First Reference Talks

Privacy risk management – by design

Author: Colin Braithwaite

Posted on Thursday, June 10th, 2010 at 10:00

Image taken from: http://www.hoax-slayer.com

I’ve discussed the Privacy by Design (PbD) principle before, in the Inside Internal Control newsletter. In case you don’t know, PbD is an approach developed by Dr. Ann Cavoukian, the Privacy Commissioner of Ontario, which proactively embeds privacy protection by default in the design of an organization’s practices and products.

Now the commissioner has released a paper that discusses the integration of PbD principles into a Privacy Risk Management framework, built on the model of ISO 31000. The paper is aimed at organizations that already have privacy and risk management capabilities in place. As Dr. Cavoukian writes, “By embedding privacy into their existing risk management framework, they will be able to manage risks associated with the protection of personal information, in much the same fashion as any other business risk.”

You can find other useful papers on the Privacy by Design website.

And you can find confidentiality and privacy policies in all of First Reference’s Internal Control Library publications: Information Technology PolicyPro, Not-for-Profit PolicyPro and Finance and Accounting PolicyPro.

Colin Braithwaite
First Reference Internal Controls Managing Editor

Tags: confidentiality, employee personal information, PbD, PbD principles, personal information, privacy, privacy and risk management, privacy by design, Privacy Commissioner, privacy legislation

This entry was posted on Thursday, June 10th, 2010 at 10:00 and is filed under Human Resources, Internal Controls, IT, Privacy and Security, Privacy and Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.