From: Boris Wojtan <BWojtan@gsma.com>

Sent: Thursday, October 24, 2019 10:52 PM

To: privacyframework <privacyframework@nist.gov>

Cc: Lefkovitz, Naomi B. (Fed) <naomi.lefkovitz@nist.gov>; Campbell Massie 

<cmassie@gsma.com>; Jade Nester <jnester@gsma.com>

Subject: GSMA comment on NIST Privacy Framework

Dear Katie MacFarland

I attach our submission comprising one general comment on the proposed NIST Privacy 

Framework.

If you have any questions please do not hesitate to contact us.

Best regards,

Boris

Boris Wojtan| Director of Privacy| GSMA | bwojtan@gsma.com | +44 7825 680780
Before the

DEPARTMENT OF COMMERCE

National Institute of Standards and Technology

Washington, D.C. 

NIST Privacy Framework: Preliminary Draft Comments of the GSM Association

The GSM Association (“GSMA”) welcomes the opportunity to comment on the draft Privacy 

Framework proposed by the National Institute of Standards and Technology (“NIST”). 

In order for the digital economy to continue to flourish, consumers need to be able to trust in 

innovative products and services that rely on the processing of personal data. 

Trust is promoted when organisations are transparent about what they do with personal data, 

adopt appropriate operational measures to identify, mitigate and avoid risk of harm to 

individuals, as well as hold themselves accountable.

The proposed NIST Privacy Framework offers a flexible and practical mechanism for 

organisations to integrate risk management practices. Depending on the type and amount of 

sensitive data companies handle, the Framework will help companies of all sizes provide

effective data privacy for individuals without disrupting their core business. Because the 

Framework is jurisdictionally agnostic, it will help organizations meet their jurisdictionalspecific compliance obligations and demonstrate how they comply in a transparent manner.

As such, it aligns very well with the concept of ‘Accountability’* increasingly incorporated 

into data privacy frameworks around the world, including in the EU’s General Data 

Protection Regulation and the Council of Europe Convention 108+.

It is important that policymakers including NIST continue to seek maximum interoperability 

between these mechanisms and frameworks.

Such mechanisms build confidence with consumers, enforcement authorities and 

policymakers around the world, encouraging a risk-based, flexible approach to data privacy 

that enables innovation through good data privacy practices. Seeking interoperability will 

also build trust between countries and facilitate exchanges of data across borders securely and 

consistently. All of these principles are in line with the GSMA’s approach as set out in its 

report ‘Smart Data Privacy Laws: Achieving the Right Outcomes for the Digital Age’.

* For further information on ‘Accountability’, please see GSMA’s Smart Data Privacy Laws 

- Achieving the Right Outcomes for the Digital Age, June 2019

https://www.gsma.com/publicpolicy/resources/smart-data-privacy-laws. The Centre for 

Information Policy Leadership (CIPL) also has numerous resources explaining the concept 

that can be found at https://www.informationpolicycentre.com/