Module 1: Foundational Principles of Privacy in Technology Flashcards
Data Lifecycle
Collection, Use, Disclosure, Retention, Destruction
Data Life Cycle for Privacy
Consent/notice before collection and disclosure and use and retention and ensuring destruction
First Party Collection
Individual provides PII directly to data collector
Surveillance
Individual’s data stream behavior observed though activities, including searches and websites engaged without interrupting activity.
Repurposing
Previously collected data used for different purpose other than what it was initially collected for. Also called secondary use
Third Party Collection
Previously collected data is shared with a third party to enable new data collection
Active Collection vs. Passive Collection
Active: Customer has to do something to give data
Passive: Customer doesn’t do anything but data is still collected
Explicit vs Implied Consent
Explicit: have to actively give consent
Implied: noted in privacy link
Retention
Business Continuity Planning must be taken into account but also respect privacy standards
Destruction Methods
Overwriting, Degaussing, Incinerating
PbD Principle 1
Proactive, not Reactive; Preventative, not Remedial
PbD Principle 2
Privacy as the Default Setting
Contextual Integrity (Nissenbaum)
The preservation of situational expectations where there is an understanding between participants on societal norms or past interactions
Actors: the senders and receivers of personal information
Attributes: the types of information being shared
Transmission principles: those that govern the flow of information
Steps:
Identify relevant, existing norms
Determine how a system may disrupt those norms
Interpret and design for vulnerabilities
PbD Principle 3
Privacy Embedded into Design in online forms, logging systems, and encryption
PbD: Principle 4
Full functionality - Positive Sum, Not Zero Sum; have desired performance and functionality and protecting information privacy
PbD: Principle 5
End-to-End Security during full life cycle protection through collecting, processing, storing, sharing, destroying
PbD: Principle 6
Visibility and Transparency - Keep it Open
PbD: Principle 7
Respect for User Privacy; Keep it User Centric
How to measure risk (programmatic and technical)
Potential threat or issue + Impact of threat or issue + Likelihood
Privacy risk model management options
Accept, Transfer, Mitigate, Avoid
Fair Information Practice Principles (FIPPS)
Work alongside compliance models to mandate:
- notice, choice, and consent
- access to information
- controls on information
- how information is managed
Calo’s Harm Dimensions
Objective: privacy has been violated; direct harm known to exist; forced or unanticipated use of personal information (measurable, observable)
Loss of business opportunity; loss of consumer trust; social detriment
Subjective: expects or perceives harm; may not be observable or measurable; can cause fear, anxiety, embarrassment
Psychological, behavioral
NIST Frameworks
Risk Management Framework
Cybersecurity Framework
Privacy Framework: voluntary risk management tool; assist organizations in communicating and organizing privacy risk; rationalize privacy to build or evaluate privacy governance programs
National Initiative for Cybersecurity Education’s Cybersecurity Workforce Framework (NICE Framework)
Published by NIST; categorizes and describes cybersecurity work; establishes common terminology; intended to be applied in all sectors
