Privacy, or information privacy, means retaining control over what personal or sensitive information is collected, accessed, shared, and used, with whom, and under what conditions. In digital identity systems, privacy is threatened when information is stored across poorly secured systems, reused beyond its original purpose, or exposed through identity and authorization logs. section 2.2.4 section 2.7.3
Privacy differs from confidentiality and authenticity. Confidentiality protects communication content from unauthorized access; authenticity establishes who the parties are. Privacy concerns whether information and communication metadata are revealed, retained, or used beyond what the individual permits. section 2.7.1
A private banking interaction
A bank must authenticate customers and retain activity logs for regulatory reasons, so a balance check is not fully private from the bank. It can still be functionally private when outsiders and employees without a need to know cannot access the record. section 2.7.2
Functional privacy turns the principle into operational controls:
- Limit access and processing to information necessary for the task. section 2.7.3
- Use governance to define who may access data and under which conditions. section 2.7.3
- Enforce fine-grained rules with Policy-Based Access Control (PBAC), such as allowing insurance verification without exposing a patient’s health history. section 2.7.3
- Apply dynamic authorization to reduce unnecessary data exposure while preserving compliance and auditability. section 2.2.4 section 2.7.3
