Module 2 - Privacy Governance

Question 1

What is Privacy Governance?

Answer 1

• It is foundational to a Privacy Program
• Privacy Governance is a component that guides the privacy function towards compliance and supports the organization’s broader goals.
• It consists of:
  a) Privacy vision/mission statement
  b) Scope/Charter of the privacy program
  c) Privacy framework
  d) Privacy strategy
  e) Structuring the privacy team.

Question 2

What’s the difference between mission and vision?

Answer 2

Mission = what we do, who we do it for, and how we do it different or better

Vision = Description of what we believe or want to achieve.

Question 3

What are the key components of a privacy strategy?

Answer 3

1. Business Alignment - how does privacy enhance the business goals? Budget
2. Data governance of personal information - applicable laws, data lifecycle,
3. Inquiry/compliant handling procedures - training individuals, use technology to efficiently respond

Question 4

Where should privacy program sit within an organization?

Answer 4

It depends.
Which department has the most influence?
Who has the budget?
Who is the strongest supporter of privacy?

Question 5

What’s the different between a Privacy Strategy and a Privacy Framework?

Answer 5

Privacy Program Strategy (PPS) is the “why?” - Why is privacy important to the organization.
Privacy Program Framework (PPF) is the “what?” - i.e. what form or structure will the privacy program take?

PPF - provides the implementation roadmap. Provides a benchmark to measure program. Includes policies and procedures. E.g. ISO 27001.

Question 6

What does the Privacy Program Framework include?

Answer 6

• Organizational policies
• Standards and guidelines
• Program activities

Question 7

What are the different types of PPF?

Answer 7

1. Principles and standards - e..g OECD data protection principles, AICPA General Accepted Privacy Principles (GAPP), ETSI 3GPP, ISO 27001
2. Laws, regulations and programs - PIPEDA, Australian Privacy Principles, GDPR, LGPD, HIPAA, BCR
3. Privacy program management solutions - NIST Privacy Engineering and Risk Management

Question 8

What is the privacy policy life cycle?

Answer 8

1. Draft
2. Get approval
3. Disseminate & socialize
4. Train
5. Review & Revise

Question 9

What are the different kinds of privacy governance model within an organization?

Answer 9

1. Centralized
2. Localized/decentralized
3. Hybrid

Question 10

What are the factors that determine what kind of privacy governance model a organization adapts?

Answer 10

1. Organizational Structure
2. Existing governance model
3. Privacy team’s position and authority
4. Program maturity
5. Senior leadership and stakeholder involvement
6. Internal partnerships