- 1 Introduction
- 2 OWASP Top 10 Privacy Risk Project
- 3 Guidelines
- 4 Studies
- 5 Events
This pages covers other activities which could be of interest: guidelines, studies, events
OWASP Top 10 Privacy Risk Project
The OWASP Top 10 Privacy Risks Project provides a top 10 list for privacy risks in web applications and related countermeasures. It covers technological and organizational aspects that focus on real-life risks, not just legal issues. The Project provides tips on how to implement privacy by design in web applications with the aim of helping developers and web application providers to better understand and improve privacy. The list uses the OECD Privacy Guidelines as a framework and can also be used to assess privacy risks associated with specific web applications.
EC Data Protection Impact Assessment Template for Smart Grid and Smart Metering Systems
The Smart Grids Task Force was set up by the European Commission in 2009 to advise on issues related to smart grid deployment and development. One of the working group (WG2) is on security and privacy.
The EC has provided a Data Protection Impact Assessment Template for smart grid and smart metering systems.
The EC has decided to have a two-year trial of the template starting from March 2015.
Smart grid task force: http://ec.europa.eu/energy/en/topics/markets-and-consumers/smart-grids-and-meters
|Documents||Template document: https://ec.europa.eu/energy/sites/ener/files/documents/2014_dpia_smart_grids_forces.pdf|
CNIL Privacy Risk analysis / Privacy Impact Assessment
|Context|| CNIL is the French DPA. It has produced two guidelines in November 2012
The two guides propose a way to build a comprehensive analysis to handle complex personal data processing operations. These documents are primarily intended for use by controllers, data protection officers (DPO) and chief information security officers (CISO). They assist them in creating a rational understanding of the risks arising from the processing of personal data and to choose necessary and sufficient organizational and technical measures to protect privacy.
CNIL also published in July 2015 two documents (in French) on privacy impact assessment. See http://www.cnil.fr/linstitution/actualite/article/article/etude-dimpacts-sur-la-vie-privee-suivez-la-methode-de-la-cnil/ (in French)
|URL||English web page: http://www.cnil.fr/english/news-and-events/news/article/the-cnil-publishes-an-english-translation-of-its-two-advanced-security-and-privacy-risk-management/|
Methodology to manage risk: http://www.cnil.fr/fileadmin/documents/en/CNIL-ManagingPrivacyRisks-Methodology.pdf
Measures for the privacy risk treatment: http://www.cnil.fr/fileadmin/documents/en/CNIL-ManagingPrivacyRisks-Measures.pdf
NIST study on privacy risk management framework for Federal Information Systems
NIST issued in May 2015 a draft report: NISTIR 8062, Privacy Risk Management for Federal Information Systems
The report describes a privacy risk management framework for federal information systems. The framework provides the basis for establishing a common vocabulary to facilitate better understanding of - and communication about - privacy risks and the effective implementation of privacy principles in federal information systems.
Comments are expected by July 13, 2015 at 5:00pm.
|URL||See 8062 dated May 28: http://csrc.nist.gov/publications/PubsDrafts.html and http://www.nist.gov/itl/201506_privacy_framework.cfm|
ENISA 2015 Study: Privacy and Data Protection-by-Design - from Policy to Engineering
Report published in January 2015. Report aims to bridge the gap between the legal framework and the available technological implementation measures. It provides an inventory of the existing approaches and privacy design strategies, and the technical building blocks of various degree of maturity from research and development. Limitations and inherent constraints are presented with recommendations for their mitigation.
|May 2016||IEEE International Workshop on Privacy Engineering|| http://ieee-security.org/TC/SPW2015/IWPE|
|January 27-29 2016||9th International conference, Computer Privacy & Data Protection conference, Brussels|| http://www.cpdpconferences.org/|
|October 7-8 2015||3rd Annual Privacy Forum, Luxemburg|| http://privacyforum.eu/|
|August 31-September 1 2015||CCC Privacy-by-design workshop, Pittsburgh|| http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design|
|July 8-9 2015||
OASIS conference Ditton Manor UK (Building trust in a hyperconnected world)
|June 5th 2015||IPEN Workshop Leuven|| https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015|