1. Presentation annotated by Gail Magnuson LLC with permission from www.peterfbrown.comwww.peterfbrown.com Using Information Technologies to Empower and Transform This presentation supported by Gail Magnuson, President, Gail Magnuson LLC Peter F Brown Independent Consultant The Privacy Management Reference Model and Methodology from OASIS: Using the Privacy Management Reference Model and Methodology to Explore Do Not Track Design Introduction to PMRM IAPP Cleveland KnowledgeNet Presentation Gail A Magnuson, CIPP US President, Gail Magnuson LLC Gail.Magnuson@gmail.com September 2012

2. © Peter F Brown, 2012 All Rights Reserved with annotations provided with permission by Gail Magnuson LLC A Model and a Methodology 2 The model provides a common conceptual framework and vocabulary to help people cooperate across disciplines and organizational boundaries… …and the methodology provides a common set of tasks to achieve a privacy architecture and privacy management analysis

3. © Peter F Brown, 2012 All Rights Reserved with annotations provided with permission by Gail Magnuson LLC The PMRM Model 3

4. © Peter F Brown, 2012 All Rights Reserved with annotations provided with permission by Gail Magnuson LLC The PMRM Methodology 4

5. Presentation annotated by Gail Magnuson LLC with permission from www.peterfbrown.comwww.peterfbrown.com Using Information Technologies to Empower and Transform This presentation supported by Gail Magnuson, President, Gail Magnuson LLC Peter F Brown Independent Consultant The Methodology in Detail

6. © Peter F Brown, 2012 All Rights Reserved with annotations provided with permission by Gail Magnuson LLC Detailed Privacy Analysis 1.High-Level Privacy Analysis and Use Case 6 Scope General Description of Services & Application s Environment Business Use Case Inventory Applicable Requirements Privacy Conforman ce Criteria Impact Assessments Privacy Assessment Preparation Privacy Impact Assessments Privacy Maturity Assessments Compliance Reviews Accountability Model Assessments Application and Business Process DescriptionsApplicable Privacy Policies, Practices, Laws & Regulations

7. © Peter F Brown, 2012 All Rights Reserved with annotations provided with permission by Gail Magnuson LLC Domains 2.Detailed Privacy Use Case Analysis 7 Scope: High-Level Privacy Analysis High-Level Use Case Description Systems Roles & Responsibilities Actors Touch Points Owners Identify all the following:

8. © Peter F Brown, 2012 All Rights Reserved with annotations provided with permission by Gail Magnuson LLC 1 st Party Website Brower(s) or DNT 2.US DNT & EU Cookie Touch Points & Data Flows 8 System a Touch Point System b System c 3 rd Party Websites System d Big Data Vendor(s) System e Browser(s) or DNT System a Touch Point

9. © Peter F Brown, 2012 All Rights Reserved with annotations provided with permission by Gail Magnuson LLC 3.Identify PI and Privacy Controls 9

10. © Peter F Brown, 2012 All Rights Reserved with annotations provided with permission by Gail Magnuson LLC 4.Services Supporting Privacy Controls 10 Privacy Controls are usually stated in the form of a policy declaration or requirement and not in a way that is immediately actionable or implementable. Services provide the ‘bridge’ between requirement and implementation by providing privacy constraints on system-level actions governing the flow of PI between touch points 8 key PMRM Services identified in the initial work: AgreementUsageValidationSecurityCertificationEnforcementInteractionAccess

11. © Peter F Brown, 2012 All Rights Reserved with annotations provided with permission by Gail Magnuson LLC 4.Map Privacy Controls to Services 11 Ag E I Ac U V E U V S C I Incoming PI Internally Generated PI Inherited Privacy Controls Internal Privacy Controls PMRM Services Required Outgoing PI Exported Privacy Controls Ac U V S C I I U V E

12. © Peter F Brown, 2012 All Rights Reserved with annotations provided with permission by Gail Magnuson LLC 4.Map Services to Systems 12 Ag E Ac I U V E U V S C I PMRM Services Used Ac U V S C I Business Processes and Technical Mechanisms Required by System ABCDE BCEF A C D GH CEGH Risk Assessment

13. © Peter F Brown, 2012 All Rights Reserved with annotations provided with permission by Gail Magnuson LLC A Model and a Methodology 13 The model provides a common conceptual framework and vocabulary to help people cooperate across disciplines and organizational boundaries… …and the methodology provides a common set of tasks to achieve a privacy architecture and privacy management analysis

14. Presentation annotated by Gail Magnuson LLC with permission from www.peterfbrown.comwww.peterfbrown.com The OASIS Privacy Management Reference Model and Methodology Introduction to PMRM ► peter@peterfbrown.com ► www.peterfbrown.com ► PensivePeter.wordpress.com ► @PensivePeter PMRM Draft Specification: http://docs.oasis-open.org/pmrm/PMRM/v1.0/csd01/PMRM-v1.0-csd01.doc PMRM Committee Home Page: http://www.oasis-open.org/committees/pmrm USAToday EU Cookie Law Overview with Chris Wolf Interview : http://content.usatoday.com/communities/technologylive/post/2011/09/europe-taking-much- stricter-stance-on-do-not-track-rules/1#.UFiEBrJlR5U