Foundational Principles

1. Privacy Risk Models and Frameworks

• Nissenbaum’s Contextual Integrity
• Calo’s Harmful Dimensions
• Legal Compliance
• FIPPs
• NIST/NICE framework
• FAIR (Factors Analysis in Information Risk)

1. Privacy by Design Foundational Principles

• Full Life Cycle Protection
• Embedded into Design
• Full Functionality
• Visibility and Transparency
• Proactive not Reactive
• Privacy by Default
• Respect for Users

1. Value Sensitive Design

• How Design Affects Users
• Strategies for Skillful Practice

1. The Data Life Cycle

• Collection
• Use
• Disclosure
• Retention
• Destruction

IT’s Role in Protecting Privacy

1. Fundamentals of privacy-related IT

• Organization privacy notice
• Organization internal privacy policies
• Organization security policies, including data classification policies and schema, data retention and data deletion
• Other commitments made by the organization (contracts, agreements)
• Common IT Frameworks (COBIT, ITIL, etc.)
• Data inventories, classification and records of processing
• Enterprise architecture and data flows, including cross-border transfers
• Data Protection and Privacy impact assessments (DPIA/PIAs)

1. Information Security

• Transactions which collect confidential data for use in later processing activities
• Breach/disclosure incident investigations and responses—security and privacy perspectives
• Security and privacy in the systems development life cycle (SDLC) process
• Privacy and security regulations with specific IT requirements

1. The privacy responsibilities of the IT professional

• Consultation on internal and external policies
• Consultation on contractual and regulatory requirements
• Understanding how IT supports information governance in an organization

Privacy Threats and Violations

1. During Data Collection

• Asking people to reveal personal information
• Surveillance

1. During Use

• Insecurity
• Identification
• Aggregation
• Secondary Use
• Exclusion

1. During Dissemination

• Disclosure
• Distortion
• Exposure
• Breach of Confidentiality
• Increased accessibility
• Blackmail
• Appropriation

1. Intrusion, Decisional Interference and Self Representation

• Behavioral advertising
• Cyberbullying
• Social engineering

1. Software Security

• Vulnerability management
• Intrusion reports
• Patches
• Upgrades
• Open-source vs Closed-source