Supplemental Material for NIST Privacy Framework Workshop #3 6/26/2019

1

1 Draft NIST Privacy Framework Executive Summary

2 Note to Reviewers

3 This document is provided for discussion purposes to promote the development of the NIST Privacy 

4 Framework: An Enterprise Risk Management Tool (Privacy Framework). In response to stakeholder 

5 feedback received on the Privacy Framework Discussion Draft, released April 30, 2019, NIST has 

6 prepared this document to summarize key aspects of the scope and purpose of the Privacy Framework 

7 that generated significant dialogue. These themes included privacy risk to individuals and the

8 relationship to organizational risk, privacy risk assessment terminology, the relationship of privacy risk

9 and cybersecurity risk, and organizational roles. This executive summary is more robust than a 

10 traditional executive summary by design, to serve as a tool to foster discussion and help NIST 

11 understand whether this content better addresses the areas of concern.

12 NIST is particularly interested in: (i) whether this document fosters a clear understanding of the purpose, 

13 value, and scope of the Privacy Framework and (ii) any further gaps or areas for clarification. Please send 

14 feedback on this document to privacyframework@nist.gov. NIST will use the feedback to inform the 

15 development of a preliminary draft of the Privacy Framework.

16 Draft NIST Privacy Framework Executive Summary

17 For more than two decades, the Internet and associated information technologies have driven 

18 unprecedented innovation, economic value, and improvement in social services. Many of these benefits 

19 are fueled by data about individuals that flow through a complex ecosystem—so complex that 

20 individuals may not be able to understand or attend to the potential consequences for privacy resulting 

21 from their interactions with systems, products, and services. At the same time, organizations may not 

22 realize the full extent of these consequences for individuals, for society, or for their enterprises, which 

23 can affect their reputations, their bottom line, and their future prospects for growth.

24 Approaches to privacy have been challenging because privacy is an all-encompassing concept. It is a 

25 condition or state that safeguards important values such as human autonomy and dignity, yet the 

26 means for achieving it vary. This broad and shifting nature of privacy makes it difficult to communicate 

27 clearly about privacy risks within and between organizations and with individuals. 

28 As part of its mission to further technological innovation and increase trust in information systems, the 

29 National Institute of Standards and Technology (NIST), working in collaboration with private and public 

30 stakeholders, has developed the voluntary NIST Privacy Framework: An Enterprise Risk Management 

31 Tool (Privacy Framework). The Privacy Framework provides a shared lexicon and is a practical tool that 

32 can assist organizations—even those fully compliant with relevant laws or regulations—in making ethical 

33 decisions when designing or deploying their products and services and avoiding losses of trust that 

34 damage their reputations and can slow adoption or cause abandonment of these products and services.

35 It does this by helping organizations consider:

36 • How their systems, products, and services affect individuals; and 

37 • How to integrate practices into their risk management processes that optimize beneficial uses of 

38 data while minimizing adverse effects on individuals’ privacy.
Supplemental Material for NIST Privacy Framework Workshop #3 6/26/2019

2

39 Deriving benefits from data while simultaneously managing risks to individuals’ privacy is not well-suited 

40 to one size-fits-all solutions. The Privacy Framework—through a risk- and outcome-based approach—is 

41 flexible enough to address diverse privacy needs and stay current with broader technology trends,

42 including artificial intelligence and the Internet of Things. 

43 The approach of the Privacy Framework is to consider potential problems individuals could experience

44 arising from system, product, or service operations with data, whether in digital or non-digital form,

45 through a complete life cycle, or in other words: from data collection through disposal. The Privacy 

46 Framework describes these data operations in the singular as a data action and collectively as data 

47 processing. The problems individuals can experience as a result of data processing can be expressed in 

48 various ways, but NIST describes them as ranging from dignity-type losses such as embarrassment, 

49 stigmas, or discrimination to more tangible harms such as economic loss or physical harm. These 

50 problems can arise from cybersecurity incidents where there is a loss of confidentiality, integrity, or 

51 availability at some point in the data processing, including the unauthorized access or use of data by 

52 employees who exceed their authorized privileges. However, problems also can arise from data 

53 processing that is intentional or “authorized” (whether under law or explicit or implicit organizational 

54 policy) that organizations conduct to meet their mission or business objectives. 

