Chief Privacy Officer Research Articles

Chief Privacy Officer: A Systematic Literature Review and Future Research Directions

As the digital landscape continues to evolve, the role of Chief Privacy Officers (CPOs) has emerged as an important component in improving organizations' information privacy management and practices. Hence, a synthesis of CPO extant studies is critical for both academics and practitioners to understand the CPO's tasks and responsibilities and how such a role leads to positive privacy-related organizational outcomes. This paper addresses a gap in the organizational information privacy literature by presenting a comprehensive and systematic literature review of the CPO role from 2000 to 2020. With the increasing recognition of CPOs' pivotal roles in enhancing information privacy practices across diverse sectors, this review aims to synthesize recent articles, identify research themes, pinpoint knowledge gaps, and propose avenues for future research. The study's contribution lies in providing a comprehensive literature review at the intersection of two main IS research streams: information privacy and IS leadership. We find limited research on information privacy that examines the CPO's role within relevant journals and conferences. The central theme that emerges from the literature is about identifying the CPO managerial roles, responsibilities, and background. We conclude by calling for more empirical research for a better understanding of the role and its impact.

Facial recognition technology: blasting the bias narrative out of the water?

In this article, Corsight AI chief privacy officer Tony Porter counters the accusations of bias still levelled at facial recognition technology. He argues that FR software now offers the level of accuracy and ethical focus required to justify its global use.

Amazon tackles bias and issues ‘warning cards’ about recognition products

In this article, Corsight AI chief privacy officer Tony Porter counters the accusations of bias still levelled at facial recognition technology. He argues that FR software now offers the level of accuracy and ethical focus required to justify its global use.

The Surprising Virtues of the New Financial Privacy Law

The financial privacy law passed by Congress in 1999 has been the target of scathing criticism. Financial institutions have complained about the high costs of the billions of notices sent to consumers, apparently to widespread consumer indifference. On the other side, privacy advocates have condemned the law as woefully weak. This article disagrees with the criticisms. Part I describes the main provisions of Title V of the Gramm-Leach-Bliley Act, showing a better match with basic privacy principles than many have realized. Part II explores the history of how GLB became law, placing the enactment into the context of a historic peak of privacy policy activity in the late 1990s. This history draws on my dual perspective, as an academic who has written extensively about financial and other privacy issues, and as the Clinton Administration's Chief Counselor for Privacy during the period. Part III looks at the most hotly contested issue in the privacy debate, the rules for sharing personal information with affiliated entities and third parties. GLB establishes a basic rule that information can flow freely within a financial institution and to its affiliates. Customer choice - an opt out ability to prevent sharing - applies for transfers to non-affiliated companies. The article argues that an to that principle of customer choice, the joint marketing exception should be repealed. It then explores the knotty issue of how to handle data sharing in today's vast financial conglomerates, suggesting possible statutory modifications. Part IV looks at the much-maligned notices that financial institutions have sent out in compliance with GLB. The critics have accurately complained about the legalistic and detailed language in the current notices. The critics have largely overlooked, however, important benefits from these notices. Publication of the notices and the new legal obligation to comply with them have forced financial institutions to engage in considerable self-scrutiny of their data handling practices. Many firms have hired a Chief Privacy Officer or made other institutional changes. The current notices, even in their imperfect form, have reduced the risk of egregious privacy practices. And improved notices, with a plain-language short form on top, would enhance accountability while also communicating far more clearly with ordinary customers. In short, there are surprising merits of the GLB privacy provisions. Considerably more was accomplished in the Act than observers would have predicted in the spring of 1999 or than critics have recognized to date. Important flaws do exist, but specific and achievable changes in the statute and implementing regulation can go far toward reducing the magnitude of those flaws.

A Cybermodel for Privacy by Design: Building privacy protection into consumer electronics

Does privacy protection matter in consumer electronics (CE)? What is privacy, how is it valued, and where does it sit in your organization today? Chances are, if you do not have a chief privacy officer or data-protection officer, your company is lacking in protecting critical data, let alone observing all the laws and statutory regulations dealing with privacy (e.g., audits, compliance, etc.). Managing privacy is crucial, especially considering the key mandated privacy requirements, such as those concerning personally identifiable information (PII), the Health Insurance Portability and Accountability Act (HIPAA), and the payment card industry (PCI). In addition, the privacy definitions and the policy and enforcement effectiveness are themselves varied and complex, and they change depending on where your data reside?i.e., the state, province, and country. For example, the European Union?s (EU?s) data-protection directive [1] is much stricter than the weak U.S. privacy laws. (Note that if you plan to market a global CE product, you should know about the Safe Harbor Framework.)

