CIPM Flashcards
Top Privacy Team Responsibilities
- Compliance with laws and regulations
- Meet expectations of business clients and partners
- Safeguard data against attacks and threats
Responsibilities of a Privacy Program Manager
- Identify privacy obligations
- Identify business, employee and customer privacy risks
- Identify existing documentation, policies and procedures
- Create, revise and implement policies and procedures that effect positive practices
and together comprise a privacy program.
Goals of a Privacy Program
- Demonstrate compliance with applicable laws and regulations (at a minimum)
- Promote consumer trust and confidence
- Enhance organization’s reputation
- Facilitate privacy program awareness, where relevant, of employees, customers,
partners and service providers - Respond effectively to privacy breaches
- Continuously maintain and improve the privacy program
Privacy Mission Statement
Concisely communicates its privacy stance to all stakeholders (requires knowledge of privacy approaches, evaluating the intended objective, and gaining executive sponsor approval)
Common Elements of a Privacy Vision and Mission
- Value of Privacy
- Organization objectives
- Strategies to achieve intended outcomes
- Roles and Responsibilities
Defining Privacy Program Scope and Charter
- Global and local laws, regulations and standards
- Cultural expectations and perspectives, including risk acceptance
- Business sector requirements
- Types of personal information the org collects/stores and how it’s used
- Regulatory challenges
Basics of a Privacy Strategy
- Goal of the org’s Privacy Program
- Business Alignment
- Data Governance
- Inquiry/Complaint Handling procedures
Privacy Program Framework
Implementation roadmaps that guide the privacy team through privacy management and prompt them for the details to determine all privacy relevant decisions for the org.
Policy framework should include:
- organizational policies
- standards and guidelines
- clearly defined program activities
Likely includes templates tools, processes, laws and standards
Benefits of a Privacy Program Framework
- Reduce Risk
- Avoid/plan for incidents of data loss
- Sustain market value and reputation
- Provide measurements in compliance with laws, regulations, and standards
Privacy Framework Categories
- Principles and Standards (FIP, OECD, AICPA, CSA, etc)
- Laws, regulations, and programs (PIPEDA, GDPR, HIPAA, local data protection authorities, Binding Corporate Rules)
- Privacy Program Management solutions (Privacy by Design, ISVA, ENISA, NIST, CPA Canada)
Privacy Policy Lifecycle
- Draft inward facing policies that are practical, simple and easy to understand
- Get approval from stakeholders
- Disseminate and socialize to all employees
- Train employees and enforce policies
- Revise and review policies regularly (at least annually)
Privacy Governance Models
- Centralized (one person responsible for privacy)
- Localized or decentralized (decision making is delegated to lower levels of the organization)
- Hybrid (most common when a large org assigns an individual or organization responsibility for privacy-related affairs for the rest of the org)
Privacy Tech Vendors
- Privacy program management (PPM) - work directly with the privacy office (assessment, management, data mapping, etc)
- Enterprise program management (EPM) - provide solutions to support the needs of the privacy office and org (data discovery, activity monitoring, deidentification, etc.)
Privacy Strategy vs. Privacy Framework
Privacy strategy = why
Privacy framework = what
Steps to ensure compliance with applicable laws and regulations
- Identify applicable laws and regulations
- Create a data map/inventory
- Determine a mechanism for cross-border transfers
- Perform a complete Privacy Impact Assessment
Items that can affect an org’s legal obligations
- New processes
- Acquisitions
- Outsourcing agreements
- Divestitures
- New products & services
- Discontinued products & services
Binding Corporate Rules (BCRs)
Mechanism that allows for an org to transfer data across borders.
Under GDPR, BCRs require approval from a supervisory authority.
At a minimum, BCRs must include structure and contact details for the concerned group, info about the data and transfer process, how the rules apply to the general data protection principles, complaint procedures, and compliance mechanics.
Data Inventory/Data Map
A complete record of all the personal information your organization stores, uses, and processes
It can be used:
1. As a precursor to regulatory compliance and risk analysis
- To assess data, systems, and processes
- To inform data assessments, priorities, data lifecycle management, and data classification
Data inventories should:
1. Demonstrate the flows and classification of data
- Create a record of the authority of organizational systems processing personal information
- Analyze the types and uses of data
Questions to ask during Data Mapping
- Collection (format, special protection by law, intended purpose of processing, type of info?)
- Usage (how often, for what purpose, identifiable, in what format?)
- Storage (how long is data kept, where is it housed geographically, from where is it accessed, where and how does it flow?)
Privacy Assessment
Measures an organizations compliance with laws, regulations, adopted standards and internal policies and procedures.
When?
Should be conducted on a regular basis, ad hoc due to a privacy or security event, or at the request of an enforcement agency.
By Whom?
Internal audit, data protection officer, business function, external third party
How?
Subjective standards or objective standards
Then What?
Document results for management sign off, analyze results to improve and remediate program, monitor changes on ongoing basis
Privacy Impact Assessment (PIA)
Specifically assess the privacy risks associated with processing personal information in relation to a project, product or service.
Requirements around PIAs may be mandated by industry, organizational policy, and laws and regulations.
When should a PIA be conducted?
- Prior to deployment of a project, product, or service that involves the collection of personal information.
- When there are new or revised industry standards, organizational policies, or laws and regulations,
- And when the org makes changes to methods in which personal information is handled that create a new privacy risk.
Data Protection Impact Assessment (DPIA)
DPIAs have specific triggers under the GDPR
- If the processing is likely to entail a high risk to the rights and freedoms of natural persons.
- The use of new technologies, in particular, whose consequences and risks are less understood, may increase the likelihood of a DPIA
- Article 35 of GDPR has specific examples
- See Article 29 Working Party’s Guidelines on DPIA
Common Sections of a DPIA
- Project or system overview
- PIA/DPIA goals, timeframe, and scope
- Personal information, its source and the purpose for processing
- Identified risk to data subjects, including high risk
- A proposed strategy for risk mitigation or risk acceptance
- Conclusion
Attestation
Tool for ensuring functions outside the privacy team are held accountable for privacy-related responsibilities.
Questions should be specific and easy to answer. The designated department is required to answer and possibly provide evidence.
Physical Assessments
Identify operational risk
Examples:
- unlocked computer
- monitor in open concept work space
- customer document left on printer
- etc.
Vendor Assessments
Evaluation of a vendor for privacy and information security policies, access controls, where the personal info will be held and who has access to it.
Same assessment process should be followed each time the org considers a new vendor
Risks of working with vendors
- Scope creep
- Process/quality standards
- Data breaches
- Oversight
- Laws and regulations
Privacy Checkpoints for Mergers, Acquisitions and Divestitures
- Applicable new compliance requirements
- Existing client agreements
- New resources, technologies and processes
- Whether there may be concerns regarding economic concentration (org controls too large a portion of a market(
Divestitures should include a privacy check to ensure no unauthorized info remains on the org’s infrastructure
