1. www.informationpolicycentre.com 1

2. The role of Privacy Risk Framework and Risk-Based Approach in Delivering Effective Privacy Compliance Bojana Bellamy International Privacy Commissioners’ Conference, Mauritius October 2014

3. www.informationpolicycentre.com 3 Why is Privacy Risk “In”? It has always been “in”, but with a different focus – Risk to organisations v. Risk to individuals (tangible and non-tangible harms /negative impact from data processing) Modern information age requires an evolved interpretation and implementation of privacy principles and innovative models of co-regulation and compliance The need to translate abstract goals of privacy and fundamental rights into more understandable, concrete and implementable steps to non-experts Risk-based approach does not replace existing law, privacy principles, accountability and regulatory supervision, but calibrates compliance – based on context, severity, likelihood Risk assessment is an increasing legal requirement and an element of organisational accountability

4. www.informationpolicycentre.com 4 Benefits of a Risk-based Approach to Privacy Effectiveness Organisations Prioritisation; predictability; ROI in compliance; protection of reputation and shareholder value DP regulators Prioritisation in oversight, enforcement, sanction Law and policy makers Smart regulation = calibrated and context driven; outcome based; technology neutral IndividualsReal protection Society Enables economic growth, societal benefits and protection of fundamental rights Prospects to improve global interoperability by creating common expectations, common best practices and common outcomes

5. www.informationpolicycentre.com 5 Organisational Accountability and Privacy Management Program Accountability and Effective Compliance Leadership & Oversight Risk Assessment Policies & Procedures Privacy by Design Training & Communication Verification and Audits Response and Enforcement

6. www.informationpolicycentre.com 6 Risk Assessment Calibrates Privacy Program and Compliance Risk Assessment At program level Determines the program and the elements Periodic program assessment v. internal and external risks Adjusting elements of the program At element and requirement level New product, service, technology (PIA, PbD) Legitimate Interest Processing SecurityData Breach