Finally,
let's peer into how an organization could maintain their
legal and regulatory privacy mandates.
Fortunately, you do not have to create a framework from scratch.
There are many out there.
The first one we'll take a look at is the Generally Accepted Privacy Principles
from the American Institute of Certified Public Accountants,
otherwise known as AICPA.
There are 10 privacy principles to pay attention to.
Management has to do with the entity defining,
documenting,
communicating, and assigning accountability, there that term is again, legal
liability, for its privacy policies and the procedures.
Notice means that the organization would provide notice about its privacy
policies and procedures and identify the purpose for which personal information
is collected, used, and retained and also disclosed.
There's a very strong position that organizations need to
maintain related to choice and consent.
These are the choices available to the individual and makes sure that the
controller obtains implicit or explicit consent with respect to the
collection, use, and disclosure of their personal information.
The collection means that the personal information is only
for the purposes intended in the notice.
Use, retention, and disposal have to do with the limits that should be put
upon the entity collecting the information so that it is only used for the
stated purpose. And once that purpose is fulfilled,
it is no longer utilized.
When we think about the idea of access,
making sure that there is adequate protection on that information,
the idea of disclosure means that the personal information should not
be put forward to a third party unless implicitly or explicitly given
consent by the data subject.
There is the idea of security for privacy that would be included in this, so
the entity protects the information against unauthorized use, both physical and
logical. Making sure that the information is accurate, up to date, and
complete. And then you have ongoing monitoring.
If you consider for a moment the DNA of the
Generally Accepted Privacy Principles,
you could see that the predecessor of the OECD way back in 1980 kind of
sets the tone for even the principles that you see here.
General data privacy concerns have to do with answering these questions.
Where is the location of the data?
What is the specific practice? An organization may not be part of an
industry, but by their participating in a particular practice,
they may come under the regulatory requirements and, obviously, the law.
Also, who is involved in the maintenance of the data? Well,
let's look at these roles for a few moments. When we think about data privacy,
the center of the universe should be the data subject.
The data subject is an identified or identifiable natural person.
The data controller is the public authority or agency that alone or
jointly determines the purpose and means of the processing of the personal
data based upon the consent of the data subject.
The processor,
you could think of them as being the platform upon which the data
controller does the work concerning the data subject.
If I were to introduce Netflix, if you are a member, AWS, and you,
which role would be which for these primary data privacy roles?
Well,
if you answer you are the subscriber as the data subject, Netflix is the
controller because that's who you made your agreement with on how they use
your personal information, Netflix operates its environment on top of AWS,
which would be considered the processor.
It is the controller that has the liability for the protection of your data.
While there are responsibilities among all three,
the ultimate liability for the disposition of the data is with the controller.
Now there are some sub‑roles that would report to the
controller and the processor known as a custodian.
A way of defining custodian simply is some type of engineer,
some type of administrator who is managing the actual system.
So Netflix has some of the best custodians or
engineers in the world, and so does AWS.
Those are simply folks that are going to report into the
controller, report into the processor.
The data steward will define the rules under which the data can be used.
So you can think of them as a non‑technical person that sort of
describes the architectural use of the data with either in the
processor or the controller's world.
They are the advocate for the subject in how the subject's information
should be used according to laws and regulations.
Many of the modern‑day cloud service providers are
actually getting certified under ISO 27018.
We'll bring this up again in later clips, but right now we want to define
the five principles that they are certifying under.
So, no matter where the cloud service provider exists, as far as
their incorporation, under the certification,
they agree that the cloud service provider must not use the
personal data they receive for advertising and marketing unless
expressly instructed to do so by the customer.
They must have explicit control granted to the data
subject for how their data will be used.
The cloud service provider must inform customers where their data resides,
disclose the use of subcontractors to process PII and make clear
commitments about how the data is handled. And when it comes to
communication, in case of breach, the cloud service provider should
notify customers and keep clear records about the incident and
their response to it.
Also, on an annual basis, they should do a successful third‑party audit
of the cloud service provider's compliance documents, the conformance
with the standard, and showing it can be relied upon by customers to
support their own regulatory obligations.
A suggested practice, also from the American Institute of Certified
Public Accountants, would be the Privacy Maturity Model.
So an organization could get a measurement of their success and how they're
doing when they're applying the GAAP principles that we previously saw, along
with the Capability Maturity Model. At the ad hoc level, this is where
procedures and processes are generally informal,
incomplete, and inconsistent.
You could even say chaotic. At the repeatable level,
procedures or processes exist; however,
they are not fully documented and do not cover all relevant aspects.
But if I carried out the same thing twice,
I should expect to get the same results. At defined, this is where
procedures and processes are fully documented and implemented and cover
all relevant aspects. And at managed, reviews are conducted to assess
the effectiveness of the controls that are in place. At optimize, this
is where you have continuous improvement toward optimization of all the
given processes.
Come on over to the summary clip, and we will close out this module.