
In the digital age, where information serves as a cornerstone of both opportunity and risk, regulatory bodies worldwide have enacted privacy and security laws to safeguard user data. This chapter aims to dissect the different compliance regulations, delving into specific articles that delineate the mechanisms and obligations designed to protect user data.

\section{General Data Protection Regulation (GDPR) - European Union}

The General Data Protection Regulation (GDPR), which took effect on May 25, 2018, is a significant piece of data protection legislation established to govern the processing, storage, and management of personal data from individuals residing in the European Union (EU, 2016).
This legislation marks a substantial enhancement of the EU's data protection capabilities, aiming to address the privacy issues emerging from the rapid advancement of digital technologies.
While GDPR is designed to safeguard the data of EU citizens, its influence extends globally, impacting any organization that engages with the European market or manages personally identifiable information of individuals within the EU \cite{li2019impact}.

\subsection{Data security}

The GDPR requires an appropriate and organizational measure to handle data securely.
This is emphasized in the recital 78 citing \cite{whatisGDPR}: ``The protection of the rights and freedoms of natural persons concerning the processing of personal data require that appropriate technical and organizational measures be taken to ensure that the requirements of this Regulation are met. To be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures that meet in particular the principles of data protection by design and data protection by default. Such measures could consist, inter alia, of minimizing the processing of personal data, pseudonymizing personal data as soon as possible, transparency about the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the
controller to create and improve security features. When developing, designing, selecting, and using applications, services, and products that are based on the processing of personal data or process personal data to fulfill their task, producers of the products, services, and applications should be encouraged to take into account the right to data protection when developing and designing such products, services, and applications and, with due
regard to the state of the art, to make sure that controllers and processors can fulfill their data protection obligations. The principle of data protection by design and by default should also be taken into consideration in the context of public tenders'' \cite{GDPR}.

Technical measures encompass various actions, ranging from mandating employees to implement an authentication and authorization mechanism on accounts containing personal data \cite{whatisGDPR}. Organizational measures involve initiatives such as conducting staff training sessions, integrating a data privacy policy into the company's employee handbook, or restricting access to personal data solely to relevant employees within the organization,

\subsection{Data protection by design and by default}

From now on, everything done in an organization must, by design and by default, consider data protection. Practically speaking, this means you must consider the data protection principles in the design of any new product or activity. The GDPR covers this principle in Article 25.

\section{ Health Insurance Portability and Accountability Act (HIPAA) - United States}

The 1996 Health Insurance Portability and Accountability Act (HIPAA) established federal guidelines for safeguarding the private health information of patients, prohibiting its disclosure without patient authorization or knowledge. 
The U.S. Department of Health and Human Services (HHS) formulated the HIPAA Privacy Rule to apply these requirements. In addition, the HIPAA Security Rule was introduced to protect a specific segment of data protected under the Privacy Rule \cite{HIIPA_DEFINITION}.

\subsection{Who is covered by the rule}

As the HIIPA act safeguards patient information, every organization or entity that collects or has any interaction with this type of information is under this compliance law. 
This includes health plans, health care clearinghouses, and any health care provider who transmits health information in electronic form \cite{aspectsOfHIIPA}.


\subsection{What information is protected by the law}

Not all user data are under HIIPA protection, the patient's data under the said law are only protected health information\cite{aspectsOfHIIPA}.

Individually identifiable health information encompasses information, along with demographic details, that pertains to:


\begin{itemize}

    \item the individual's health status or medical conditions in the past, present, or future.

    \item any health care services provided to the individual,
    \item any past, current, or anticipated payments for health care services received by the individual and can either directly identify the person or there exists a reasonable possibility that it could be used for identification. This type of health information typically includes various common identifiers such as name, address, date of birth, and Social Security Number.
\end{itemize}

\subsection{What would be the relationship between data masking and the HIIPA law}

As we are protecting a user's data, the process of de-identification of information can be implemented by data masking.
De-identification is a process in which data can no longer be associated with a certain user as all reference to him has been altered or rendered anonymous. 
These types of information are reported by the article 45 C.F.R. § 164.514(b).
They include but not limited to:

\begin{itemize}
    \item  (A) Names;

    \item (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census:

        \begin{itemize}
            \item (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and
            
            \item (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.

        \end{itemize}

    \item (C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;

    \item (D) Telephone numbers;

    \item (E) Fax numbers;

    \item (F) Electronic mail addresses;

    \item (G) Social Security numbers;

    \item (H) Medical record numbers;

    \item (I) Health plan beneficiary numbers;

    \item (J) Account numbers;

    \item (K) Certificate/license numbers;

    \item (L) Vehicle identifiers and serial numbers, including license plate numbers;

    \item (M) Device identifiers and serial numbers;

    \item (N) Web Universal Resource Locators (URLs);

    \item (O) Internet Protocol (IP) address numbers;

    \item (P) Biometric identifiers, including finger and voice prints;

    \item (Q) Full face photographic images and any comparable images;

\end{itemize}

During the process of de-identifying these data, a qualified expert uses a formal process in our case it would be masking, and concludes, through the application of statistical or scientific principles ( use case testing), that the risk is very small that the information could be used to identify the individual.



