stream of cases hit all the social media
25:24giant giants relating to things like
25:26password leaks, insufficient security
25:29safeguards, improper transfers of EU
25:32citizen data to the US, forced consent
25:35to use services, forced acceptance of
25:38cookies, lack of transparencies in what
25:41happened to personal data, and much
25:42more. In fact, Facebook was hit with a
25:45record 1.2 2 billion euro fine for the
25:48aforementioned transfers of EU citizen
25:51personal data to the US without adequate
25:54security protections. But the problem
25:56didn't end there. Social media is
25:58somewhat of a mecca for all sorts of
26:00personal data mining and other nefarious
26:03activities. Hackers love public
26:06information, particularly where
26:07workplace information, email addresses,
26:10phone numbers, and photos can all be
26:11found in one place.
26:13They regularly use automated tools known
26:15as data scraping tools which quickly
26:18reads this type of information found in
26:20public and public public profiles
26:22creates lists that may be used for
26:23identity theft, fake profile generation,
26:26deep fake image generation and even
26:28reconnaissance reconnaissance for
26:30attacks on companies. Yes, hackers often
26:34do quite a lot lot of research on their
26:36targets before they strike. So it's
26:38gleaning public information from social
26:40media accounts of company employees can
26:42be very useful to them when crafting
26:44fishing emails for example. This all
26:46brings us to yet another significant
26:48risk with social media. This time on the
26:51messaging front. Messaging apps make it
26:53easy to share attachments like images
26:55and documents. Unfortunately, it's all
26:58too common to see people take photos of
27:00credit card information, forms, bank
27:02account details, and other personally
27:04identifiable information and share it
27:06with others. The problem is that these
27:08messenger platforms retain these
27:10documents in conversation history which
27:12it could expose the data if the plat
27:14platform or account ever gets hacked.
27:16These attachments can also contain
27:18malware particularly hidden in PDFs
27:21which can easily deceive recipients into
27:24opening them.
27:29Social media good practices. With social
27:32media, you can actually accomplish a lot
27:34of security objectives just by taking a
27:36few steps. One essential one is enabling
27:39two-factor authentication, which you've
27:41already mentioned two slides back. You
27:43can set up various methods of two-factor
27:45authentication, but the main thing is to
27:47enable it. This is a really strong
27:50deterrent against hackers as passwords
27:52on their own are very crackable and may
27:54end up in lists on the dark web to be
27:57sold and later exploited. So when you
27:59are choosing passwords, I recommend a
28:01password manager to create and manage
28:03them as you may have many of the
28:05features that you'll need such as
28:06password change reminder, secure
28:09storage, and password field autofill
28:12features. There's also an extra step as
28:15a matter of good security hygiene, and
28:17that's conducting an account activity
28:19review, which many platforms like
28:22Facebook, LinkedIn, Google, and
28:24Microsoft offer. An account activity
28:26review is usually an option found under
28:28security setting which will show you who
28:30is currently logged into your account
28:32and from where giving you the option to
28:34end suspicious loggedin sessions and
28:37prompt you to change your password and
28:39possibly report it to the help desk.
28:41Also, it's always a good idea to review
28:44friends connections and third parties
28:46app to see if they're still valid.
28:48Remove anyone and anything that seems
28:50odd or inappropriate as it's always
28:51advisable to keep your risks to a
28:53minimum. So, what about posting on
28:56social media? Well, awareness is the key
28:59here. Ask yourself, do I need to post
29:02details publicly about my employment?
29:04Tag work colleagues. Provide exact
29:07addresses or photos with things such as
29:09license plate numbers on cars. At the
29:11very least, limit audiences to friends
29:14only. Be cautious about posting content
29:16that could be problematic if shared with
29:18your employer or future employer such as
29:21images featuring drug use or posts about
29:24strong political or religious beliefs.
29:26Lastly on this topic, messaging
29:29security. We spoke about the risks in
29:31the last slide. Here we want to remind
29:33you to avoid sharing attachments with
29:35any kind of personal data and of course
29:38not to click on untrusted links in
29:40messages. Hackers frequently use
29:43authentic or official sounding messages
29:45purporting to be from Meta, LinkedIn
29:48security, etc. asking you to resolve an
29:51issue with your account before
29:52deactivation takes place. It's advisable
29:55to block the sender and report this to
29:57Meta or whoever it is via their official
29:59page and not to click any any links.
30:08Privacy law overview. In this section,
30:10we're covering data privacy law starting
30:12with GDPR and then moving to the US and
30:15Canadian data privacy laws which are
30:17very similar in nature. We've mentioned
30:19GDPR earlier in context of privacy law.
