Where networking and knowledge intersect.
Haris Hamidovic, CIA
No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.— Article 12, United Nations, Universal Declaration of Human Rights1
Rapid advancements in computer technology make it possible to store and retrieve vast amounts of data of all kinds quickly and efficiently. These advancements have raised concerns about the impact of large computerized information systems on the privacy of data subjects. Furthermore, regulated industries, such as financial services, now place additional conditions on how personal information is collected, stored, shared and used.
New ways of using existing technology and new technologies bring new or unknown risks. It is advisable that corporations handling financial information be proactive in protecting and not abusing the privacy of their consumers and partners.2
ISO 22307:2008, Financial services—Privacy impact assessment, recognizes that a privacy impact assessment (PIA) is an important financial services and banking management tool, used within an organization, or by contracted third parties, to identify and mitigate privacy issues and risks associated with processing consumer data using automated, networked information systems (IS). This article will focus and comment on the ISO privacy standard and PIA in general. It will present common PIA components for institutions handling financial information that wish to use a PIA as a tool to plan for, and manage, privacy issues within business systems that they consider to be vulnerable.
A PIA can be seen as a subsystem of a larger system of privacy protection within the organization.3 A main element that affects the system of privacy protection, and all its parts, is the requirement of regulators and law.
Citizens, today more than ever, are fearful of what information is being gathered about them and by whom, what information is being shared about them and with whom, how that information is being used, and how long it is being retained. Privacy concerns have sparked debates and provoked legislators to enact laws both protecting and restricting privacy.4
The Organization for Economic Cooperation and Development (OECD) has been a frontrunner in the privacy and security arenas and has contributed strongly to the development of the global legal framework. In 1980, the OECD developed its Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (OECD Privacy Guidelines). Virtually all privacy legislation and directives find their foundation in this OECD document.5
In 1995, the European Union (EU) raised global awareness of privacy issues with the adoption of the EU Data Protection Directive. In adopting the directive, the EU wanted to ensure that “fundamental” privacy rights were protected when personal information was processed, regardless of the national citizenship of the individual data subjects and without restricting the free flow of personal information within the EU.
Largely because of the EU directive’s prohibition on the transfer of personal information to countries with inadequate legal protection—and the fear in many countries of the potential adverse economic impact that could result from the interruption of data flows from EU countries—a number of other countries have passed essentially identical national data protection legislation, in part, to ensure uninterrupted data flow from the EU. These countries can be roughly divided into two categories:
The EU Data Protection Directive went into effect in October 1998 and prohibits the transfer of personal data to non-EU countries that do not meet the European privacy standard for data protection. Although the US and the EU share the goal of enhancing privacy protection for their citizens, the US takes an approach to privacy that is different from that taken by the EU. The US uses a sectoral approach that relies on a mix of legislation, regulation and self-regulation. The EU, however, relies on comprehensive legislation that, for example, requires creation of government data protection agencies; registration of databases with those agencies; and, in some instances, prior approval before personal data processing may begin.
As a result of these different privacy approaches, the EU directive could have significantly hampered the ability of US companies to engage in many transatlantic transactions. To bridge the different privacy approaches and provide a streamlined means for US organizations to comply with the directive, the US Department of Commerce, in consultation with the European Commission, developed the so-called Safe Harbor Privacy Principles.7
Most developing countries fall into the last category. The US falls into the middle category, and the EU has the more regulatory approach of the first category.8
Privacy impact assessments are not used in all jurisdictions with data or privacy protection regulation. Many exercises, which are called privacy impact assessments, are, however, little more than legal compliance checks.
Good privacy is good business. Good privacy practices are a key part of corporate governance and accountability. One of today’s key business imperatives is maintaining the privacy of personal information.9
Becoming privacy-compliant is a process. It requires adherence to a well-defined methodology, documentation of information, systems, data uses and requirements. The first step is to identify where the enterprise is, then determine where it should be and, finally, identify the path to get there. In between, numerous activities are required.
An adequate privacy compliance program can create or improve consumer trust and, thereby, impact sales and revenue. In addition, such a program can assist in mitigating law suits; surviving the court of public opinion; enhancing corporate branding; and improving the quality of corporate information on consumers, suppliers and employees through better management of personal information.10
A privacy compliance audit differs from a privacy impact assessment in that the compliance audit determines an institution’s current level of compliance with the law and identifies steps to avoid future noncompliance with the law. While there are similarities between PIAs and privacy compliance audits in that they use some of the same skills and are tools used to avoid breaches of privacy, the primary concern of a compliance audit is to meet the requirements of the law, whereas a PIA is intended to investigate further to identify ways to safeguard privacy optimally.11
A PIA is a tool that, when used effectively, can identify risks associated with privacy and help organizations plan to mitigate those risks. Recognizing that the framework for privacy protection in each country is different, the internationalization of privacy impact assessments is critical for global banking, in particular for cross-border financial transactions.12
The following sections analyze each of these basic PIA elements.
PIA PlanThe PIA process requires a plan with a scope. This scope shall guide the PIA process for a specific proposed financial system (PFS). A PFS involves:
The PIA plan shall systematically establish the steps to be followed, questions to be answered and options to be examined for the PFS being assessed.
The identification of known and relevant risks to personal information is required. There may be risks to personal information other than those addressed by privacy laws and regulations. These include identity theft and pretexting. Identifying all known and relevant risks to personal information should precede any study or research, examination of alternatives to the proposed financial system, and the rendering of conclusions and recommendations.