\section{California Consumer Privacy Act (CCPA) - California, United States}

California set a precedent as the first U.S. state to enact a broad consumer privacy statute when the California Consumer Privacy Act (CCPA) took effect on January 1, 2020.

This law provides California residents with unprecedented rights concerning their data and places numerous responsibilities on specific businesses operating within California regarding data protection \cite{CCPAdef}.

\subsection{What is protected by CCPA}

The legislation applies to the Personal Information of all individuals identified as California Residents.
According to the Act, a ``resident'' is defined as (1) any person present in the State for reasons beyond a temporary or short-term visit, and (2) any person whose home is in the State but is currently outside the State for a brief or temporary reason \cite{CCPexplanation}.

\subsection{Who must comply with the law}

The CCPA applies to for-profit entities that gather and manage the personal information of California residents, operate within California, and satisfy at least one of the following criteria:

\begin{itemize}
    \item Generate annual gross revenues greater than \$25 million
    \item Annually collect, share, or receive the personal information of 50,000 or more California residents, households, or devices;
    \item Earn 50\% or more of their yearly income from the sale of personal information belonging to California residents.
\end{itemize}


\subsection{What qualifies the personal information}

 Personal information as defined by the CCPA is ``information that identifies,
 relates to, describes, is capable of being associated with, or could reasonably
 be linked, directly or indirectly, with a particular consumer or household'' \cite{CCPApersonalInfo}.
 
 Most personal information is almost the same as the ones seen in other regulations above and may include;

 \begin{itemize}
     \item Personal information is information that identifies, relates to, or could reasonably be linked with you or your household. For example, it could include your name, social security number, email address, records of products purchased, internet browsing history, geolocation data, fingerprints, and inferences from other personal information that could create a profile about your preferences and characteristics.

    \item Sensitive personal information is a specific subset of personal information that includes certain government identifiers (such as social security numbers);
    an account log-in, financial account, debit card, or credit card number with any required security code, password, or credentials allowing access to an account; precise geolocation; contents of mail, email, and text messages; 
    genetic data; biometric information processed to identify a consumer;
    information concerning a consumer's health, sex life, or sexual orientation;
    or information about racial or ethnic origin, religious or philosophical beliefs, or union membership.
    Consumers have the right to also limit a business's use and disclosure of
    their sensitive personal information.
 \end{itemize}


\subsection{Correlation between CCPA with data masking}

While the CCPA does not explicitly discuss de-identification or anonymization techniques outside of the definitions, it is an implicit strategy that is used to go around and sell information as no rule protects de-identified data. 

\section{Personal Information Protection and Electronic Documents Act (PIPEDA)- Canada}

PIPEDA is a Canadian privacy law that regulates Organizations so that they obtain an individual's consent when they collect and use an individual's personal information. 

\subsection{How the act applies}

Organizations that fall under the PIPEDA regulations are the ones who are in the private sector; collect use, and disclose personal information, and lastly use the information retrieved for commercial or for-profit activities in Canada \cite{PIPEDA_explained}.

\subsection{ What is protected by the law}

The first critical step in adhering to PIPEDA is to grasp the nature of personal information as defined by the act, to identify the range of information your organization manages, and to evaluate how these aspects intersect.
Under PIPEDA, personal information encompasses data concerning identifiable individuals. This scope includes both objective and subjective data, applicable whether the information is documented or not.

The Office of the Privacy Commissioner of Canada (OPC) provides examples to illustrate what constitutes personal information, highlighting its broad spectrum:

Details such as:

\begin{itemize}
    \item an individual's age, name, and identification numbers.
    \item An individual's ethnic background and blood type.
    \item Personal opinions held by an individual.
    \item Financial information including income levels, credit reports, and records of loans.
    \item Health-related information, encapsulating medical histories.
    \item The presence of any disagreements between a consumer and a business entity.
\end{itemize}

\subsection{Correlation between PIPEDA and Data masking}

According to Article 4.7 safeguards that says ``The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Organizations shall protect personal information regardless of the format in which it is held. \cite{PIPEDA_4.7}''

As data can be protected differently we can also use dynamic data masking to give access to real data to verified users and mask personally identifiable information to unauthorized users.

In our case, data masking can also be used to de-identify information and use it for commercial reasons without falling under the compliance of PIPEDA.


\section{The Data Protection Act (DPA) 2018 - United Kingdom}

The Data Protection Act 2018 governs the handling of `personal data', defined as information of individual persons.
It grants individuals the authority to request access to their data via subject access requests and establishes specific regulations that must be adhered to during the processing of personal data \cite{DPA_definition}.

\subsection{Correlation between DPA and data masking }

The DPA does not explicitly mention data masking, but the practice is relevant under the DPA's principles of processing personal data lawfully.

As DPA also bases itself on GDPR, there is a reference to Article 32 of the GDPR, titled ``Security of processing'', which requires Data Controllers and Data Processors to implement technical measures that ensure a certain level of data security appropriate for the level of risk presented by processing personal data \cite{impervaGDPRArticle32}.

With this in mind, data masking can be implemented as a way of securing user data or de-identifying it in a way that it will not fall in the GDPR domain.

%\section{Brazil's General Data Protection Law (LGPD)}
%\section{Australia's Privacy Act 1988}
%\section{Information Technology Act, 2000 - India}












