From: Christian Dawson <dawson@i2coalition.com>

Sent: Friday, October 18, 2019 12:22 PM

To: privacyframework <privacyframework@nist.gov>

Subject: i2Coalition RFC response on NIST PRIVACY FRAMEWORK

See attached.

Christian Dawson

Executive Director

i2Coalition

c: 703 623 2612
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Request for Comment on NIST PRIVACY FRAMEWORK

The Internet Infrastructure Coalition (“i2Coalition”) submits these comments in response to the

September 6, 2019 notice requesting public comment on “NIST Privacy Framework: A Tool For

Improving Privacy Through Enterprise Risk Management”.

Our comments are divided into sections: i2Coalition Background, Overview, Promoting an

Effective and Realistic Approach to Privacy, and Conclusion.

i2Coalition Background

The i2Coalition provides a global voice for the people and companies building the nuts and bolts

of the Internet. We believe the continued growth of the Internet is vital for growing an

environment of innovation and seek to foster success of the Internet and Internet infrastructure

industry.

The i2Coalition supports copyright policies that preserve the remarkable opportunities offered by

a free and open Internet, while balancing the rights of rights holders of all types.

The i2Coalition represents a large swath of Internet infrastructure companies and related

technology firms. Our membership is a collection of hundreds of companies that generated the

infrastructure on which the digital economy sits. In 2016 the U.S. exported over $185 billion in

digitally-enabled services to Europe and imported $111 billion from Europe, generating a trade

surplus with Europe in this area of at least $74 billion1

. U.S. exports of digitally-enabled services

to Europe were more than double U.S. exports to Latin America and almost double U.S. exports

to the entire Asia-Pacific region. As an organization, we believe that the full innovative potential

of the Internet can only be harnessed if its inherent openness is preserved and made available

to all, not just the giants of the industry.

1 Page 25 of the AmCham "EU THE TRANSATLANTIC ECONOMY 2018 - Annual Survey of

Jobs, Trade and Investment between the United States and Europe"

(http://www.amchameu.eu/sites/default/files/publications/files/transatlantic_economy_report_20

18.pdf)
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Overview

The i2Coalition is proud to have been an active contributor to the process that brought about the

NIST Cybersecurity Framework (CSF)2

. The NIST Cybersecurity Framework was a success

because it was a collaboration with industry, technology-neutral, and voluntary. The proposed

NIST Privacy Framework is a welcome addition to that strong work. It effectively balances

privacy and cybersecurity risk while maintaining flexibility and viable implementation for service

providers to implement.

Promoting an Effective and Realistic Approach to Privacy

The framework as presented does an effective job of acknowledging that there are many valid

methods of achieving privacy, and offers organizations the option of choosing different types of

protection outcomes, to suit their business environments and allow them to meet the privacy

needs of individuals who use their services.

Like the CSF before it, the NIST Privacy Framework has benefitted from the multi-stakeholder

model which considers policy outcomes as well as technical and organizational realities.

Both documents help organizations assess their own risks and achieve their particular goals. In

short, the framework does a good job of not being a simple one-size-fits-all checklist of action

items.

Why is this important? Because it is vital for tech solutions to scale down, and be accessible to

small businesses.

Purveyors of Internet services are mostly small or medium sized businesses, and yet all too

often when legislators are seeking to find their own solutions to problems they do so with only a

few large organizations in mind.

That isn’t the way an approach to privacy can reasonably be built. One company might have

more risks, for example, and might need to have a chief privacy officer, while another might not.

Each company has its own potentially unique situation when it comes to privacy. The NIST

Privacy Framework acknowledges this.

2 Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1, National Institute of

Standards and Technology, April 16, 2018,

https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
 

 

 

 

 

 

 

 

Conclusion

i2Coalition is proud to endorse the NIST Privacy Framework, and believe that it is poised to be

an effective partner to the already beneficial NIST Cybersecurity Framework. Governments

should look to the way that NIST has operated the creation of both frameworks as a way to

collaborate with industry on solving complex problems at a number of different scales.

Privacy risk management practices are really in their infancy, and we expect that the NIST

Privacy Framework will continue to adapt and change, as the CSF has. i2Coalition looks

forward to an ongoing dialogue that can help the NIST Privacy Framework continue to mature

and improve.