Our position is that all Personal Information is handled as confidential information and gets the strictest due diligence for governance. Personal Information has many forms and has many layers. If you have the data controller's opt-in, you can gather and process their personal information. We have strict policies regarding the processing and storage of any personal information. This includes technical information like email address, ip addresses, login ids, etc.
For us, you must have a legitimate business reason to possess and process personal information. You must also have a method for the data controller to opt-out. Once your project or program is complete, the data is either returned to the controller or simply destroyed following the guidelines in out Information handling policy. This is regardless of whether the data exists in the wild or not.
This is stated in our privacy policy.
Original Message:
Sent: 10-23-2020 10:03 AM
From: Jeff Bater
Subject: Is information in the public domain considered private and confidential?
I have seen this question discussed multiple times in many outlets out there.
Name, address and phone numbers are not always considered confidential or private if they are already in the public domain. Third Party Management offices struggle with this in other companies as well. It may be PII, but of a different category and may not be considered a privacy concern as opposed to nonpublic information.
I am interested in how any of your companies view this question and handle this in your privacy policies?
Thank you,
Jeff Bater