55 Once an organization can identify the likelihood of any given problem arising from the data processing, 

56 which the Privacy Framework refers to as a problematic data action, it can assess the impact should the 

57 problematic data action occur. This impact assessment is the intersection between privacy risk and

58 organizational risk. Individuals experience the direct impact of problems, but an organization may 

59 experience “secondary” impacts, such as noncompliance costs, customer abandonment of products and 

60 services, or harm to its external brand reputation or internal culture. These organizational impacts can 

61 be drivers for informed decision-making about resource allocation to strengthen privacy programs and 

62 to help organizations bring privacy risk into parity with other risks they are managing at the enterprise 

63 level. 

64 Given the overlap with data security, the Privacy Framework can be used in conjunction with the 

65 Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework) to manage the 

66 data security aspect of privacy risk. [Alternate sentence for the Core Version A: Given the overlap with 

67 data security, the Privacy Framework integrates and adapts Core Functions, Categories and 

68 Subcategories from the Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity 

69 Framework) to support coordinated management of the data security aspect of privacy risk.] To further 

70 facilitate alignment, the Privacy Framework follows the structure of the Cybersecurity Framework and is 

71 composed of three parts: the Core, the Profiles, and the Implementation Tiers. Each component 

72 reinforces privacy risk management through the connection between business and mission drivers and 

73 privacy protection activities. 

74 • The Core enables an organization—from the executive level to the implementation/operations 

75 level—to have a dialogue about and prioritize privacy protection activities and desired 

76 outcomes. An organization may not need to achieve every outcome or activity reflected in the 

77 Core. 

78 • An organization uses the process of developing Profiles to prioritize the selection of the 

79 outcomes and activities that best meet its specific needs, taking into consideration its 

80 organizational or industry sector goals, legal or regulatory requirements and industry best 

81 practices, risk management priorities, and the privacy needs of individuals who are directly or 

82 indirectly served or affected by the organization’s systems, products, or services. 
Supplemental Material for NIST Privacy Framework Workshop #3 6/26/2019

3

83 • The Implementation Tiers are meant to support organizational decision-making and 

84 communication about how to manage privacy risk by taking into account the nature of the 

85 privacy risks engendered by the organization’s systems, products, or services and the adequacy 

86 of the processes and resources the organization has in place to manage such risks.

87 The Privacy Framework is intended to be widely usable by organizations of all sizes and agnostic to any 

88 particular technology, sector, law, or jurisdiction. Different parts of an organization’s workforce, 

89 including executives, legal, and IT may take responsibility for different outcomes and activities. Ideally, 

90 the Privacy Framework encourages cross-organization collaboration to develop Profiles and achieve 

91 outcomes. The Privacy Framework also is intended to be usable by any organization or entity regardless 

92 of its role in the data processing ecosystem—which comprises the complex and interconnected 

93 relationships among entities involved in creating or deploying systems, products, or services or any 

94 components that process data. Some laws or industry sectors classify organizational roles—to allow for 

95 broad use, the Privacy Framework does not—but an organization should review the outcomes and 

96 activities in the Privacy Framework from its standpoint in the ecosystem and consider how to manage 

97 privacy risk not only with regard to its internal priorities, but also in relation to how they affect other 

98 parties’ management of privacy risk. 

99 While privacy is often discussed in compliance terms, the Privacy Framework highlights that regulatory 

100 compliance is only one piece of the puzzle, and often should be viewed as the floor instead of the 

101 ceiling. A risk-based approach to privacy allows the flexibility for more innovative and effective solutions 

102 that can lead to better outcomes for individuals and enterprises. Much work remains: privacy risk 

103 management is still a nascent discipline in contrast to cybersecurity risk management. The Privacy 

104 Framework is a foundation, but NIST, in collaboration with stakeholders, intends to build a repository of 

105 informative references of additional guidance and shared best practices to help organizations achieve 

106 the Privacy Framework outcomes and activities and build trust in their systems, products, and services 

107 through the protection of individuals’ privacy.