Privacy Dispatches

How Do You Engineer Privacy? NIST Seeks Answers

Last week, the National Institute of Standards and Technology (NIST) hosted a workshop to discuss and develop the concept of privacy engineering. Although a great deal was covered, three topics recurred throughout the workshop and appeared to be of special interest to NIST, most notably the lack of technical standards concerning privacy,the role engineers can play in protecting privacy and the role NIST should play in the privacy field going forward.

Get your free study guide now!
Get your free study guide now!

Context

Making the Case for Surprise Minimization

By Jedidiah Bracy, CIPP/US, CIPP/E

Facebook made headlines this week—for a positive reason, this time—by announcing a new set of privacy controls to help users understand with whom they are communicating. Last month, at the IAPP Global Privacy Summit, Facebook CPO Erin Egan foreshadowed this roll out by exclaiming, “If people are surprised, that’s not good for me.”

What did she mean, exactly?

More from Jedidiah Bracy

Opinion

Hey “Chicken Littles,” Wyndham Doesn’t Mean the Sky is Falling

By Jeff Kosseff, CIPP/US

Based on the extensive news coverage of this week’s court ruling against Wyndham Hotels and Resorts in its battle with the Federal Trade Commission (FTC), one would think that the sky is falling on efforts to resist FTC enforcement actions relating to data security.

More from Jeff Kosseff

Opinion

European Court Gives a Boost to EU Data Protection Reform

On April 8, the Court of Justice of the European Union invalidated the EU Data Retention Directive 2006/24. Beyond its significance for data retention, this judgment has important implications for EU data protection law in general and the proposed General Data Protection Regulation (GDPR) in particular.

More from Christopher Kuner

Opinion

IAPP Westin Research Center

In Standoff with FTC, Wyndham Shoots Itself in the Foot

The Federal Trade Commission’s (FTC) resounding victory over Wyndham Worldwide Corporation in a U.S. District Court paves the way for increasing privacy and data security action by the agency, which over the past decade has asserted itself as the most forceful and well-respected privacy enforcement authority in the world.

More from Omer Tene

Opinion

Getting Practical and Thinking Ahead: “Interoperability” Is Gaining Momentum

In a world of disparate privacy regimes, pragmatic privacy professionals, experts and regulators have in recent years championed “interoperability” as the way forward for providing consistent privacy protections for global data flows. Of course, many in the privacy and data protection community continue to pursue the ideal of a global privacy standard and have made various recommendations to that effect over the years. Witness the recent “Resolution on anchoring data protection and the protection of privacy in international law” adopted by the International Conference of Data Protection and Privacy Commissioners in Warsaw, Poland, last September.

More from Markus Heyder

HIPAA

Why Employers Need to Carefully Approach Employee Healthcare Data

By Kirk J. Nahra, CIPP/US

The recent controversy about AOL CEO Tim Armstrong’s comments on employee healthcare expenses reflects ongoing confusion about the actual and appropriate rules for employers and the protections for employees concerning their health care information. As employers become more involved in the overall management of employee wellness and overall healthcare expenditures, this confusion is likely to remain. Employers need to very carefully consider their approach to employee healthcare information and how they will act effectively and intelligently in this controversial and risky area.

More from Kirk J. Nahra

Opinion

The Risk of the “Risk-Based Approach”

By Stuart S. Shapiro, CIPP/US, CIPP/G

At this year’s IAPP Global Privacy Summit, I repeatedly encountered references to and quasi-explanations of the “risk-based approach” to privacy. The risk-based approach is, apparently, the new black now that accountability is no longer quite so chic. With its focus on the privacy risks incurred by individuals, the risk-based approach is, I was informed, a bold new direction for the privacy profession.

Taken at face value, it’s rather difficult to imagine a more damning indictment of the privacy profession. It’s 2014 and we’ve only just started worrying about risks to individuals?

More from Stuart S. Shapiro