October was celebrated as Cybersecurity Awareness Month, dedicated to raising awareness of the importance of cybersecurity and the conversation continues. As Jamaica continues its digital transformation journey, cybersecurity becomes even more critical to mitigating inherent risk. Though important, cybersecurity does not stand alone in protecting our information. Two other concepts —privacy and data protection — are just as important, and the three work best together. Cybercrime further reinforces the importance of all three concepts. As organizations become increasingly dependent on digital systems, they are more exposed to threats. These threats can compromise the confidentiality, integrity and availability of the information and be used for the furtherance of several criminal offences.
Cybersecurity, data protection, and privacy are three close relatives that live separate lives but always stay in touch. Cybersecurity is that defensive relative that protects the family. Data protection is the bridge that keeps the family connected, while privacy is the relative who sets the boundaries and decides what family business stays confidential and what gets shared. Think about how many everyday activities, such as paying at the supermarket, receiving a salary, or booking a doctor’s appointment, depend on systems most of us never see. When one of those systems is compromised, the impact quickly reaches ordinary people, which is why these three relatives must work together.
CYBERSECURITY
Cybersecurity is the practice of protecting systems, networks, and information from unauthorized access, theft, or damage. In a world that is more digitally connected than ever, a strong cybersecurity posture must include not only technological controls such as strong passwords, system updates, and multifactor authentication, but also responsible people and robust and defined processes. Together, these create an effective defense against attackers getting in and limit the damage they can do. Cybersecurity measures help detect suspicious activity and isolate affected systems to limit disruption. Consider an organization that notices unusual activity on its network. A prepared team can quickly take the affected system offline, contain the threat, and stop it from spreading to other systems. That is cybersecurity working as designed: even when an attacker gets in, early detection and a swift response limit the damage.
DATA PROTECTION
This entails the rules and controls that govern the collection and handling of personal data to maintain privacy. This is where the Data Protection Act, 2020 comes in. The Act protects an individual’s right to privacy by preventing misuse of data and unauthorized access. It reinforces that organizations should responsibly handle the personal data they process by complying with eight (8) prescribed data protection standards, which ultimately reduces risks. The Seventh Standard requires organisations to implement appropriate organisational and technical measures to protect personal data against misuse and unauthorised access. Cybersecurity measures form an integral part of complying with this standard. Data protection promotes accountability, builds trust, and empowers individuals to exercise greater control over their personal data. Compliance with the Act is promoted and monitored by the Office of the Information Commissioner, Jamaica’s data protection regulatory authority.
PRIVACY
Privacy is about your control and autonomy; it concerns your right to question the purpose, necessity, use, and permissions associated with the handling of your personal information. An organization can have a strong information security system, but still fail at privacy through collecting more data than is necessary, without informed and clear consent, and using the data for unintended purposes. In today's digital economy, organizations must comply with the Data Protection Act, 2020, respect individuals’ privacy, be transparent about how the data is being used, obtain user consent before their data is processed, and implement appropriate controls to protect the data they handle from being misused and accessed inappropriately. However, protecting privacy is a shared responsibility. Individuals must also play their role by being careful with what personal information is shared, to whom it is shared, and for what purpose it is being requested. Behind every record is a real person, and details such as a name linked to a bank or card number can be used by malicious actors to cause further harm.
THE BOTTOM LINE
Without information security, there is no privacy, especially of personal data, which must be protected under the law. Data protection provides the rules which keep security and privacy consistent. Cybercrimes are, more often than not, also data breaches because personal data remain one of your most valuable assets and threat actors are always aware of that. Every breach should therefore be a reminder to maintain defenses across all systems to protect every piece of information and every cyber incident/cybercrime should also bring into focus your obligations under the Act to assess and reassess your compliance. Protecting the core is not enough if adjacent systems hold sensitive data.
The Office of the Information Commissioner reminds the public that protecting personal data is a shared responsibility. Individuals have a responsibility to know their rights and be careful with what they share online and offline, and even with trusted organizations. Organizations must secure the data they hold, handle it responsibly, and respect individuals’ privacy. Let us work together to make privacy a priority by complying with data protection requirements, including implementing appropriate cybersecurity measures to safeguard our personal information and help prevent cybercrimes. Together, we can make Jamaica a cyber-strong nation.
Santana Broderick
Information Systems Manager