1: Introduction to Privacy Program Management

Question 1

Program mgmt.

Answer 1

*The process of managing multiple projects across an org to improve performance
*Allows for:
oversight and status of projects to ensure goals of program are met
holistic view of multiple projects and change mgmt.
metrics to be viewed across program

Question 2

Privacy program management

Answer 2

The structured approach of combining several projects into a framework and lifecycle to protect personal information and the rights of individuals

Question 3

Results of a properly structured privacy program

Answer 3

*Comply with legal and regulatory requirements
*Meet the expectations of customers
*Prevent and mitigate privacy risks

Question 4

Framework

Answer 4

*The structure needed to support prog. mgmt.
*Privacy prog. framework created by analyzing applicable laws, regulations and best practices tailored for the goals of the org.

Question 5

Key concept: A structured privacy program…

Answer 5

exhibits an organization’s thoughtful and intentional plan to protect personal information and the rights of individuals

Question 6

Privacy governance life cycle

Answer 6

Assess, protect, sustain and respond

Question 7

Framework and life cycle

Answer 7

*
*

Question 8

Key concept: Privacy program framework and lifecycle

Answer 8

Provide:
*Guidance and structure necessary to deal with privacy, which is dynamic and difficult to measure
*Reusable procedures and processes that outline course of action
* Inquiry topics and direction, (e.g., problem definition, purpose, literature review, methodology, data collection and analysis) to ensure quality through repeatable programmatic steps, thereby reducing error or gaps in knowledge or experience.

Question 9

Key concept: Ownership and management of framework shared with

Answer 9

other stakeholders throughout the org, including employees, exec leadership, managers and external entities such as partners, vendors and customers.

Question 10

Assess

Answer 10

*Provides the steps, checklists and processes necessary to assess any gaps in a privacy program as compared to industry best practices, corp. policies, applicable laws and regulations and the framework developed for the org.
*Elements may be performed in varying order and combinations
*Models and frameworks that allow measurement and alignment of these activities include AICPA/CICA Privacy Maturity Model, Generally Accepted Privacy Principles (GAPP) and Privacy by Design (PbD).

Question 11

Protect

Answer 11

*Provides the data life cycle, information security practices and PbD principles to protect personal information
*Embeds privacy principles and infosec mgmt practices within the org to address, define and establish privacy practices
*Since privacy spans the org, must take into account laws and regulations applying to other areas such as labor or telecom law as they may interact w/privacy laws

Question 12

Sustain

Answer 12

*Provides privacy mgmt through the monitoring, auditing and communication aspects of the framework
*Includes audit, risk and security practices
*Ensures business as usual for identification, mitigation and reporting of risk in variation or gaps in operations to meet regulatory, industry and business objectives
*Monitoring should be continuous and based on the org’s risk appetite

Question 13

Respond

Answer 13

*Includes the respond principles of information requests, legal compliance, incident-response planning and incident handling
*Org needs to be prepared to properly receive, assess and respond to requests from customers, partners, vendors, employees, regulators, shareholders…