Supplemental Material for NIST Privacy Framework Workshop #3 6/26/2019

1

1 Proposed NIST Privacy Framework Roadmap Topic 

2 Areas

3 Note to Reviewers

4 This document is provided for discussion purposes to promote the development of a companion 

5 roadmap to the NIST Privacy Framework: An Enterprise Risk Management Tool (Privacy Framework or 

6 Framework). NIST is particularly interested in whether: (i) the proposed topic areas are appropriate for 

7 the roadmap; (ii) there are additional areas that should be included; and (iii) the proposed topics 

8 appropriately capture priority challenges and gap areas for organizations and key action items to 

9 address them. Please send feedback on this document to privacyframework@nist.gov. 

10 Proposed Roadmap Topic Areas

11 A companion Roadmap to the Privacy Framework will describe plans for advancing the Framework 

12 development process, discuss NIST’s next steps with the Framework, and identify key areas of 

13 development, alignment, and collaboration. It will provide a description of anticipated future activities 

14 related to the Framework and offer stakeholders another opportunity to participate actively in the 

15 continuing Framework development process. 

16

17 NIST proposes the following priority areas for inclusion in the Roadmap as they pose challenges to 

18 organizations in achieving their privacy objectives. While this list is not intended to be exhaustive, these 

19 are important topics identified by stakeholders that should inform future versions of the Privacy 

20 Framework. These areas require continued focus as they are important but evolving areas that have yet 

21 to be developed or need further research and understanding. While guidance, standards, practices, and 

22 tools exist for some of the areas, they need to become more mature, available, and widely 

23 adopted. NIST will work with stakeholders to identify primary challenges, solicit input to address those 

24 identified needs, and collaboratively develop and execute action plans for addressing challenges. 

25

26 Mechanisms to Provide Confidence: Mechanisms to provide confidence (e.g., conformity assessment 

27 activities, assessments, or audits) can be used to enhance an organization’s understanding of its 

28 implementation of the Privacy Framework. Effective mechanisms of this type are efficient, transparent, 

29 and accessible to organizations regardless of size and resources, drive improvement, and have a 

30 sustainable and scalable business case. The lack of mechanisms to provide confidence is a challenge for 

31 determining whether organizations are providing effective privacy protections and making good use of 

32 limited resources.

33

34 Areas of need include research into the organizational challenges and needs with respect to the 

35 development of confidence mechanisms, for example, conformity assessment activities, assessment 

36 procedures, and externally shared results.

37

38 Emerging Technologies: Emerging technologies (e.g., internet of things [IoT], artificial intelligence [AI]) 

39 have amplified the complexity of the data processing ecosystem; for example, in IoT, decentralized data 

40 processing can involve various third parties that are not contractually bound to any other party, 

41 challenging traditional accountability mechanisms. Emerging technologies and the complex data 

42 processing ecosystem can add complexity to:
Supplemental Material for NIST Privacy Framework Workshop #3 6/26/2019

2

43 o redress processes,

44 o individuals’ understanding of how their data is processed and how to engage in its processing,

45 o maintenance of data lineage and provenance, and

46 o ethical treatment of individuals (e.g., developing AI systems that do not produce biased results, 

47 can be explainable, or allow for human intervention capabilities).

48

49 Areas of need include research and development to underpin guidance, standards, practices, and 

50 related tools for managing privacy risks arising from the use of emerging technologies.

51

52 Privacy Risk Assessment: While various privacy risk models have been developed and introduced, 

53 organizations continue to face challenges in conducting effective privacy risk assessments.

54

55 Areas of need include:

56 • Uniform concepts of privacy risk factors; and

57 • More in-depth guidance for assessing privacy risks, including how assessment fits into a risk

58 management approach, and processes for assessing impact to individuals and reflecting that 

59 impact within the organization.

60

61 Privacy Workforce: Further development of a knowledgeable and skilled privacy workforce (to include 

62 privacy practitioners and other personnel whose duties require an understanding of privacy 

63 implications) is necessary to support organizations in better protecting individuals’ privacy while 

64 optimizing beneficial uses of data.

65

66 Areas of need include:

67 • A common lexicon to categorize and describe a privacy workforce, including identification of 

68 privacy work roles, the discrete tasks performed by staff within those roles, and the knowledge, 

69 skills, and abilities needed to complete the tasks successfully;

70 • Guidance, standards, practices, and tools to advance the development of a knowledgeable and 

71 skilled privacy workforce; and

72 • Collaboration with organizations that specialize in developing workforce training.

73

74 Re-identification Risk: While guidance, standards, practices, and tools are beginning to be developed for 

75 de-identification, this area needs to be developed further to promote understanding of how to manage 

76 residual re-identification risks.

77

78 Areas of need include:

79 • Increased awareness of re-identification to facilitate identification of these risks (e.g., risks 

80 arising from the combination of datasets that were not intended to be combined, magnification 

81 of challenge with emerging technologies); and

82 • More guidance, standards, practices, and tools for managing re-identification risks.

83

84 Technical Standards: While there are emerging privacy standards in a variety of standards development 

85 organizations, to date many of these have been management system standards (focused on processes); 

86 there are fewer technical and testing methodology standards in privacy.

87
Supplemental Material for NIST Privacy Framework Workshop #3 6/26/2019

3

88 Areas of need include:

89 • Development of standards or adoption of standardized formats for metadata, privacy-enhancing 

90 cryptographic techniques, confidence mechanisms, and management of re-identification risk;

91 • Additional technical and assessment standards.