Question

A privacy engineer is asked by the CISO to help justify budget for a new enterprise encryption and access-control initiative. The CISO argues that once these security controls are fully deployed, the organization's privacy obligations will be substantially met. How should the privacy engineer BEST characterize the relationship between privacy and security to executive leadership?

Accepted Answer

Security controls such as encryption protect data confidentiality and integrity, but privacy additionally governs whether and how personal data may be collected, used, retained, and disclosed—so security supports but does not fully satisfy privacy obligations.

Answer

Privacy is a subset of security; deploying strong encryption and access controls will inherently deliver compliance with applicable privacy laws and regulations.

Answer

Security and privacy are entirely independent disciplines with no meaningful overlap, so the encryption initiative should not be considered relevant to the privacy program.

Answer

Because security failures are the only cause of privacy violations, investing in encryption and access controls eliminates the organization's privacy risk.