Theory: Confidentiality vs. Privacy
Week 6 was about access control: deciding who is allowed to touch the data. Week 7 asks the next question: once someone touches the data, how do we keep it safe, and are we even allowed to use it the way we are using it? This lesson separates two ideas that people constantly mix up, confidentiality and privacy, and shows why an organization can be excellent at one and still fail the other.
The opening question
MediCare Plus Hospital has excellent access control. A staff member who is allowed to view patient records copies them and sells them to a third party. Did access control fail?
Not really. Access control did exactly its job: it let an authorized person in. The failure happened after access was granted, through misuse by an insider. That gap, between “allowed to see” and “allowed to do anything with it”, is what this week is about (and what DLP in 7.4 tries to close).
Think of two everyday situations:
- A friend tells you a secret. You are trusted to keep it from others. That is confidentiality: protecting information from people who should not see it.
- You decide who knows your phone number, address and health history. That is privacy: your right to control information about you.
| Confidentiality | Privacy |
|---|
| Focus | Protecting data from unauthorized access | An individual’s right to control their own data |
| Perspective | Organization-centric (the organization protects what it holds) | Individual-centric (the person the data is about) |
| Basis | Control-based (locks, permissions, encryption) | Rights-based (consent, purpose, legal rights) |
| Example breach | A hacker steals a database | Data is used without consent |
| Who is “the bad actor”? | Usually an outsider or an unauthorized insider | Often the organization itself |
Confidentiality is keeping data away from anyone who is not authorized to access it, an organization-centric, control-based goal (the “C” of the CIA triad).
Privacy is an individual’s right to control how their personal data is collected, used and shared, an individual-centric, rights-based concept protected by law (for example, Thailand’s PDPA, see 7.3).
The Key Insight
An organization can have perfect confidentiality and still violate privacy.
How? Confidentiality only asks “did the data stay inside the authorized circle?” Privacy also asks “should the organization be collecting this at all, and is it using it for what the person agreed to?” Two classic privacy failures happen entirely inside a perfectly secured system:
| Privacy failure | Meaning | MediCare Plus example |
|---|
| Over-collection | Gathering more personal data than the stated purpose requires | The appointment form demands a national ID number, religion and income “just in case” |
| Purpose creep | Using data for something the person never agreed to | Phone numbers collected for appointment booking are later used for marketing SMS |
In both cases no hacker is involved and no unauthorized person sees anything, so confidentiality is intact, yet the patient’s rights have been violated.
Common mistake: “No breach happened, so there is no problem.” A privacy violation does not require a breach or an outsider. Selling data, over-collecting or reusing it for a new purpose are violations even if the data never leaves an encrypted, access-controlled database.
Classifying Situations: C, P or Both?
The lecture poll asked students to classify four MediCare Plus situations.
| # | Situation | Answer | Why |
|---|
| 1 | A hacker breaks into the system and steals the patient database | Confidentiality | Access-control failure: an unauthorized party gained access |
| 2 | MediCare Plus sells patient phone numbers to an insurance company without consent | Privacy | No breach occurred: the organization itself used the data beyond its original purpose |
| 3 | A nurse accidentally drops a patient file in the elevator; a stranger picks it up | Confidentiality | Data left organizational control, even though it was unintentional |
| 4 | Phone numbers collected only for appointment booking are used to send health-package promotion SMS | Both | Purpose creep (privacy), plus data handled outside what the patient authorized, a possible consent violation under PDPA |
A quick test that helps:
- Did someone who was not authorized get the data? If yes, it is a confidentiality issue.
- Did the organization collect or use the data in a way the person did not agree to? If yes, it is a privacy issue.
- If both answers are yes, it is both.
What Could Access Control Have Prevented?
Access control (Week 6) stops unauthorized people. It cannot stop the organization’s own decisions.
| Prevented by access control | Requires policy / law instead |
|---|
| Situations 1 and 3: keeping data in controlled custody (logical controls against the hacker; physical controls and handling rules so paper files do not leave secured areas) | Situations 2 and 4: the organization itself chose to misuse data it legitimately holds; only policy, consent rules and law (PDPA) can stop that |
Diagram loads as you scroll.
Exam tip: when asked “could access control have prevented this?”, look at who acted. If the actor was authorized (the hospital itself, or a staff member with legitimate access), access control alone cannot be the answer; you need policy, law, monitoring or DLP.
To manage both confidentiality and privacy, an organization first needs to know how sensitive each piece of data is. That is data classification (7.2).
Worked Examples
Exercise 1
MediCare Plus has excellent access control. A billing clerk who is allowed to view patient records exports them and sells them to a third party. Did access control fail? What kind of issue is this, and what kind of controls are needed instead?
Show solution ↓Hide solution ↑
Solution
Step 1: Was the access authorized? Yes. The clerk’s role legitimately grants access to patient records, so the access-control system correctly let her in. Access control answers who may touch the data, and it gave the right answer.
