The privacy principle for Service Organization Controls. Those dreaded words for years steered companies away from reporting on it due to the perceived herculean effort that was required in order to be compliant. In 2016, the American Institute of Certified Public Accountants revised the SOC 2 trust principles with the issuance of TSP 100, Trust Services Principles and Criteria. One of the most significant revisions in this update was a simplified set of criteria for the privacy principle.

Overall changes

The AICPA is constantly working on improvements for SOC reports and the guidance that goes with them. In 2015, the AICPA revised its SOC 2 guide, but privacy remained a 64-page effort of management criteria, illustrations, and additional considerations based on Generally Accepted Privacy Principles. Because this information seemed to repeat itself quite a bit; was difficult to understand, and had so many aspects that appeared to be needed for compliance, many companies avoided the privacy principle in SOC 2 as much as possible.

The AICPA revised the trust principles again recently with the biggest change coming to the privacy principle. Instead of 64 pages of guidance, the new TSP 100 simplified privacy to eight criteria with a total of 20 control objectives. Let’s take a closer look at where privacy stands now for SOC 2.

The new privacy criteria 

The eight criteria for privacy in TSP 100 are as follows:

• Notice and communications of commitments and system requirements: focuses on notice about (and any changes to) privacy practices and commitments as well as the system requirements to internal users to carry out responsibilities.
• Choice and consent: focuses on the choices related to collection, use, retention, disclosure, and disposal of personal information to data subjects (and any related consequences). Consent must be obtained from the data subjects (or authorized person) if required and is only obtained for the stated purpose. Basis for the determination of any implicit consent is documented.
• Collection: personal information must be collected in accordance with privacy commitments and system requirements. If explicit consent is required, that consent must be communicated as well as the consequences of failure to provide consent for the request of personal information.
• Use, retention and disposal: The use and retention of personal information is limited to the purposes identified for privacy commitments and system requirements. Disposal of personal information needs to be secure and consistent with commitments and system requirements
• Access: Data subjects (once identified and authenticated) are given the ability to review and access their stored personal information and, upon request, provided with physical or electronic copies of that information. If access is denied to a data subject, notice as well as the reason for denial is provided. Data subjects are allowed to provided corrected, updated, or appended information, and that information is to be communicated to appropriate parties. If such corrections are denied, notice as well as the reason for denial is provided. 
• Disclosure and Notification: Personal information of data subjects must have the consent of the data subject prior to disclosure of the information to third parties. The company creates and retains authorized disclosure records that are complete, accurate and timely. The company creates and retains unauthorized personal information disclosure records that are complete, accurate and timely (includes breaches). Vendors and third parties whose products or services are part of the system and have access to personal information must comply with company privacy commitments and system requirements. If said vendors or third parties have an actual or suspected unauthorized disclosure of personal information, they must notify appropriate personnel at the company and act on the event to meet established incident response procedures, privacy commitments, and system requirements. Notification of breaches and incidents must be reported to affected data subjects, regulators, and others as deemed necessary to know. A data subject can request, and the company must keep an accounting record of, personal information held and disclosure of that information.
• Quality: The personal information collected should be accurate, up-to-date, complete, and relevant. 
• Monitoring and Environment: There must be a process for receiving, addressing, resolving, and communicating the resolution of inquiries, complaints, and disputes from data subjects and others. Compliance with privacy commitments and system requirements should be periodically monitored. Corrections and other necessary actions related to identify deficiencies are taken in a timely manner.

The old Generally Accepted Privacy Principles (GAAP)

For service organizations that were reporting privacy under the old GAAP methods and guidance, the AICPA has provided a mapping from the old GAAP to the new trust principles in TSP 100.  For example, GAAP 1.2.10: Privacy Awareness and Training now is considered to be included in Common Control (CC) 2.3: The responsibilities of internal and external users and others whose roles affect system operation are communicated to those parties.

Section 3

Service organizations that are adding the privacy principle should consider adding privacy policies/commitments and system requirements to their SOC 2 Section 3 system description. Privacy aspects that should be considered to be added in: 

Subservice organizations: Similar to the other trust principles, service organizations that plan on reporting under the new TSP 100 for the privacy principle would have to give consideration to how their sub-service organizations help them meet the objectives of the privacy principle. If the subservice organization (third party) has access to, or is permitted to view the personal information, compliance with your own privacy policies/commitments and system requirements has to be considered, as well as, the privacy practices of the subservice organization.

Complimentary user-entity controls: Service organizations would also have to consider if more complimentary user-entity controls would have to be added to Section 3 of the SOC 2 report in relation to privacy. For example, if the service organization is providing services to a hospital, some complimentary user-entity controls could be that the hospital has privacy policies in place for notice, choice, and consent. Another could be proper disposal of personal information after the information has been used.

While adding privacy is still a large effort for SOC 2, the new TSP 100 has certainly made the process simpler and more streamlined. Companies who are subject to other compliance frameworks such as HIPPA or HITRUST will now find the SOC 2 privacy principle allows for single compliance /audit efforts with multiple-use results.