30:22But what is it? Well, keeping it high
30:24level at the moment, GDPR stands for
30:26general data protection regulation which
30:28was enacted in the European Union in
30:302018. It's a privacy law with 99
30:33articles designed to protect the
30:35personal data of EU citizens being
30:37processed by businesses anywhere in the
30:39world. The main features of the law,
30:41which we'll cover here, include the
30:43eight consumer rights, and seven data
30:46protection principles that companies
30:48must abide by when processing personal
30:50data. We'll look at the two-tier fine
30:52structure, the internet cookie consent
30:55law defined in the e- privacy
30:57regulation, and how the US and Canada
30:59have adopted adapted GDPR into their
31:01statutes.
31:07GDPR is filled with terminology, but
31:10there are three essential terms to
31:11understand when working with the
31:13regulation. They are the data
31:15controller, the data processor, and the
31:18data subject. The data controller can be
31:20defined as an individual or legal entity
31:23who controls how personal data is used
31:25by the business. The data processor on
31:27the other hand follows instructions from
31:29the controller on what to do with
31:31personal data. But finally, the data
31:33subject is the person who which the
31:35personal data is about. There can be
31:37different arrangements with these roles
31:38in that you can sometimes have joint
31:40controllers and many data processors
31:43working with the same personal data
31:44transmitted from the controller.
31:50GDPR rights. So what are the main rights
31:53granted to individuals under GDPR? Well,
31:56there are eight rights which are
31:57included in the regulation which
31:59companies in the EU are obliged to honor
32:01for their customers. They include the
32:04right to be informed on how their data
32:06personal data has been used and shared
32:08and any changes of use. Next to the
32:12right of access, which means consumers
32:14can request a human readable copy of
32:16data that is held on file by a company.
32:19It must be provided within 28 days of
32:21the request and free of charge.
32:24Next is the right of rectification which
32:26means customers have the right to
32:27correct data be held on them such as
32:29their name and address. Then is there is
32:32the right to object to processing. So
32:35individuals can formally withdraw
32:36consent for continued use of their data.
32:39Then there's the right to restrict
32:40processing. So individuals can request
32:42limits to how their data is used. For
32:45example, restriction on third party
32:47advertising from their uh personal data.
32:50Then there's the right of portability
32:52which means that customers can transfer
32:54the records to another organization eg
32:56to another health insurance for example.
32:59And then there's the right to be
33:00forgotten where individuals can request
33:02their data be deleted. And then lastly
33:04the right to object to automatic
33:06decisionmaking. Customers can object to
33:08the personal data being used in
33:10automatic decisions such as credit or
33:12loan decisions.
33:19For companies, there are seven
33:20principles that govern how they must
33:22protect the personal data of their
33:24customers. We show them here on this
33:26slide. Starting with the lawfulness. So
33:28lawfulness answers the question of
33:30whether a company has the right to
33:31process the data in the first place. So
33:34there are six legal bases that c that
33:36businesses can use to justify processing
33:39personal data. They include consent,
33:42contract, legal obligation, vital
33:46interests, public tasks or legitimate
33:49interests. It's important to highlight
33:51that since customers must explicitly
33:53consent or opt in to having their
33:55personal data used when consent is used
33:58as a legal basis for processing their
34:00data. The term opt-in comes up
34:02frequently in GDPR, particularly when it
34:04relates to business websites when
34:06they're asking for consent to collect
34:08personal data about you. The second GDPR
34:10principle is purpose limitation, which
34:13directs companies only to use data for
34:16its intended purpose. This principle is
34:18designed to prevent companies from
34:20reusing the data for something else and
34:22for gain without the express permission
34:24of the individual. The next principle is
34:26data minimization which requires
34:29companies only to use the minimum amount
34:31of data to get the job done. Then there
34:33is data accuracy principle which
34:36requires businesses to maintain accurate
34:38personal data records at all times. And
34:41then the final three principles require
34:43businesses to one purge personal data
34:45when it's no longer required and two
34:48restrict access based on need and then
34:51lastly three meet accountability
34:54requirements. These accountability
34:55requirements include legal obligations
34:57where companies are expected to document
35:00all the data processing activities,
35:02implement appropriate safeguards, notify
35:04authorities of a data breach within the
35:06statutory 72 hours, and appoint a data
35:10protection officer when required.
35:19In this slide, we can see the fine
35:21structure for GDPR, of which there are
35:23two levels. Level two is for less severe
35:26violations and carries a fine of up to€
35:2910 million euro or 2% of the prior
35:31year's annual global turnover of the
35:34company, whichever amount is greater.
35:37Level one fines carry a fine of up to 20
35:40million euro or 4% of the prior year's
35:43annual global turnover of the company.
35:47Level one fines can get quite high,
35:49particularly for tech giants who are
35:51essentially built on mountains of
35:53personal data. As an example of a level
35:56one fine, Facebook, who had over 135
36:00billion in revenue in 2023, was
36:03fined$1.2 billion euro for GDPR
36:06violations based on a percentage of
36:08their annual global turnover.
36:11So who is responsible for enforcement?

About this transcript

This page contains the full transcript of YouTube transcript (sQBSVa4FicI) , generated from the public captions YouTube serves with the video. The transcript has 5,609 words across 924 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.