From: Gleason, Angela <angela.gleason@apci.org>

Sent: Tuesday, November 5, 2019 1:36 PM

To: privacyframework <privacyframework@nist.gov>

Subject: APCIA Comments on Preliminary Draft

Please find attached comments from the American Property Casualty Insurance Association on the 

Preliminary Draft of the Framework. We apologize for the late delivery, but hope they can still be 

considered and are helpful.

Angela Gleason

American Property Casualty Insurance Association (APCIA)

555 12th Street, NW -- Suite 550

Washington, D.C. 20004

P: (202) 828-7181 | Fax: (202) 495-7868 | E-mail: angela.gleason@apci.org
October 24, 2019 

Katie MacFarland

National Institute of Standards and Technology

100 Bureau Drive, Stop 2000

Gaithersburg, MD 20899

VIA Electronic Mail: privacyframework@nist.gov

RE: Preliminary Draft of the NIST Privacy Framework

Dear Ms. MacFarland: 

The American Property Casualty Insurance Association (APCIA) appreciates the opportunity to respond to the 

National Institute of Standards and Technology’s (NIST) Request for Comments on the Preliminary Draft of 

the Privacy Framework (Preliminary Draft). Consumer privacy and data security are priority issues for the 

insurance industry and, as such, we strive to maintain the balance between protecting consumer privacy and 

trust while meeting consumer product expectations. We believe the Preliminary Draft identifies a wellbalanced approach consistent with U.S. privacy expectations and NIST’s mission to promote innovation and 

industrial competitiveness. 

Significantly, the voluntary nature of the Privacy Framework is essential. Frameworks, no matter how welldeveloped, rarely achieve a one-size-fits-all approach for all companies in all circumstances. The Privacy 

Framework is one option among others, to include: ISO 29000 and the Information Technology Industry 

Council’s Framework to Advance Interoperable Rules on Privacy. The voluntary nature allows companies a 

choice in utilizing a framework, or combination of frameworks, that best suit their individual needs. 

We also support the risk-based, outcome-based, and non-prescriptive approach, which allows companies to 

efficiently maximize human, financial and technical resources thereby meeting or exceeding consumer 

privacy expectations and fostering innovation. For instance, it is important to focus on the sensitivity of 

different types of personal information when evaluating actual risk and the controls to put in place. 

Associating the application of privacy principles in appropriately defined circumstances helps ensure that 

organizations are striking an appropriate balance between risk based due diligence and consumer protection. 

Further, the compatibility attribute of the Privacy Framework is critical. We believe the Framework should 

help enable compliance with existing privacy laws and regulations rather than imposing a new set of 

requirements. This harmonization/compatibility will serve to foster innovation and speed to market by 

reducing the time spent analyzing and applying multiple privacy regulations. To that end, we recommend for 

your consideration developing an appendix or other material that would test the Privacy Framework to two 

recent privacy regulations – The General Data Protection Regulation and the California Consumer Privacy 

Protection Act. This would be a very valuable tool since, at present, it unclear how the Privacy Framework 

would complement these new regulations. 

Finally, the Preliminary Draft may be enhanced to include a definition of digital privacy and identifying 

fundamental principles on which the Privacy Framework is built, such as: consent, transparency, portability, 

etc.) 
2

****

We thank NIST for its collaborative approach and welcome the opportunity to answer any question you may 

have or to be of further assistance 

Respectfully submitted,

Angela Gleason

Senior Director Cyber & Counsel