Presentation is loading. Please wait.

Presentation is loading. Please wait.

1 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Making Privacy Operational International Security, Trust.

Published byMarilyn Jefferson Modified over 8 years ago

Similar presentations

Presentation on theme: "1 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Making Privacy Operational International Security, Trust."— Presentation transcript:

1 1 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Making Privacy Operational International Security, Trust and Privacy Alliance (ISTPA) Michael Willett, Seagate John Sabo, CA, Inc. The Privacy Symposium Harvard University 20 August 2008

2 2 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved What is the ISTPA? The International Security, Trust and Privacy Alliance (ISTPA), founded in 1999, is a global alliance of companies, institutions and technology providers working together to clarify and resolve existing and evolving issues related to security, trust, and privacy ISTPA’s focus is on the protection of personal information (PI) ISTPA

3 3 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved ISTPA’s Perspective on Privacy Operational – Technical, Operational Focus  …“making Privacy Operational”  based on legal, policy and business process drivers  privacy management is multi-dimensional with extended lifecycle requirements Privacy Framework v1.1 published in 2002  supports the full “Lifecycle” of Personal Information “Analysis of Privacy Principles: An Operational Study” published in 2007 See www.istpa.org for downloads ISTPA

4 4 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Three Dimensions of Privacy Management Principles/Legislation/Policies  Requirements and constraints on the collection and use of personal information by government and private sector organizations Business Processes  Data collection, processing and storage systems and business applications which make use of PI Operational Privacy Management and Compliance  Architectures and applications which incorporate standardized privacy management services and controls

5 5 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved “Analysis of Privacy Principles: An Operational Study” Principles/Legislation/Policies

6 6 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Laws, Directives, Codes Analyzed The Privacy Act of 1974 (U.S.) OECD Privacy Guidelines UN Guidelines EU Data Protection Directive Canadian Standards Association Model Code Health Insurance Portability and Accountability Act (HIPAA) US FTC Fair Information Practice Principles US-EU Safe Harbor Privacy Principles Australian Privacy Act Japan Personal Information Protection Act APEC Privacy Framework California Security Breach Bill

7 7 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Analysis Methodology Select representative international privacy laws and directives Analyze disparate language, definitions and expressed requirements Parse expressed requirements into working set of privacy categories and terms Cross-map common and unique requirements Establish basis for a revised operational privacy framework to ensure ISTPA Framework Services supports full suite of requirements

8 8 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Comparative Analysis-Sample OECD Guidelines – 1980  Collection Limitation  Data Quality  Purpose Specification  Use Limitation  Security Safeguards  Openness  Individual Participation  Accountability Australian Privacy Principles – 2001  Collection  Use and Disclosure  Data Quality  Data Security  Openness  Access and Correction  Identifiers  Anonymity  Transborder Data Flows  Sensitive Information

9 9 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Derived Privacy Requirements Accountability Notice Consent Collection Limitation Use Limitation Disclosure Access & Correction Security/Safeguards Data Quality Enforcement Openness Less common: Anonymity Data Flow Sensitivity

10 10 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved What we Discovered Example: Notice Principle Notice: Information regarding an entity’s privacy policies and practices includes 1. definition of the personal information collected 2. its use (purpose specification) 3. its disclosure to parties within or external to the entity 4. practices associated with the maintenance and protection of the information 5. options available to the data subject regarding the collector’s privacy practices 6. changes made to policies or practices 7. information provided to data subject at designated times and under designated circumstances

11 11 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved PI Lifecycle Implications of “Notice” Notice: Information regarding an entity’s privacy policies and practices definition of the personal information collected its use (purpose specification) its disclosure to parties within or external to the entity practices associated with the maintenance and protection of the information options available to the data subject regarding the collector’s privacy practices changes made to policies or practices information provided to data subject at designated times and under designated circumstances

12 12 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Revising the Framework Operational Privacy Management

13 13 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved PI Life Cycle Perspective PI Subject Requestor Collector Processor Operational Privacy Management at each touch point

14 14 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Designing a Privacy Management System Step by Step ….

15 15 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Personal Information AGENT INTERACTION CONTROL NEGOTIATION USAGE ACCESS VALIDATION CERTIFICATION Audit ENFORCEMENT SECURITY PI Touch Point Architecture

16 16 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Personal Information AGENT INTERACTION CONTROL NEGOTIATION USAGE ACCESS VALIDATION CERTIFICATION Audit ENFORCEMENT SECURITY PI Touch Point Architecture SELF- ENCRYPTING PRIVACY AGENT

17 17 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved ISTPA Privacy Framework Services Control – policy – data management Certification – credentials, trusted processes Interaction - manages data/preferences/notice Negotiation – of agreements, rules, permissions Agent – software that carries out processes Usage – data use, aggregation, anonymization Audit – independent, verifiable accountability Validation - checks accuracy of PI Enforcement – including redress for violations Access - subject review/suggest updates to PI

