--

From: Blatt, Rebecca <RBlatt@cityops.nyc.gov>

Sent: Thursday, October 24, 2019 4:52 PM

To: privacyframework <privacyframework@nist.gov>

Subject: NIST Privacy Framework: Preliminary Draft Comments

Hello,

Please find enclosed NIST Privacy Framework: Preliminary Draft Comments from the City of New York.

Rebecca Blatt

Senior Counsel, Legislative Affairs and Special Projects

NYC Mayor’s Office of Operations

Desk: 212-748-0347|Mobile: 917-297-1127

Pronouns: she/her
 

 

 

October 24, 2019 

Katie MacFarland 

National Institute of Standards and Technology 

100 Bureau Drive, Stop 2000, 

Gaithersburg, MD 20899 

Re: NIST Privacy Framework 

Dear Ms. MacFarland: 

The Chief Privacy Officer for the City of New York, the Chief Technology Officer and the General 

Counsel to the Department of Information Technology and Telecommunications and Cyber Command, 

submit this comment in response to the request for information issued by the National Institute of 

Standards and Technology (''NIST") inviting public comment on the Preliminary Draft of the NIST 

Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management. The City of 

New York ("City") previously submitted a comment in April 2019 in response to NIST’s invitation for

public comment on the development of the Privacy Framework, and the City appreciates the opportunity 

to comment on this Preliminary Draft. 

The City supports the development of a Privacy Framework that guides organizations in their efforts to 

manage privacy risks arising from the collection, storage, use, and sharing of individuals’ information. In 

our previous comment, we encouraged NIST to develop a flexible, strong, and predictable framework, in 

harmony with other privacy and security requirements and guidance, to reduce the burdens on 

organizations and provide clarity to individuals. The City believes that the Privacy Framework structure, 

following a model similar to its Cybersecurity Framework, will enable productive consideration within 

organizations of managing privacy risk through the development of responsible policies and practices. 

The City appreciates that this framework draft is generally consistent with its privacy and information 

security policies and with NIST’s Cybersecurity Framework.

Another key component of the City’s initial comment was to ask that NIST engage meaningfully with 

stakeholders throughout this process. A feedback loop is critical to ensure that the privacy standards 

ultimately set forth are adaptable across a wide range of sectors and that input is solicited from 

government agencies with vested interests in advancing privacy protection initiatives and promulgating 

guidance and best practices. The City is pleased to see that NIST has thoughtfully considered input from 

the April comment. 

We encourage NIST to continue to develop the Privacy Framework to ensure it can be implemented as 

easily as possible by multiple stakeholders, for example, small business owners who have limited English 

proficiency, of whom there are a significant number in New York City. In addition, we urge NIST to add 

language reminding organizations that work performed pursuant to a government contract, whether 

federal, state, or local, may impose requirements related to privacy and data security that must be factored 

in to the organizations’ policies and practices.
 

___________________ 

__________________ 

The City looks forward to further opportunities to comment on this Framework Draft and engage with 

NIST in its work on advancing privacy protections, given the increasing risks to consumer privacy, both 

online and off. 

Laura Negrón 

Chief Privacy Officer 

City of New York 

NYC Mayor’s Office of Information Privacy

_________________ 

John Paul Farmer 

Chief Technology Officer 

NYC Mayor’s Office of the Chief Technology Officer

Michael Pastor 

General Counsel, NYC Department of Information Technology and Telecommunications 

and NYC Cyber Command