The "I" in IT stands for information, yet few IT professionals have a sufficient understanding of information privacy standards and guidelines to properly design and delivery systems that will adequately protect personal information.

Many IT professionals mistakenly assume that information privacy is the equivalent of information security or information secrecy.  This misunderstanding leads many to embrace the following information privacy myths:

1. Information privacy is something that can be addressed after the coding is done
2. Information privacy can be addressed by hardware.
3. Information privacy can be addressed by software.
4. Having strong passwords is all that is needed to protect personal information.
5. Privacy is something the corporate lawyers do for customers.
6. IT professionals don't need to worry about information privacy.
7. If you work here, you need need access to all the data.
8. Real testing happens with real customer data (test data is somehow "weaker" than real data).
9. The data about the customer belongs to the company
10. Having a privacy policy is all that is needed to be compliant.

We'll deal with those myths on an individual basis in a future article.  Let's start now, though, with an overview of information privacy. 

The OECD publishes a very detailed set of Guidelines on the Protection of Privacy and Transborder Information Flow.

The Canadian Standard Association used the OECD guidelines to develop  ten principles that balance the privacy rights of individuals and the information requirements of private organizations.  These principles are:

1. Accountability
2. Identifying Purposes
3. Consent
4. Limiting Collection
5. Limiting Use, Disclosure, and Retention
6. Accuracy
7. Safeguards
8. Openness
9. Individual Access
10. Challenging Compliance

The Canadian Information Processing Society has a good overview of the above privacy principles. 

In reviewing the list above, you can clearly see that information privacy concerns much more than hardware, software, security, or passwords.  The principles also require that certain business processes be established to provide access to information, to challenge compliance with legislative guarantees and to identify why information is being collected.  This means that incorporating information privacy requirements into your systems will change the initiation, requirements, and design phases of your systems development life cycle.  More on that later, too.