The PIA plan should include a detailed description of the PFS, as defined by the scope. The business process and data flow diagrams need to identify how information flows through the organization as a result of a particular business activity or activities. At a minimum, the diagrams should identify, on a general level, the major components of the business processes and how personal information is collected, used, disclosed and retained through this process.
AssessmentAssessment should be performed within the scope defined by the PIA plan, using competent expertise. Business process and data flow analysis of the personal information used by the system(s) need to be performed.
ISO 22307:2008 requires that gap analyses be performed on privacy policy compliance and impact analyses be performed on infrastructure support and the security program.
Findings and recommendations should be determined for the PIA report.
PIA ReportThe PIA report is a policy-level discussion of a PFS that summarizes the specific privacy implications and risks together with mitigation measures, as appropriate.
Competent ExpertiseThe PIA process for a PFS and its services should require competent expertise as directed by the financial institution. Competent expertise should be required throughout the PIA process, including the development of the PIA plan, the performance of the PIA assessment and the development of recommendations in the PIA report.
Degree of Independence and Public AspectsThe degree of independence should be balanced against corporate needs to protect trade secrets, and it could include:
Use in the Proposed Financial System Decision MakingA PIA could be used in the following ways:
The following are examples of problems that may be identified by performing the PIA process:
Privacy impact assessments are only valuable if they have, and are perceived to have, the potential to alter proposed initiatives in order to mitigate privacy risks. Where PIAs are conducted in a mechanical fashion for the purposes of satisfying a legislative or bureaucratic requirement, risk assessment, as a key element of PIA, is often omitted.
Privacy is an issue that cannot be presented without proper context. The natural connection between privacy and security is quite simple: Without security there is no privacy.
In many countries, because there is no legislative mandate to conduct privacy impact assessments and because the privacy commissioner can only recommend their completion, provision of assistance and guidance to those conducting PIAs is critical to having the PIA adopted.
PIAs and privacy compliance represent the subsystems of the wider system of privacy protection. Good privacy protection systems must include both elements.
While there are similarities between PIAs and privacy compliance audits, in that they use some of the same skills and seek to avoid privacy breaches, compliance audits are primarily directed toward existing systems to validate their compliance with required policies, standards and law. By contrast, a PIA is used at an early stage in the development of a PFS and is useful in identifying optimum privacy options and solutions. If a PFS introduces a change to an existing system, the most recent privacy compliance audit provides very useful information for assessing the impact of the PFS.
The PIA is a tool for addressing privacy issues in a system under development. To be effective, a PIA needs to be conducted as part of a formalized process. The PIA provides a way to ensure that a proposed new system under development complies with applicable laws and regulations governing customer and consumer privacy.
One way of proactively addressing privacy principles and practices is to follow a standardized privacy impact assessment process for a proposed financial system, such as the one recommended in ISO 22307:2008.
1 United Nations, Universal Declaration of Human Rights, General Assembly, 19482 International Organization for Standardization, ISO 22307:2008, Financial services—Privacy impact assessment, 20083 ISO 22307 can be used to define the basic characteristics of PIA as a functional whole, in terms of the system’s theory, i.e., its elements, structure and purpose.4 Westby, Jody R. (editor); International Guide to Privacy, American Bar Association, USA, 20045 Parker, Robert G.; “Personal Information Privacy Is Quickly Becoming a Global Imperative,” Information Systems Control Journal, USA, vol. 3, 20016 Organization for Economic Co-operation and Development (OECD), Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, France, 19807 Op cit, Westby8 Ibid.9 American Institute of Certified Public Accountants and Canadian Institute of Chartered Accountants, Generally Accepted Privacy Principles, CPA and CA Practitioner Version, 200910 Parker, Robert G.; “Personal Information Privacy Is Quickly Becoming a Global Imperative,” Information Systems Control Journal, vol. 3, 200111 Op cit, ISO 22307-200812 Ibid.13 Ibid.
Haris Hamidovic, CIAis chief information security officer at Microcredit Foundation EKI Sarajevo, Bosnia and Herzegovina. Prior to his current assignment, Hamidovic served as IT specialist in the NATO-led Stabilization Force (SFOR) in Bosnia and Herzegovina. He is the author of four books and more than 60 articles for business and IT-related publications. Hamidovic is a certified information technology expert appointed by the Federal Ministry of Justice of Bosnia and Herzegovina.
Enjoying this article? To read the most current ISACA® Journal articles, become a member or subscribe to the Journal.
The ISACA Journal is published by ISACA. Membership in the association, a voluntary organization serving IT governance professionals, entitles one to receive an annual subscription to the ISACA Journal.
Opinions expressed in the ISACA Journal represent the views of the authors and advertisers. They may differ from policies and official statements of ISACA and/or the IT Governance Institute® and their committees, and from opinions endorsed by authors’ employers, or the editors of this Journal. ISACA Journal does not attest to the originality of authors’ content.
© 2010 ISACA. All rights reserved.
Instructors are permitted to photocopy isolated articles for noncommercial classroom use without fee. For other copying, reprint or republication, permission must be obtained in writing from the association. Where necessary, permission is granted by the copyright owners for those registered with the Copyright Clearance Center (CCC), 27 Congress St., Salem, MA 01970, to photocopy articles owned by ISACA, for a flat fee of US $2.50 per article plus 25¢ per page. Send payment to the CCC stating the ISSN (1526-7407), date, volume, and first and last page number of each article. Copying for other than personal use or internal reference, or of articles or columns not owned by the association without express permission of the association or the copyright owner is expressly prohibited.