Managing Privacy Risk

· To give access could reasonably be expected to threaten the life or security of another individual.

· The information was collected with respect to investigating a breach of an agreement or a contravention of a law.

· The information was generated in the course of a formal dispute resolution process.

As a general rule, this fair information practice acknowledges the right of individuals to be notified that personal information may be disclosed to third parties and to voluntarily choose (opt-in or opt-out) whether such information will be disclosed to a third party or used for a purpose that is other than that described in the notice, except as permitted by laws or regulations. A corresponding obligation is imposed on the organization to disclose personal information only to third parties who provide substantially equivalent protection to such personal information, and according to the specific notice and choice practices disclosed to the individual. Further transfers of the personal information by the third party should be permitted only if the transfer is also subject to practices affording an adequate level of protection.

Personal information may be disclosed without the individual's knowledge or consent to:

Various risks are associated with the failure to meet these objectives. For example, if appropriate security measures are not in place, unauthorized parties may be able to access and use, copy, disclose, alter, or destroy personal information. Significant harm could be done to individuals whose personal information is compromised, and the organization responsible for protecting that information could be held liable. Therefore, the more sensitive the information (for example, financial or medical data), the greater the potential harm and the need for increased security.

This fair information practice acknowledges that an organization should maintain accurate, complete, current, relevant, and reliable personal information for the purposes for which it is to be used. Personal information should be updated only when necessary to meet the identified purpose.

Various risks are associated with the failure to meet these objectives. For example, an individual might be harmed by the use or disclosure of inaccurate data. If an organization uses inaccurate or misleading personal information to make business decisions, customer relations may be jeopardized, resulting in lost profits and market share.

This fair information practice acknowledges that an organization should be responsible for the protection of personal information. In this respect, an organization should designate one or more individuals who are accountable for the organization's compliance with its stated privacy policies and for procedures to address privacy-related inquiries and disputes. Therefore, a privacy officer should be appointed to oversee privacy compliance and to implement policies and procedures that apply to all personal information under the organization’s control, including transfers to third parties.

Various risks are associated with the failure to meet these objectives. For example, in the absence of an effective accountability regime, personal information may be mismonitored, resulting in potential damage to the organization’s reputation and business relationships. In addition, if an individual cannot readily determine an organization's privacy policies, or procedures for raising privacy-related inquiries, trust and confidence will be undermined, resulting in the denial of consent to use personal information for business purposes. Furthermore, the inability to satisfactorily respond to inquiries and complaints could lead to potential loss of business and have a negative effect on the organization’s compliance with pertinent privacy laws, regulations, and guidelines.

This fair information practice also acknowledges the right of individuals to challenge an organization's compliance with stated privacy policies and procedures. An organization is obliged to provide the means by which an individual can exercise that right. This includes explaining the organization’s procedures and the various avenues of recourse available to the individual. Accordingly, it is important that the privacy officer develop easily accessible complaint procedures and inform complainants of avenues of recourse, including those of industry associations and regulatory bodies. To meet these responsibilities, the privacy officer (or a designated employee) would investigate all complaints received, taking care to record the date a complaint is received and the nature of the complaint, and acknowledge receipt of the complaint promptly. If necessary, the individual would be contacted to clarify the complaint.

Normally, the investigation would be assigned to a person with the skills necessary to conduct it fairly and impartially, and the investigator would be given access to all relevant records, employees, or others who handled the personal information or access request. The investigator would notify the individual of the outcome of the investigation, explaining any relevant steps taken. Any inaccurate personal information would be corrected and/or policies and procedures would be modified based on the outcome of the investigation.

Various risks are associated with the failure to meet these objectives. For example, individuals may make inquiries or lodge complaints on personal information matters such as delays in responding to a request, incomplete or inaccurate responses, improper collection or use, and improper disclosure or retention of that information. If an organization does not have an effective process for addressing such inquiries and complaints, individuals will not be able to assess how well their personal information is managed. This could destroy customer confidence, resulting in customer dissatisfaction and lost business.

Since 1997, the concept of online privacy has been hotly debated by a slew of consumer privacy advocacy groups that were awakened by new threats from the then-nascent Internet. In the few short years since then, as Internet use has exploded exponentially, the Web has become more familiar to consumers. Consumer advocacy groups are on the front lines battling companies that have violated consumer privacy or followed poor Internet privacy practices. Businesses with an online presence are under close scrutiny by many organizations, including watchdogs, regulators, and legislators, following how they collect and use their customers' personal information.

WebTrust for Online Privacy was developed by the AICPA and CICA to meet a very specific need for e-commerce businesses. As organizations address personal information about their customers or employees, they need to consider all of the privacy issues surrounding that information. Many organizations have turned to the accounting profession for privacy solutions. They are looking for help in developing good privacy practices throughout the organization and demonstrating to their customers that they manage personal information properly.

The business community is now asking for something broader in scope than just online privacy guidelines—they are looking for total, enterprise-wide privacy solutions. As the global economy evolves and information flows become borderless, organizations need solutions to help them manage those information flows effectively.

The goal is to have an integrated privacy program, instead of separate privacy policies and procedures for the Privacy Act of 1974, the GLBA or the HIPPA, and for online and offline. Clearly, it is in the public interest to have comprehensive privacy practices. It also is in the best interest of every organization that interacts with the public.

Most organizations recognize that good privacy practices are central to corporate governance and accountability. It is acknowledged, however, that some organizations will do the minimum required to protect personal information and still comply with the law. Some can be coaxed to "do the right thing" and protect the privacy of their customers. Many others will see how privacy can be used as a competitive advantage. Whatever the motivation, businesses are looking for guidance and assistance in managing privacy risk. Each of these scenarios includes the CPA/CA, a trusted business adviser who is skilled at examining management information systems and adept at identifying the controls needed to effectively manage risk.²

Many members of the accounting profession are actively helping businesses develop and implement sound privacy programs. Building on this expertise, the AICPA and the CICA jointly established an Enterprise-Wide Privacy Task Force comprising a cross section of the accounting profession, including industry, large multinational firms, and small CPA/CA firms, as well as members in academia and the legal profession. Its mission is to examine the role CPAs/CAs can play in advising organizations about privacy issues and risks, and to develop a privacy framework that will serve as a benchmark for good privacy practices.

The Privacy Task Force has since developed a Privacy Framework that can be used by all CPAs/CAs (both in industry and in public practice) to guide and assist the organizations they serve in implementing privacy programs using a standard set of privacy best practices. This framework incorporates concepts from all significant domestic and international privacy laws, regulations, and guidelines. It is the intellectual capital and body of knowledge around which all other privacy advisory and assurance services can be built.

Research shows that many CPAs/CAs possess the skills necessary to implement effective privacy programs in any organization—no matter how big or small. They understand business processes, how information flows within an organization, and how to design privacy programs. Through a wide range of advisory and assurance services, CPAs/CAs have an opportunity to help businesses navigate the patchwork of privacy laws, regulations, and guidelines and focus on the heart of the matter—building trust between customers and businesses and "doing the right thing" by following good privacy practices.

CPAs/CAs in public practice will be able to offer clients a full range of services, including privacy strategic and business planning, privacy gap and risk analysis, benchmarking, privacy policy design and implementation, performance measurement, and independent verification of privacy controls. CPAs/CAs in industry can enhance their value to their employers through performing internal assessments against something they can measure—the AICPA/CICA Privacy Framework.

Privacy, as defined by laws and regulations, is about individuals having control over the collection, use, disclosure, and retention of their personal information. Unlike privacy, there is no widely accepted definition of confidentiality but, in most cases, it is about keeping business information from being disclosed to unauthorized parties, and it is usually driven by agreements or contractual arrangements.

1. For example, consumers demand that Internet transactions be protected. Public key infrastructure (PKI) and digital certificates are important safeguards. PKI is the framework that protects the data, using specialized encryption software and associated policies and services. PKI uses numeric keys to enhance security. Digital certificates (a kind of identification card that authenticates their holder's ID) are used by certification authorities as a type of Internet passport.

2. A study by the NFIB Research Foundation, National Small Business Poll—Advice and Advisors, found that 74 percent of owners employing 20 or more people sought advice from their accountant and 83 percent took that advice.