18 18 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Legal, Regulatory, and Policy Context Security Foundation Agent Control Interaction Negotiation PI Touch Point PI, Preferences & PIC Repository PI Container (PIC) EnforcementAuditCertificationValidation Making Privacy Operational Assurance Services Usage Access - Each Touch Point node configured with operational stack - Privacy Policy is an input “parameter” to Control - Agent is the Touch Point programming persona -PIC contains PI and usage agreements

19 19 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Legal, Regulatory, and Policy Context Security Foundation Agent Control Interaction Negotiation Any two touch points in the PI life cycle Usage PI, Preferences & PIC Repository Agent Control Interaction Negotiation PIC Repository PI Container (PIC) EnforcementAuditCertificationValidation Privacy SERVICES Assurance Services Usage Access

20 20 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Converting Privacy Requirements to Privacy Management Operations “Matrix” Conversion (ISTPA ToolKit Process): 10 Framework Services Privacy Requirements (eg, Principles, Legislation) Service FUNCTIONS

21 21 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Next Steps for the ISTPA Privacy Framework Undergoing revision now Using the Analysis findings, major revisions to Service definitions and lifecycle issues for integrating services ISTPA has joined the OASIS standards organization as an institutional member to explore standards development We welcome your input and support!

22 22 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Questions? MAKING PRIVACY OPERATIONAL Michael Willett, Seagate michael.willett@seagate.com John Sabo, CA, Inc. john.t.sabo@ca.com

Download ppt "1 Copyright © 1999-2008 International Security, Trust & Privacy Alliance -All Rights Reserved Making Privacy Operational International Security, Trust."

Similar presentations

EU Privacy Directive. What is a directive? A piece of European legislation, passed by bureaucrats, addressed to member states Member states must ensure.

EU Privacy Directive. What is a directive? A piece of European legislation, passed by bureaucrats, addressed to member states Member states must ensure.
29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY.
29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS.
29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS.
ITEC 6324 Health Insurance Portability and Accountability (HIPAA) Act of 1996 Instructor: Dr. E. Crowley Name: Victor Wong Date: 2 Sept. 2004.

ITEC 6324 Health Insurance Portability and Accountability (HIPAA) Act of 1996 Instructor: Dr. E. Crowley Name: Victor Wong Date: 2 Sept
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)
Privacy: Accountability and Enforceability Jamie Yoo April 11, 2006 CPSC 457: Sensitive Information in a Wired World.

Privacy: Accountability and Enforceability Jamie Yoo April 11, 2006 CPSC 457: Sensitive Information in a Wired World.
The Geopolitics of Personal Data and the Governance of Privacy Colin J. Bennett Department of Political Science University of Victoria BC, Canada www.colinbennett.ca.

The Geopolitics of Personal Data and the Governance of Privacy Colin J. Bennett Department of Political Science University of Victoria BC, Canada
CSE2500 Systems Security and Privacy Week 11 Privacy Law in Australia (after 2000)

CSE2500 Systems Security and Privacy Week 11 Privacy Law in Australia (after 2000)
© 2006 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice Privacy Management for a Global Enterprise.

© 2006 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice Privacy Management for a Global Enterprise.
CSE 4482, 2009 Session 21 Personal Information Protection and Electronic Documents Act Payment Card Industry standard Web Trust Sys Trust.

CSE 4482, 2009 Session 21 Personal Information Protection and Electronic Documents Act Payment Card Industry standard Web Trust Sys Trust.
Chapter 9 Information Systems Controls for System Reliability— Part 2: Confidentiality and Privacy Copyright © 2012 Pearson Education, Inc. publishing.

Chapter 9 Information Systems Controls for System Reliability— Part 2: Confidentiality and Privacy Copyright © 2012 Pearson Education, Inc. publishing.
Per Anders Eriksson

Per Anders Eriksson
High Technology Cooperation Group: Data Privacy The Indo-U.S. High Technology Cooperation Group November 18, 2004 www.usibc.com Privacy and Cyber Security:

High Technology Cooperation Group: Data Privacy The Indo-U.S. High Technology Cooperation Group November 18, Privacy and Cyber Security:
Transborder dataflows Flow of information across national borders Much of this data involves personal information.

Transborder dataflows Flow of information across national borders Much of this data involves personal information.
Data Protection: International. Data Protection: a Human Right Part of Right to Personal Privacy Personal Privacy : necessary in a Democratic Society.

Data Protection: International. Data Protection: a Human Right Part of Right to Personal Privacy Personal Privacy : necessary in a Democratic Society.
Class 13 Internet Privacy Law European Privacy.

Class 13 Internet Privacy Law European Privacy.
Privacy By Design Sample Use Case Privacy Controls Insurance Application- Vehicle Data.

Privacy By Design Sample Use Case Privacy Controls Insurance Application- Vehicle Data.
Protecting information rights –­ advancing information policy Privacy law reform for APP entities (organisations)

Protecting information rights –­ advancing information policy Privacy law reform for APP entities (organisations)
Crown copyright: State Services Commission, March 2008 1 Information for New Members of Crown Entity Boards Information for New Members of Crown Entity.

Crown copyright: State Services Commission, March Information for New Members of Crown Entity Boards Information for New Members of Crown Entity.

Similar presentations

Ads by Google