yes, they are subtly different (but only if you are fully modelling Role Based Access Control (RBAC)):
consider an ER model for role based authorisation:
- an application has functions
- functions may be performed by roles
- identities are given roles
- individuals are provisioned with identities
bringing that together a little bit, we can say:
+ an individual (who has an online identity), performing a role is given permission to perform functions in applications
- the permission is the ER link between the role, function and application, i.e. permissions are given to roles
- the privilege is the ER link between an individual and the application, i.e. privileges are given to people.
HOWEVER, many designers don't bother separating individual and role or don't separate function and application and so the difference between privilege and permission is missed. In my experience, you often see this when someone says "use AD groups to store RBAC" - this is a serious anti-pattern.
In a world where there are requirements to report on toxic combinations and granular permissioning is more common place then it the data model for storing RBAC is very much more important.