CIPT

CIPT

1. Information lifecycle

   • 4 principles
     • 1. Collection 2. Use 3. Disclosure 4. Storage and destruction.
   • Data controller
     • An entity that holds personal data and determines the purposes of use.

2. Privacy by design concept

   • Organizations should build privacy directly into technology, systems and practices at the design phase to ensure privacy from the the outset.
   • 1. Proactive not reactive, preventative not remedial; as the default setting; embedded into design; full functionality - positive sum not zero-sum;end-to-end security;visibility and transparency;respect for user privacy-usercentric.

3. Frameworks

   • Fair Information Practices headings and subheadings
     • Rights of Individuals - Notice, Choice/consent, data subject access;Controls on Information - Information security, Information quality;Information life cycle - Collection, use/retention, disclosure;Management - mgmt and adminstration,Monitoring and enforcement.
     • FIP derives from US Health Education and Welfare Advisory committee (1973) p17

4. Personal info

   • Typical elements
     • Elements of HR
       • 1. Salary 2. Job title 3. Productivity and performance statistics, 4. Medical and pension benefits, 5. Employee evaluations
     • Customer data
       • 1. Name 2. Gender 3. Contact info(address, phone, email,etc.), 4. Age 5. Dob, 6. Marital status, 7. Income or education, 8. Languages spoken
   • 2 main categories of personal info
     • Customer Information
     • Employee
   • Sources
     • 3. Nonpublic info
     • 2. Publicly available info
     • 1. Public records

5. Privacy

   • Privacy Law
     • Protection of information about individuals in USA.
     • Data protection law
       • Protection of information about individuals in EU and other countries.
       • Article 8 of EU Convention 4 of Human Rights and Fundamental Freedoms provides:
         • The right to respect for one's "private and family life, his home and his correspondence", subject to certain restrictions that are "in accordance with law" and "necessary in a democratic society" p3
       • European union data protection directive
         • In response to the problems of trans-border data flows.
         • 1. unified economic market within the EU, permitting flows of personal information among the member states and 2. strong overall protection of privacy with the EU
     • OECD Guidelines 1980
       • Collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation, accountability
       • Convention for the protection of individuals with regard to the automatic processing of personal data.
     • Madrid resolution
       • Principles:1. Lawfulness and fairness, 2. Specification principle, 3. Proportionality, 4. Data quality, 5. Openness, 6. Accountability.
   • Privacy definitions
     • The desire of people to freely choose the circumstances and degree to which individuals will expose their attitudes and behaviiour to others.
     • The right of the individual to be protected against intrusion into his personal life or affaires, or those of his family, by dirct physical means or by publication of information. (UK's Calcutt Committee in 1997).
   • 4 Classes of privacy
     • 1. Information 2. Bodily 3. Territorial 4. Communications
   • Privacy policy
     • Internal statement governing the org's handling practices of personal information directed at the users of personal information. p11
     • Privacy notice
       • Statement made to a data subject describing how the organization collects uses retains and discloses personal information. p11
         • Examples
           • 1. Contracts 2. Application forms, 3. Specific web pages, 4. Terms of use, 5. Icons, 6. Signs, 7. Brochures. p11
       • A privacy notice does not relate to Monitoring and enforcement
     • Privacy impact assessments
       • Checklists or tools to ensure that a personal information system is evaluated for privacy risks and designed with life cycle principles in mind.
       • Privacy assessments/audits
         • Reviews of an organization's compliance with its privacy policies and procedures, applicable laws, regulations, service-level agreements, standards adopted by the entity and other contracts.
       • what information, why collected, intended use, with whom shared, consent and choice rights of subjects

6. Associations

   • APEC 2004
     • Asia-pacific economic cooperation and development principles
       • 1. Preventing harm 2. Notice 3. Collection limitation 4. Uses of personal information 5. Choice 6. Integrity of personal information, security safeguards 7. Access and correction, 8. Accountability
   • OECD