Question

A privacy engineer is defining the working relationship between the privacy office and the information security team for a new customer analytics platform. Security has proposed that, because they already enforce access controls, logging, and encryption, they should assume full accountability for all data protection decisions, including determining what personal data may be processed and for what purposes. How should the privacy engineer respond to best reflect the proper relationship between privacy and security?

Accepted Answer

Clarify that security safeguards data confidentiality and integrity, but privacy governs lawful purpose, necessity, and use decisions that must remain with the privacy function

Answer

Agree, since security controls fully satisfy privacy obligations once encryption and access controls are in place

Answer

Transfer all privacy decision-making to security to avoid duplicated effort and reduce overhead

Answer

Assign purpose and lawfulness decisions to the platform's data owner while removing the privacy function from the process entirely