IS3350 Security Issues in Legal Context Unit 5 Security and Privacy Involving Corporations and Educational Institutions

Learning Objective Identify the basic components of the American legal system Describe legal compliance laws addressing public and private institutions

Key Concepts Protecting children on the Internet Family Education Rights and Privacy Act (FERPA) Regulation of privacy and security in corporations Sarbanes-Oxley (SOX) Compliance and security controls

EXPLORE: CONCEPTS

Critical Aspects of FERPA Right to inspect and review student education records Right to request that a school correct inaccurate or misleading records Schools required to secure written permission from parent or eligible student to release information from student education record

School Disclosure Exceptions in FERPA School officials with legitimate educational interest Other schools to which a student is transferring Specified officials for audit or evaluation purposes Appropriate parties in connection with financial aid to a student

School Disclosure Exceptions in FERPA (cont.) Organizations conducting certain studies for or on behalf of the school Accrediting organizations Response to judicial order or lawfully issued subpoena Appropriate officials in cases of health and safety emergencies State and local authorities within a juvenile justice system, pursuant to specific State law

School Disclosure Exceptions in FERPA (cont.) Directory information Student and parents must be informed and raise no objectives Name, address, and telephone number Date and place of birth Honors and awards Dates of attendance

Critical Aspects of Sarbanes-Oxley (SOX) Protect investors by requiring accuracy and reliability in corporate disclosures Created new standards for corporate accountability Created new penalties for acts of wrongdoing, both civil and criminal Changes how corporate boards and executives must exchange information and work with corporate auditors

Critical Aspects of Sarbanes-Oxley (SOX) continued Specifies new financial reporting requirements Requires all financial reports to include an internal control report Auditing firms are also required to attest to the accuracy of the assessment

Critical Sections of Sarbanes-Oxley Act Services outside scope of auditor practice Sec. 302 Corporate responsibility for financial reports Sec. 404 Assessment of internal controls Sec. 409 Real time issuer disclosures Sec. 802 Criminal penalties for altering documents Sec. 806 Protection of employees exposing fraud Sec. 807 Criminal penalties for defrauding shareholders

Privacy – Principle Concepts Privacy of employee data Privacy of customer data Privacy of corporate data

Privacy in Workplace Law generally allows organizations to monitor employee conduct Protection of proprietary information Maintain privacy of customer information

COPPA and CIPA Children are Internet-ready and receptive Lack the judgment and knowledge of dangers Lack knowledge to evaluate the merits of information U.S Congress Protective Actions Children's Online Privacy Protection Act (COPPA) of 1998 Children's Internet Protection Act (CIPA) of 2000

EXPLORE: PROCESS

Children's Online Privacy Protection Act (COPPA) Notice of information practices on home page Notice at each area where personal information from children is collected Notice must be clearly written and understandable Notice may not include any unrelated or confusing materials Notification of parent is required Verifiable parental consent is required

EXPLORE: CONTEXT

Where do COPPA and CIPA Apply? Commercial Web sites Online services Educational institutions Libraries  

CIPA Requirements Schools and libraries must Use technology protection measures Protect against access to harmful visual depictions Adopt and enforce a policy to monitor the online activities of minors Minors are those 17 years of age or less

Summary Protecting children on the Internet Family Education Rights and Privacy Act (FERPA) Regulation of privacy and security in corporations Sarbanes-Oxley (SOX) Compliance and security controls