Chapter 2 - Privacy Principles

PRIVACY PRINCIPLES CHAPTER 2
Purpose of the assessments/reviews (privacy

TOPICS COVERED
impact analysis) that may be done by IS
● Introduction and General Principles auditors include:
● Audit Considerations for Privacy ● Pinpoint the nature personally identifiable
information associated with business
INTRODUCTION AND GENERAL PRINCIPLES processes
● Document the *processing (collection, use,
disclosure, and destruction) of personally
PRIVACY identifiable information
● It is a significant part of IS auditor’s role, in ● Ensure existence of accountability on
light of *global regulations privacy issues
● Key concepts: right, trust, appropriate use ● **Identify legislative, regulatory, and
of personal information, for the purpose the contractual requirements for privacy
information was collected ● Be the foundation for informed policy,
● It requires a consistent approach operations and system design decisions
throughout the organization based on an understanding of privacy risk
and the options available for mitigating that
*Examples of global regulations related to risk
privacy:
1. European Union (EU) General Data *Processing of personal information includes:
Protection Regulation (GDPR) 1. Collection
2. Health Insurance Portability & 2. Use
Accountability Act (HIPAA) in the US 3. Disclosure
4. Destruction
Privacy is the right of an individual to trust that
others will appropriately and legitimately use, **Requirements for privacy consists of:
store, share and dispose of his/her associated ● Legislative - according to law or
personal and sensitive information within the legislature
context, and according to the purposes, for which ● Regulatory
it was collected or derived. ● Contractual - under a contract
Good practices to ensure consistent approach on AFTER THE PRIVACY IMPACT ANALYSIS
privacy includes: ● Create a consistent format and structured
a) Privacy should be considered from the process for analyzing technical and legal
outset and built by design compliance with relevant regulations and
- It should be systematically built into internal policies
policies, standards, and procedures ● The structured process provides a
from the beginning. framework to ensure that privacy is
b) Private data should be collected fairly in an considered in all IT projects, from the
open and transparent manner conceptual and requirements analysis stage
- Only the data required for the to the final design approval, funding,
purpose should be collected in the implementation and communication stage, to
first instance. assure that privacy compliance is built into
c) Private data should be kept securely projects rather than retrofitted
throughout the life cycle
d) Private data should only be used for the Figure 5.3 – Changes That Impact Privacy
purpose for which they were collected
Technology Processes People
e) Private data should be accurate, complete
- New programs - Change - Business partners
and current (or up to date) - Changes in existing management - Service providers
f) Private data should be deleted when they programs - Business process
are no longer needed - Additional system reengineering
linkages - Enhanced
- Data warehouse accessibility rules
1
Chapter 2: Privacy Principles
- New products - New systems g) Accountability - assigning roles,

- New operations responsibilities, accountability, and authority
- Vendors
in performing privacy processes
h) Security safeguards - appropriate security
Tasks of IS auditor to fulfill the role of giving safeguards are in place for all personal
assurance on compliance with privacy policies, information
laws and other regulations include: i) Monitoring, measuring and reporting -
● Identify and understand compliance reporting compliance to policies, standards,
requirements regarding privacy from laws, and laws
regulations, and contract agreements. j) Preventing harm - processes to mitigate
Depending on the assignment, IS auditors personal harm to data subjects
may need to seek legal or expert opinion on k) Third-party/vendor management -
these. implement governance processes to ensure the
● Review management’s privacy policy to appropriate protections and use of personal
ascertain whether it takes into consideration information transferred to third parties
the requirement of these privacy laws and l) Breach management - documented policy
regulations and supporting procedure for identifying,
● Check if personal sensitive data are escalating, and reporting incidents
correctly managed in respect to these m) Security and privacy by design - executive
requirements support for the identification of personal
● Check if correct security measures are information and privacy risk within enterprise
adopted events
i) Dapat sa una pa lang, kasama na
AUDIT CONSIDERATIONS FOR PRIVACY yung privacy sa design, hindi yung sa
dulo mo siya ilalagay
Seven categories of privacy to be considered n) Free flow of information and legitimate
when developing audit objectives consist of: restriction - follow the requirements of
1) Person applicable data protection authorities for the
2) Behavior and Action transfer of personal information across
3) Communication country borders
4) Data and Image (Information)
5) Thoughts and Feelings
6) Location and Space (Territorial)
7) Association
Sample assurance considerations based on

ISACA’s privacy principles include:
a) Choice and consent - does the enterprise
ensure that appropriate consent is obtained
prior to the transfer of personal information
to other jurisdictions
b) Legitimate purpose specification and use
limitation - purpose for which the personal
info is obtained or collected
c) Personal information and sensitive
information life cycle - retaining personal
information as long as necessary
d) Accuracy and quality - personal
information is accurate, complete and
up-to-date
e) Openness, transparency and notice - clear
and easily accessible information on the
privacy policies and practices
f) Individual participation - providing data
subjects a process for accessing their
personal information

Chapter 2 - Privacy Principles

Uploaded by

Copyright:

Available Formats

Chapter 2 - Privacy Principles

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chapter 2 - Privacy Principles

Uploaded by

Copyright:

Available Formats

PRIVACY PRINCIPLES CHAPTER 2

Purpose of the assessments/reviews (privacy

- New products - New systems g) Accountability - assigning roles,

Sample assurance considerations based on

You might also like