Are Designers Ready for Privacy by Design? Examining Perceptions of Privacy Among Information Systems Designers

How do information systems designers handle privacy when designing systems? How do they perceive and interpret privacy? Privacy by Design (PbD) is the idea that designers should apply technological measures that aim to address privacy concerns, applied to the very same technology that might create the privacy risk. PbD requires system designers to apply inherent solutions for privacy issues, so to facilitate privacy within the system. PbD, and more generally information systems design, depends on the designers rather than on regulators or managers. Hence, the objective of this research is to explore designers' perceptions, attitudes, and prior knowledge as to privacy issues. To this end, we interviewed 27 experienced software designers from different domains in industry, including telecommunication, healthcare, and software infrastructure. Data were qualitatively analyzed in light the Fair Information Privacy Principles (FIPPs). Our findings indicate that software designers frame privacy mainly as a matter of information security; some refer also to secrecy and internal permission systems in the organization; other principles, such as notice, consent, and rectification, were hardly found as part of the designers' perception of privacy. Many of the designers perceive privacy as a theoretical-abstract concept, rather than an applicable principle in designing information systems. Moreover, they demonstrate an ambivalent attitude towards the issue whether they are responsible for addressing privacy concerns. In many cases, privacy is framed as a legal issue, handled by the organization's legal department, or as a data security issue, handled by security experts. In addition, designers report adopting organizational values and practices, specifically in cases where ignoring privacy concerns may benefit the business. We identified two important forces that affect privacy-related practices within organizations: (1) organizational policy, and (2) organizational climate, namely the norms and culture within the organization. These two forces can be aligned, as was frequently evident in the healthcare domain, and can, at times, be inconsistent, as we found in other domains, such as telecommunication. In the latter cases, designers reported that they comply with what they felt they were expected to do, namely with the organizational climate, rather than with the formal policy. The findings of this research shed some light onto the current state of privacy handling in new technologies, as well as point to obstacles for applying PbD. This, in turn, directs future steps to be taken in order to improve the protection of personal information. We believe that changing the organizational privacy climate to better support privacy in information systems would go a long way to improve design decision-making in this context. To this end, management commitment is an obligatory requirement, accompanied with the following activities: educating designers to be more familiar with the law and more aware of privacy issues and possible solutions; offering intra-organizational sources about privacy; forming a dedicated role within the organization to support designers when addressing privacy issues, such as a Chief Privacy Officer; and establishing technical internal review procedures to supervise and ensure that the design solutions fully and satisfactorily address relevant privacy policy.

Patient-Consent Tools Are Available

Federal health officials have developed videos and other tools to gain patient consent for sharing medical information electronically. While state laws and regulations create a patchwork of different requirements for when patient consent is required to release information for treatment, federal officials are encouraging physicians to develop a “meaningful consent” process that includes education about how the information is shared, gives patients time to review the educational materials, and allows them to change or revoke their consent at any time. The effort deals specifically with information shared through health information exchange organizations and is available at www.healthit.gov/providers-professionals/patient-consent-electronic-health-information-exchange/econsent-toolkit. “As patients become more engaged in their health care, it's vitally important that they understand more about various aspects of their choices when it relates to sharing their health in the electronic health information exchange environment,” Joy Pritts, ONC's chief privacy officer in the Office of the National Coordinator for Health Information Technology, said in a statement.

Conning the IADC Newsletters:Protecting The Corporate Counsel Communications Shield: The Attorney-Client Privilege Is Alive and Well for Company Lawyers

This article originally appeared in April 2013 Business Litigation Committee newsletter. IN THE CURRENT electronic era, one of substantial challenges facing defense lawyers is protecting written communications involving corporate counsel. In many companies, corporate counsel are now often part of business management team, no longer only relegated to providing legal advice when asked to do so. Frequently, legal department attorneys are located with business unit and are actively engaged with company executives and product managers in both legal aspects of business and day-to-day business decisions. In fact, company titles for in-house lawyers sound like those of executives rather than lawyers, including Executive Vice-President, Chief Compliance Officer, Senior Vice-President, Chief Privacy Officer or Corporate Secretary. These positions bring our company lawyers directly into cross-hairs of business litigation involving company decisions ranging from intellectual property and contract disputes to product liability and environmental contamination matters. The various scenarios raise interesting factual questions for traditional protections afforded to clients in attorney-client relationship, particularly when it comes to assertion of attorney-client privilege or attorney work product protection. This sacrosanct principle is the oldest of privileges for confidential communications known to common law. (1) As all are aware, with certain exceptions, privilege protects against disclosure of confidential communications between attorney and client within context of seeking legal advice from a lawyer. The privilege necessarily encourages candid and open conversations between clients and their attorneys, allowing attorneys to more effectively represent their clients' interests by understanding inner-most workings of company operations, errors made in judgment, discussions surrounding correction of problems and liabilities that might flow from those decisions, and issues relating to damage control. These kinds of lawyer-related communications likely would be deemed relevant to any litigation concerning such issues and these communications are often accomplished electronically and become central to discovery disputes when placed on a privilege log. Discoverability of these written communications is challenged through motion practice with communications initially described generally along with names of those sending, receiving and copied. The object of defense is to keep these communications from being produced, even for review by trial judge or magistrate judge or discovery master. To do so, defense lawyers must have detailed substantive knowledge of communications, electronic history of communications, inter-relationship between those involved in communications, particularly lawyers, and motivations for communications. Since It]he burden of establishing existence of privilege is on person asserting it, (2) it will be necessary to prepare affidavits from those involved explaining factual basis for assertion of privilege, so that those making legal decision understand how and whether privilege or protection comes into play. For most part, since outside lawyers are invariably consulted for legal advice, they rarely will be asked to disclose information provided to them by clients, and since communication is almost always protected, we will not address outside counsel in this article. (3) The greater challenge comes when in house counsel are involved because those seeking communications argue that privilege is inapplicable or waived and cannot shield them from disclosure. To be sure, courts acknowledge that the need to apply [the attorney-client] privilege cautiously and narrowly is heightened in case of corporate staff counsel, lest mere participation of an attorney be used to seal off disclosure. …

