Assess

Question 1

Privacy operational life cycle: 4 phases

Answer 1

1. Assess (measure) current processes, procedures, management and practices for privacy management
2. Protect (improve)
3. Sustain (evaluate)
4. Respond (support)

Question 2

Assessment maturity models definition

Answer 2

methods to measure progress against established benchmarks and measurements-provides standardised reference for companies to use in assessing level of maturity of privacy program

Question 3

Assessment models

Answer 3

1. AICPA/CICA
2. PROP (privacy risk optimisation process)/PbD
3. FTC/PbD

Question 4

PbD definition

Answer 4

Embed privacy into design of technology, business practices, physical design (for assess and protect phases); dictates that privacy and DP embedded throughout life cycle of technologies

• proactive:
  
  • life cycle protection
  • embedded in design
  • by default
• respect for users
  
  • visibility/transparency
  • positive sum

Question 5

AICPA/CICA 5 level privacy maturity model

Answer 5

1. ad hoc: informal, incomplete, inconsistent
2. repeatable: procedures exist but with gaps
3. defined: fully documented, cover all
4. managed: reviews conducted for effectiveness of controls in place
5. optimized: regular reviews and feedback towards optimization

Question 6

PROP (privacy risk optimisation process)

Answer 6

used to integrate PbD into business processes

Question 7

FTC consumer PbD

Answer 7

Baseline principle of PBD is that companies promote consumer privacy throughout organization at every stage of development of products and services. Includes:
1. Substantive privacy practices:
-data security
-reasonable collection limits
-sound retention and disposal
-data accuracy
-procedural protections to implement substantive principles
Privacy protection
PIA

Question 8

Assess key areas of business

Answer 8

1. Audit: identify risks and gaps
2. IT- BC and DR and alignment with privacy policy
3. IS-IT systems, building, remote users, vendors; CIA and AA (confidentiality, integrity, availability, accountability, assurance); IRP
4. HR/Ethics - latter should be independent
5. Legal - due diligence - which privacy laws apply
6. Compliance - privacy program track and investigate roles and responsibility
7. Processors/3P vendors - privacy controls in K; vet vendors then monitor and control