The U.S. Federal Trade Commission recently voted unanimously in support of the submission of staff comments on the National Institute of Standards and Technology’s preliminary "Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management" draft.  In doing so, the FTC staff highlighted the importance of NIST’s work to create a new U.S. privacy framework designed to help management start a dialogue about how to better manage privacy risk across an organization. In compiling these comments, the FTC relied on previous enforcement actions to guide the commission’s views about legal privacy practices and which elements are necessary for a "reasonable" privacy program.

The FTC applauded NIST’s "flexible framework" approach, which tailors privacy programs to "the size and complexity of the organization," the "scope and nature of its data processing activities" and the "volume and sensitivity of the consumer data at stake." This approach enables organizations to adjust their privacy programs as their business environment and practice evolves.

With those principles in mind, the FTC proposed the following five changes to the NIST draft Privacy Framework: (1) Address privacy breaches at each step of the framework; (2) evaluate the sensitivity of data when managing risks; (3) include a more detailed discussion on accurately describing how an organization collects, uses or shares consumer data; (4) designate one or more individuals to be in charge of the organization’s privacy program; and (5) highlight the importance of conducting a comprehensive risk assessment as a first step before making decisions about implementing privacy controls. 

1) Privacy breaches should be considered at each step of the framework

In its current state, the draft framework describes five "core functions" as foundational privacy activities: Identify-P, Govern-P, Control-P, Communicate-P and Protect-P. The framework states organizations can use the first four core functions to manage privacy risks associated with data processing, while privacy risks arising from privacy breaches can be managed in Protect-P Core Function. However, the FTC argues that the draft framework should address privacy breaches, defined as unauthorized access to information and a subset of privacy risks, in every core function of the framework and not just in Protect-P. The FTC warns that the risk of privacy breaches is "one of the most significant privacy risks against which organizations need to safeguard" and warrants consideration at each step of the framework. Failure to address the risk of privacy breaches at any one stage, according to the FTC, "is likely to result in an organization’s failure to properly control for that risk."

2) Privacy risk management should account for the sensitivity of the consumer data that is being processed

Currently, the draft framework addresses privacy risks by using an outcome-based approach that weighs the potential problems individuals could experience from data processing. The FTC recommends expanding this approach to include an explicit consideration of the sensitivity of the data to help predict risk.

In support of this recommendation, the FTC cites its enforcement action against Lenovo where built-in, ad-injecting software accessed laptop users' internet browsing activity, login info, financial account information, health information and communications. The FTC alleged, among other things, that Lenovo’s privacy practices were unfair because Lenovo did not provide sufficient notice and consent mechanisms appropriate for processing such sensitive information. The FTC argues that if a company were deciding to include this software in its laptops without considering the sensitivity of data being processed and, instead, used the "outcomes-based approach" under the current draft framework, then the organization "may not accurately predict the privacy risks of collecting sensitive data."

Although the FTC acknowledges that the draft includes some discussion of this concept, the FTC encourages a more robust discussion on data sensitivity, suggesting specifically that data sensitivity should be discussed where the draft framework describes responding to privacy risk by "avoiding the risk."

3) Include how to accurately describe how an organization collects, uses or shares consumer data

The FTC recommends NIST offer a more detailed discussion of the analysis an organization should undertake as part of the framework’s Core Communicate-P Function. According to the FTC, failing to accurately describe the way an organization collects, uses or shares data is one of the most common privacy violations committed by organizations. Thus, the FTC suggests posing a series of questions to help shape the Communicate-P Core Functions, such as:

• "Given the context of the organization’s interaction with consumers, what would be their reasonable expectations regarding the organization’s data processing practices (including collection, use, sharing, and storage)?"
• "What are the organization’s public-facing representations regarding its data processing practices and are those representations prominent and understandable?" 
• "Are the organization’s actual data processing practices in alignment with individual expectations and public-facing representations?"

 To underline the importance of clear data-processing disclosures, the FTC references its historic $5 billion enforcement action against Facebook. In that case, the FTC alleged Facebook had "shared consumer data in a manner contrary to its promises to users" when Facebook shared data with app developers after promising consumers that their data would only be shared with "friends." Additionally, Facebook collected telephone numbers for two-factor authentication but used the phone numbers for the undisclosed purpose of advertising. The FTC cautions organizations can draw "significant legal risk" if they fail to uphold their privacy promises to consumers and if they "do not accurately communicate how consumer data is collected, used, or shared."

4) Designate one or more individual to be in charge of creating, implementing and maintaining the organization’s privacy program

Perhaps the most powerful comment for privacy professionals is the FTC’s recommendation that the framework clarify the Govern-P Core Function to explicitly include the designation of specific individuals to lead the organization’s privacy program. The current draft assigns responsibilities to a cross-functional team (of lawyers, engineers, management, etcetera) to implement an organization’s privacy policy, which the FTC notes can be an effective approach as long as someone is driving the work forward.

The FTC explains that in its enforcement experience, such teams are often not able to identify privacy gaps outside their areas of responsibility as easily as envisioned in NIST’s Hypothetical Use Case Profiles. Without someone in charge of leading the organization’s privacy program, the FTC warns "it is more likely that such gaps would fall through the cracks."

Above all, the FTC emphasized it regularly requires organizations under order for privacy violations to designate an employee to coordinate the organization’s privacy program, citing enforcement action against Uber Technologies, Vizio and Facebook.

5) Conduct a comprehensive risk assessment as a first step before making decisions about implementing privacy controls

The FTC recommends the framework clarify its discussion regarding "current" and "target" privacy profiles to show that it is necessary for organizations to perform a comprehensive risk assessment first before making decisions about implementing privacy controls. Specifically, the assessment should review "all aspects of the company’s operations that process consumer data, including inventorying all consumer data that is collected, stored or shared, and then assessing the privacy risks of that data processing."

The FTC argues that conducting this assessment upfront is necessary for organizations to make informed decisions about their privacy controls and risks. However, without doing this assessment before implementing privacy controls, the FTC cautions that an organization may end up focusing on "relatively small" privacy risks while overlooking the "significant vulnerabilities and privacy risks affecting large numbers of consumers."

Conclusion

Considering how recent failures to protect consumer data have resulted in heavy enforcement fines, more data controllers are looking to regulators for guidance. This makes the FTC’s comments on the NIST Privacy Framework draft a valuable resource for cybersecurity and privacy professionals alike. Considering the FTC’s recent enforcement activity, it is not surprising that the FTC is interested in assisting NIST with this privacy risk management objective. As we look toward the future of privacy, it is clear that there will be more focus on integrating privacy and security objectives to protect consumer data.

Photo by ipse dixit on Unsplash