Chapter 8: Privacy Governance

Question 1

List the elements of the Conceptualizing a Privacy Governance Program pyramid

Answer 1

Law & Policy
Privacy Controls
Security Controls
Standards
Compliance
Technology

Question 2

What is the role of the Law & Privacy element in the privacy governance program pyramid?

Answer 2

Translate fundamental requirements—whether foundational legal requirements or organizational privacy policies—into tooling that is manageable and scalable with the organization’s IT needs

Question 3

What is the role of the Compliance element in the privacy governance program pyramid?

Answer 3

Building upon law and established organizational policy, compliance begins the translation into practical and measurable requirements and the process through which privacy can be implemented and evaluated

Question 4

What is the concept of reasonable assurance?

Answer 4

Means that requirements and objectives are not absolute, but rather based upon some criteria that is deemed practical to implement and manage

Question 5

Why is reasonable assurance so important when safeguarding privacy in IT?

Answer 5

It affords flexibility and is greatly valuable for managing the potential overengineering of solutions
It also grounds solutions in common sense

Question 6

What are internal controls?

Answer 6

Objectives tied to practical measurements and designed to evaluate components governed by the privacy program

Question 7

What are the 2 flavours of internal controls?

Answer 7

• Preventative - designed to stop an activity from occurring

* Detective - for identifying problematic behaviour after the event has occurred

Question 8

What does compliance offer a privacy program?

Answer 8

Structure

Question 9

What is the role of the Security element in the privacy governance program pyramid?

Answer 9

Protecting against unauthorized access and malicious actions

Question 10

How are security risks often framed?

Answer 10

CIA
• Confidentiality
• Integrity
• Availability

Question 11

Provide an example of how security and privacy differ

Answer 11

Security can reasonably assure that two parties exchange personal data securely, but it is privacy that reasonably assures that the authorized parties are in fact using the personal data appropriately

Question 12

What benefits does security provide to privacy?

Answer 12

• Information security is more mature technologically
• Frameworks and certifications are well established
• Security thus provides privacy an avenue through which meaningful IT solutions can be developed to safeguard privacy
• As security and compliance are as intertwined as privacy and compliance, reasonably assured internal controls can be repurposed, or extended, as necessary in order to maturate the privacy governance program
• Important benefit for privacy: The ability to translate privacy into meaningful and understandable terminology for engineers

Question 13

What benefits do industry standards such as NIST offer?

Answer 13

Establishment of a common language - this results in transparency

Standards provide a mechanism through which an organization can transparently describe its controls tied to governance and information technology in common and accessible terms

This helps build trust between an organization and its key stakeholders or customers and, in addition, provides auditability through independent third-party certification

Question 14

What is the role of the Standards element in the privacy governance program pyramid?

Answer 14

Standards provide a mechanism both to fact-check if the security and privacy controls meet minimum expectations as defined by outside parties

Question 15

What are the 2 overall aims of the privacy governance program?

Answer 15

To be:
• Structured
• Enduring

Designed controls should focus on structuring objectives and activities in measurable and discrete ways that connect, but do not embed, higher-order legal requirements or lower-level technological solutions

Question 16

What are the 6 core activities typical of a privacy program?

Answer 16

• Privacy and Data Protection Impact Assessments
• Privacy Reviews
• Training and Awareness
• Privacy Incident Management
• Third-Party Relationships
• Consent and Notice

Question 17

Describe the Privacy and Data Protection Impact Assessments activity of a privacy program

Answer 17

Assessments evaluating privacy harms and issues for major activities undertaken by an organization

Question 18

Describe the Privacy Reviews activity of a privacy program

Answer 18

Individual design reviews of systems or activities to evaluate sufficiency of privacy safeguards employed

Question 19

Describe the Training and Awareness activity of a privacy program

Answer 19

Educational and awareness activities for personnel supporting privacy functions within the organization. (Awareness may also include external engagement and transparency activities)

Question 20

Describe the Privacy Incident Management activity of a privacy program

Answer 20

Management and response for privacy-related incidents within the organization

Question 21

Describe the Third-Party Relationships activity of a privacy program

Answer 21

Requirements and privacy safeguards when interacting and sharing personal data with external organizations

Question 22

Describe the Consent and Notice activity of a privacy program

Answer 22

Practices and requirements to provide notice and appropriate consent for users of organizational services

Question 23

What is evaluated in a privacy review?

Answer 23

Among other things…
• the data and uses of a given service
• dataflows (across systems as well as geographic boundaries)
• consent/notice in keeping with organizational requirements
• access control
• other aspects as defined by an organization’s privacy program

Question 24

List the 3 steps that are helpful to conceptualize a model for data and use specifically tailored to an organization’s needs and goals

Answer 24

1 Business objective and purpose—Identifying the business objectives and associated purposes

2 Law and policy—Once business objectives and purposes are understood, law and policy help shape the limits

3 Technology—Ultimately, the data and uses, tied to business objectives and constrained by rules, must be channeled through technological controls

Question 25

How do you put in place privacy engineering?

Answer 25

Translating the highest-order objectives of a privacy governance program into actionable, practical technical controls, rationalized against an organization’s evaluation of privacy risk and the fundamental capabilities available within the organization’s IT infrastructure