RECOMMENDATIONS FOR STANDARDIZED IMPLEMENTATION OF DIGITAL PRIVACY CONTROLS


Background and Overview

The Digital Government Strategy issued by U.S. Chief Information Officer (CIO) Steven VanRoekel on May 23, 2012 sets forth a new vision of how Government is to connect with and provide services to the American people, harnessing the power of digital technology and enabling citizens and the Federal workforce to securely access Government digital information, data, and services anywhere, anytime, and on any device. In helping to create a 21st Century Digital Government, the Strategy recognizes that Federal agencies, as good data stewards, must adopt strong privacy, confidentiality, and security safeguards to prevent the improper collection, use, retention or disclosure of personally identifiable information (PII) when developing and delivering such digital services and programs. Services and programs that incorporate digital content, platforms, mobile applications (apps), application programming interfaces (APIs), and other new and emerging technologies must be designed and operated in a manner that fosters trust, accountability, and transparency in how personal information is collected, retained, used, and disclosed through the information’s life cycle.

To help meet this obligation, Milestone Action #10.3 of the Strategy calls upon the Privacy Committee of the Federal CIO Council, the National Institute of Standards and Technology (NIST), and the National Archives and Records Administration (NARA) to “develop guidelines for standardized implementation of digital privacy controls and educate agency privacy and legal officials on options for addressing digital privacy, records retention, and security issues.” Several efforts relating to this milestone have already been undertaken:
 
 NIST, in consultation with the Office of Management and Budget (OMB) and the Best Practices Subcommittee of the CIO Council Privacy Committee, has proposed recommended families of privacy controls. These controls supplement and & complement NIST’s recommended security control families, and apply to traditional information technology platforms (e.g., Web sites) as well as newer digital and mobile technologies (e.g., hand-held devices).

 NARA has issued Electronic Records Management (ERM) guidance for digital content created, collected, or maintained by Federal agencies. NARA also serves as managing partner of the E-Government (E-Gov) ERM Initiative, coordinating the development and issuance of enterprise-wide ERM tools and electronic information standards, to support the interoperability of Federal agency record systems and improve customer service (e.g., digital records access).

Building on these privacy, security, and records management efforts, this document explains how privacy controls help enable and promote the Strategy’s data- and customer-centric approach, and the importance of integrating such controls into the risk management process to ensure that privacy is fully incorporated in the planning and development of digital services and programs. This document then discusses three key privacy controls: (1) PII Inventory; (2) Privacy Impact Assessment (PIA); and (3) Privacy Notice. These fundamental privacy controls require that agencies identify and consider all PII that may be collected or otherwise exposed through a particular digital technology, analyze the privacy risks through the data life cycle by conducting and updating a PIA (as needed), and provide notice to individuals of when and how their PII will be collected, used, retained, and disclosed.

This document is not a formal guidance document and does not establish or alter official Federal Government policies. It does, however, offer recommendations that can serve as a resource to help agencies meet their privacy obligations as they implement the requirements of the Strategy. Moreover, this document does not attempt to provide a “one size fits all” approach, as each digital service or program will be different. Instead, it provides tools and best practices, in the form of key considerations and checklists, to standardize and streamline the implementation of these three critical privacy controls noted above, and to educate agency personnel on options for addressing privacy issues in the complex ecosystem inherent in the evolution toward a Digital Government.

Publication date: December 2012
Source:
https://cio.gov/wp-content/uploads/downloads/2012/12/Standardized_Digital_Privacy_Controls.pdf

0 yorum: