The current privacy discourse is shaped around the question: “Is your organization compliant with privacy regulations such as the EU General Data Protection Regulation (GDPR), the US State of California Consumer 隐私 Act (CCPA) or the US Health Insurance Portability and Accountability Act (HIPAA)?”. 然而, addressing privacy as a compliance issue does not allow for the consideration of other pillars of privacy that are equally important (e.g.，私隐是一项人权，是一项伦理及social关注的议题，亦是一项政治议题). 从合规的角度, 包括这些额外的隐私支柱，使谈话超越了“行使隐私权”的范畴。, 更倾向于“保护隐私权”.“这种更全面的隐私保护方法承认这是可行的, 有用或有利可图并不等于可持续发展，强调的是责任而不是合规. 旨在反映“做隐私权”,“Align 隐私 by Align (PbA)是一种解决隐私多重支柱问题的新方法. PbA的支柱概述为 图1.

图1 - PbA的6根立柱

什么是PbA方法?

目前大部分的隐私景观, 例如CCPA和GDPR, 提出基于风险的方法，要求在风险需要时采取额外措施保护个人数据. 然而, 的道德, 在这些基于风险的方法中，隐私的政治和social层面往往不存在¹ because data privacy legislation is largely focused on how organizations process personal data rather than what organizations do to extend or shape conditions for that processing. PbA方法通过6个隐私支柱来解决这一差距:

1. 立法和监管隐私
2. 隐私事件管理
3. 澳门赌场官方下载伦理的隐私
4. 澳门赌场官方下载社交隐私
5. 澳门赌场官方下载政治隐私
6. 隐私通讯

PbA方法敦促各组织将法律/监管和事件管理支柱作为基线, 然后解决这些可自由支配的支柱在组织中的应用. PbA的六大支柱及其相关的私隐活动概述于 图2.

图2 - PbA的6个支柱及其关联的隐私活动

法例及规管私隐
This pillar consists of all the privacy activities an organization must undertake as directed by their own privacy legislative landscape (e.g.，消费者、隐私和网络安全立法).

事件管理隐私
当隐私事件发生时, 受影响的组织必须首先确定是否需要向监督当局报告该事件, 规管机构或持份者. 然后，该组织需要补救该事件(例如.g.，通过引入新的硬件、软件、流程或培训，以确保问题不会再次发生). 该组织可能还必须管理诉讼程序, 对事故进行经济处罚或加强监督或审计.

隐私道德
隐私伦理包括数据伦理、数字伦理和隐私权. 隐私伦理关注的是技术塑造政治的方式, social, 环境与道德存在. 隐私伦理是关于如何使用技术的问题, 新的或更新的技术可能会带来什么隐私风险, 以及这些新未来的到来对social意味着什么. 曼特莱罗的工作结合了人权, social和道德影响评估(HRSEIA)与隐私影响评估(PIA), 这是一个有用的起点吗.² 随着隐私伦理的出现，可能还不存在的伦理含义又增加了一个变量, 风险是无法预测的. 英国数据道德框架³ 以及奥米迪亚网络的道德操作系统⁴ 提供解决这一隐私风险的有用工具.

对social负责的隐私
组织的竞争力, 以及周围澳门赌场官方下载的福祉, 是相互依赖. 在这个支柱, 组织接触到多个利益相关者, 包括员工, 供应商, 消费者和周边澳门赌场官方下载, 了解他们对隐私的关注. 虽然隐私通常是利益相关者的期望，但它的重要性可以有很大的不同. 例如, 芬兰等国的纳税人, 挪威和瑞典对金融隐私的期望很小，因为他们的个人所得税记录可以在网上公开. The process of reaching out to stakeholders to determine what matters most to them is called a materiality assessment.⁵

政治隐私
政治隐私与国家监控等政治概念有关, 言论自由的, 游说, 投票和民主. 各组织投资数百万美元游说政府，以有利于制定隐私立法. 例如, 他们可能会游说降低隐私合规成本，或将数据保留更长时间或将来使用. VpnMentor recently analyzed all the 游说 reports that were submitted to the US House of Representatives between 2005 and 2018 by the 5 largest big tech organizations. It found that privacy was the most frequently used word in the 游说 submissions and was in the top-5 lobby interests of all 5 organizations (图3).⁶

图3—2005年至2018年的大型科技公司游说

来源:vpnMentor。”大科技游说团关心的问题.” 允许转载.

隐私通讯
Each pillar of privacy in the PbA approach is reported in a corporate communication form that is accessible to key stakeholders. 隐私政策是隐私的法律支柱, 透明度报告和隐私声明, the social pillar of privacy is reported in corporate social responsibility (CSR) reports and the political pillar is reported in various 游说 databases. 当这些沟通揭示了不一致时，就会出现基本的利益相关者信任和声誉问题.g., when an organization reports “contributing to privacy advocacy groups” in their CSR reports and then reports “游说 for weaker privacy for consumers” in its 游说 submissions). 当一个组织将这些隐私支柱对齐并证明这种对齐时, 它可以增加消费者的信任, 消费者忠诚度和收入.

“Organizations need to view privacy with a broader lens that extends beyond just privacy rights and recognizes 的道德, 隐私的social和政治支柱.”

调整的柱子

The PbA approach highlights the need for organizations to not only address these additional pillars of privacy but to also align them. 第一个对齐过程包括跨隐私支柱(i.e.，“to walk the talk”). Organizations that undertake collaborations with privacy advocacy groups (reflecting the social privacy pillar) should ensure that their 游说 submissions (reflecting the political privacy pillar) are aligned. 在澳门赌场官方下载social责任报告中, 思科, 例如, states that it is leading the development of the EU Cloud Code of Conduct (reflecting the social privacy pillar) while also 游说 for more comprehensive privacy laws that respect privacy as a fundamental human right.⁷ 因此，它的social隐私和政治隐私支柱是一致的. 这些支柱的不一致可能导致利益相关者信任的降低, 增加对隐私和负面声誉影响的关注.

The second alignment process consists of ensuring that the privacy activities in the pillars reflect stakeholder expectations toward privacy (in materiality assessments). 再一次, 以思科最近的重要性评估为例, 这表明“数据安全和隐私”对于利益相关者和组织来说是非常重要的.⁸ 以这种方式, its privacy pillars are aligned with stakeholder expectations and will likely result in appeasing its privacy concerns.

结论

Organizations need to view privacy with a broader lens that extends beyond just privacy rights and recognizes 的道德, 隐私的social和政治支柱. 组织还需要确定更广泛的利益相关者澳门赌场官方下载的隐私期望. The PbA framework enables organizations to more holistically address privacy and advocate for the alignment of the pillars to engender increased consumer trust, 减少了对隐私的关注，提高了声誉.

尾注

¹ Mantelero,.; “AI and Big Data: A Blueprint for a Human Rights, Social and Ethical Impact Assessment,” 计算机法律 & 安全审查,卷. 34岁的空间站. 4, 2018
² 同前.
³ 英国政府数字服务， 数据伦理框架2018年6月13日，英国
⁴ Omidyar网络, “如何不为你所创造的东西感到后悔”
⁵ 全球报告倡议(GRI)，”重要性和主题边界”
⁶ vpnMentor。”大科技游说团关心的问题”
⁷ 仓库保管员,K.; “思科呼吁将隐私视为一项基本人权，” 思科，2019年2月7日
⁸ 思科, “物质评估”

瓦莱丽·里昂，CDPSE, CISSP

是BH咨询公司的首席运营官吗, 这是一家总部位于都柏林的国际网络安全和隐私咨询机构, 爱尔兰. 她也是都柏林城市大学商学院(爱尔兰都柏林)的讲师。. 此前，她曾在爱尔兰KBC银行(KBC Bank)担任信息和风险管理主管长达15年. 里昂经常在隐私问题上发表演讲, and her key motivation is to change the industry’s approach to privacy so that privacy is the baseline rather than the goal and to bring an understanding of privacy that extends beyond legislative dimensions.