Step 2: What went wrong? The data was then disclosed to an unauthorized third party. The buyer was never authorized, so this is a confidentiality breach (and, because patients never agreed to their data being sold, a privacy violation too). The cause is an insider misusing legitimate access.
Step 3: What could address it? Controls that work after access is granted:
- clear acceptable-use and confidentiality policy with consequences;
- access logging and review, so unusual bulk viewing is noticed;
- DLP rules, such as approval before bulk export and blocking export to personal channels (see 7.4);
- legal deterrence (PDPA criminal penalties for intentional disclosure of sensitive data, see 7.3).
Answer: access control did not fail; it correctly admitted an authorized user. The failure is insider misuse after access, a confidentiality breach (with privacy impact), which needs policy, monitoring/logging and DLP rather than stronger access control alone.
Exercise 2
Classify each situation as a Confidentiality issue, a Privacy issue, or Both:
- A hacker breaks into MediCare Plus’s system and steals the patient database.
- MediCare Plus sells patient phone numbers to an insurance company without consent.
- A nurse accidentally drops a patient file in the elevator; a stranger picks it up.
- MediCare Plus uses phone numbers, collected only for appointment booking, to send health-package promotion SMS.
Show solution ↓Hide solution ↑
Solution
Apply the two-question test: (a) did an unauthorized person get the data? (b) did the organization use or collect data in a way the person did not agree to?
- (a) Yes, the hacker is unauthorized. (b) No, the hospital did nothing it was not allowed to do. Confidentiality: an access-control failure.
- (a) No break-in, no outsider stealing. (b) Yes, the hospital itself used the data beyond its original purpose. Privacy.
- (a) Yes, a stranger now holds the record; data left organizational control, even though it was an accident. (b) The hospital did not intend any new use. Confidentiality.
- (b) Yes, the data is used for a purpose the patients never agreed to (purpose creep). The data is also handled outside what the patient authorized, a possible consent violation under PDPA. Both.
Answer: 1 = Confidentiality, 2 = Privacy, 3 = Confidentiality, 4 = Both.
Exercise 3
For the four situations in Exercise 2, which ones could Week 6’s access control have prevented, and which require policy or law instead? Explain the general rule.
Show solution ↓Hide solution ↑
Solution
Access control is designed to stop unauthorized people from reaching data.
- Situation 1 (hacker): the attacker is unauthorized, so stronger authentication, authorization and monitoring would block or limit the attack. Preventable by access control.
- Situation 3 (dropped file): the record escaped controlled custody. Physical access controls and handling rules (records stay in secured areas, electronic access instead of carrying paper) keep data in authorized hands. Preventable by access control.
- Situation 2 (selling to insurer) and Situation 4 (marketing SMS): the actor is the hospital itself, which is fully authorized to access its own data. No permission setting stops an organization from misusing data it legitimately holds. Only policy, consent requirements and law (PDPA purpose limitation) can.
General rule: access control stops unauthorized actors; it cannot stop authorized actors from misusing data.
Answer: Situations 1 and 3 could be prevented by access control; Situations 2 and 4 require policy and law.
Exercise 4
“An organization can have perfect confidentiality and still violate privacy.” Explain this statement and give a MediCare Plus example of each of the two privacy failures from lecture.
Show solution ↓Hide solution ↑
Solution
Step 1: What does perfect confidentiality guarantee? Only that no unauthorized party ever accesses the data. It says nothing about whether the organization should have collected it or how the organization itself uses it.
Step 2: Where can privacy still fail? Privacy is the individual’s right to control their data. The organization can breach that right with data that never leaves its secure systems:
- Over-collection: gathering more personal data than the stated purpose requires. Example: the online appointment form requires religion, salary and national ID number to book a routine checkup. All of it is stored encrypted and access-controlled, but the hospital had no need for it.
- Purpose creep: using data for something the person never agreed to. Example: treatment history collected for care is analysed to target patients with paid health-package advertisements.
Answer: confidentiality only controls who can access data; privacy also limits what the organization collects and how it uses it. Over-collection (collecting unneeded data) and purpose creep (reusing data for a new, unagreed purpose) violate privacy even inside a perfectly secured system.
Exercise 5
For each case, name the privacy failure (over-collection or purpose creep) or say that it is not a privacy failure:
- A hospital parking app asks for the user’s blood type and medical history to issue a parking ticket.
- Patient email addresses collected to send lab results are given to the hospital’s café to send coffee coupons.
- A patient’s allergy list, collected at registration, is shown to the nurse preparing that patient’s medication.
Show solution ↓Hide solution ↑
Solution
Ask for each: what was the stated purpose, and does this collection or use fit it?
- Purpose: issuing a parking ticket. Blood type and medical history are not needed for that. Over-collection.
- Purpose: sending lab results. Coffee coupons are a new purpose the patient never agreed to. Purpose creep.
- Purpose: safe treatment. Showing allergies to the treating nurse directly serves that purpose, and she has a legitimate role-based need. Not a privacy failure.
Answer: 1 = over-collection, 2 = purpose creep, 3 = not a privacy failure (legitimate use for the stated purpose).