I understand that the confidentiality aimed at protecting access to the system data, while privacy aimed at protecting access to the person data. Now, could we consider anonymity as a sub-characteristic of privacy and privacy as a sub-characteristic of confidentiality?
Confidentiality is about a data, whereas privacy is about a person/group of people/organization.
Every data belongs to a person. Every person is identified by his data. So these 2 notions extend each others. Interpreting one of them as being a sub-characteristic of an other is correct at your will.
Confidentiality is a set of rules that limits access to a certain data.
Privacy is the ability of an individual/group to choose which data about himself/themselves is shared and given access to.
Therefore, privacy is obtained through confidentiality.
Anonymity is the ability of an individual/group to keep their identity secret.
Note that confidentiality is about data, while privacy and anonymity is about people.
Anonymity can be considered a level above over privacy, as in this case the identity of the individual to which relate the data is unknown.
Note that data might breach privacy and anonymity more easily than one thinks:
- Concerning privacy, you can tell e.g. the religious affiliation of an individual if his phone cell location records show that he's every Sunday morning near a Protestant church.
- Concerning anonymity, 87% of USA individuals can be identified by their gender, date of birth and ZIP code of residence only (1990 U.S. Census data).
I like the definition given by Ross J. Anderson in his book, in chapter 1 :
Security Engineering: A Guide to Building Dependable Distributed Systems (2nd Edition)
available for free on his website : http://www.cl.cam.ac.uk/~rja14/book.html
Confidentiality involves an obligation to protect some other person’s or organization’s secrets if you know them.
Privacy is the ability and/or right to protect your personal secrets; it extends to the ability and/or right to prevent invasions of your personal space (the exact definition varies quite sharply from one country to another). Privacy can extend to families but not to legal persons such as corporations.