From: Sara DePaul <sdepaul@SIIA.net>

Sent: Monday, October 21, 2019 4:14 PM

To: privacyframework <privacyframework@nist.gov>

Cc: Sharon Burk <sburk@SIIA.net>; Carl Schonander <cschonander@SIIA.net>

Subject: NIST Privacy Framework: Preliminary Draft Comments

On behalf of the Software & Information Industry Association (SIIA), I am filing the attached 

comments to the preliminary draft of the NIST Privacy Framework.

Kind regards,

Sara

SIIA

Sara DePaul

Senior Director, Technology Policy

SIIA - The Software & Information Industry Association

1090 Vermont Ave NW, Sixth Floor, Washington, DC 20005

202-789-4471 Office / 614-439-4392 Mobile / @saracdepaul Twitter

siia.net/policy
October 21, 2019 

Katie McFarland 

National Institute of Standards and Technology 

100 Bureau Drive, Stop 2000 

Gaithersburg, MD 20899 

privacyframework@nist.gov 

Re: Preliminary Draft of the Privacy Framework 

Dear Ms. McFarland: 

On behalf of the members of the Software & Information Industry Association (SIIA), 

thank you for the opportunity to provide comments on the preliminary draft of the Privacy 

Framework. We also thank the National Institute of Standards and Technology (NIST) for its 

leadership and expertise in working with diverse stakeholders to develop the Framework. SIIA 

strongly supports the preliminary draft of the Privacy Framework. 

SIIA is the principal trade association for the software and digital information industries 

worldwide. Our membership includes global industry leaders for the digital age, including 

software, data analytics, information service companies, and digital publishers. SIIA’s member 

companies reflect the broad and diverse landscape of software and digital content, including 

both B2B and B2C services, small specialized providers, and large multinational industry 

leaders. 

Our more than 800 members depend on data to serve nearly every segment of society, 

including business, education, government, healthcare, and consumers. These business models 

rely on the ability to collect and use data to achieve important public policy outcomes in public 

safety, extensions of credit, and “know your customer standards,” to name a few. As the 

guardians of the personal data that drive these outcomes, our Members are committed to 

ensuring strong privacy protections, both as a matter of compliance and as a fundamental 

business norm that is dependent on customer trust. 

SIIA strongly supports the preliminary draft of the Privacy Framework. We believe the 

final Framework will prove critically important to enterprise risk management. Like the NIST 

Cybersecurity Framework, the preliminary draft of the Privacy Framework is flexible, 

comprehensive, and focused on risks and outcomes. Moreover, its suite of standards, guidance, 

and best practices will help companies ensure they have the awareness and roadmap to bake 

privacy management into their overall enterprise. 

We are particularly pleased that the preliminary draft of the Privacy Framework 

promises to be adaptable to help companies execute and record compliance programs for 

diverse data privacy laws and regulations – a vital feature due to the evolving privacy regulatory 

landscape in the United States and globally. By avoiding catering to a specific privacy standard, 

the Framework ensures that companies will be able to use it to build and sustain compliance 

programs as new privacy laws implement. Similarly, as privacy laws overlap, and in some 

instances conflict, the Framework can help businesses manage the complexity of divergent 
 

 

 

 

 

  

compliance requirements. This is particularly important for SMEs, which privacy regulation 

disproportionately burdens. 

Thank you again for the opportunity to provide comments on the preliminary draft. At 

this time, we fully support the preliminary draft, and look forward to reviewing the Privacy 

Framework 1.0 when it is released later this year. If you have any questions, please contact me at 

(202) 725-1419 or sdepaul@siia.net. 

Respectfully submitted, 

Sara DePaul, Senior Director, Technology Policy 

Software & Information Industry Association 

2