The Roundup

The Roundup

Privacy: Front and Center

In the 10 years since IEEE Security & Privacy's initial launch, privacy has moved from being a side story occasionally covered in the newspaper to a central issue of our times. With the Internet, through the rise of online social networks, tracking technologies such as cookies and Web beacons, and the sharing of data with third parties, and the government's increasing use of surveillance mechanisms such as closed-circuit television, wiretapping, and location tracking, almost everyone experiences far less privacy than they did just a decade ago. But at the same time, governments and industry are taking much more of an interest in privacy protection than they did when IEEE Security & Privacy first appeared, particularly because consumers adopt personalized services in large numbers. In this roundtable, five privacy leaders discuss some recent concerns: Ann Cavoukian, Ontario's privacy commissioner, Alan Davidson, a recent head of Google's US public policy office, Ed Felten, who recently served a term as chief technologist at the US Federal Trade Commission, Marit Hansen, deputy privacy and information commissioner of Land Schleswig-Holstein, Germany, and Anna Slomovic, chief privacy officer at Equifax.

Protecting personal information using Generally Accepted Privacy Principles (GAPP) and Continuous Control Monitoring to enhance corporate governance

The first decade of the new millennium may well become known as the era of data breaches. In a recent speech given by the Federal Trade Commission's (FTC) Chief Privacy Officer, Marc Groman, he emphasised to the National Association of Secretaries of States to prepare well because ‘you will have a data breach’ (Washington, DC, 18th February, 2008). This article discusses the present privacy crisis and offers a solution to managing and reducing privacy risk through the use of the AICPA/CICA's Generally Accepted Privacy Principles (GAPP). When the court of public opinion or the FTC is grilling an organisation regarding a data breach, the best defence for the organisation is to provide evidence, such as adherence to GAPP criteria or an actual GAPP audit, that they were diligent and serious about data protection policies. Recently, the Chair of Her Majesty's Revenue & Customs in the UK resigned after 25 million Britons had their personal information compromised and the investigation revealed that a mere $102,000 spent on data redaction would have prevented the snafu (see references 1 and 2). Top management, including CEOs, CFOs, CISOs, and CPOs all need to be aware of privacy risk management issues and techniques to reduce privacy risk. Researchers need to help advance the development and measurement of privacy-enhancing techniques and the implementation of GAPP in order to help move organisations along the Privacy Maturity Model. This article is written by a member of the AICPA's Privacy Task Force and a Certified Information Privacy Professional.

The Sui Generis Privacy Agency: How the United States Institutionalized Privacy Oversight After 9-11

Privacy scholars have long noted that the United States, unlike many other countries, lacks an independent office for privacy protection. However, as part of the response to 9-11, the US Congress created several new privacy entities. These sui generis privacy offices were established to counterbalance the surveillance authority that resulted from the creation of the Department of Homeland Security and the consolidation of the intelligence agencies the federal government, as well as to advise the President on emerging privacy issues. This article looks at the Chief Privacy Officer of the Department of Homeland Security, the President's Civil Liberties and Privacy Oversight Board, and the Civil Liberties Protection Officer of the Office of the National Intelligence Director. The article explores the circumstances under which the agencies were established and their legislative mandates. It reviews their activities to date and concludes that, measured primarily against their statutory responsibilities, only the DHS Chief Privacy Officer has had any meaningful impact on the privacy practices of the federal government. The article makes specific recommendations for how each office might be more effective. In almost all instances, more transparency, regular reporting, frequent public consultation, and great independence are necessary. The article concludes that in the absence of effective oversight within federal agencies for the new powers created after September 11, the effective checks and balances are likely to be the courts and the Congress.

Fraud Management in the Credit Card Industry

On November 16, 2001, the Payment Cards Center of the Federal Reserve Bank of Philadelphia sponsored a workshop on fraud management in the credit card industry. Daniel Buttafogo and Larry Drexler of Juniper Bank led the discussion.2 Daniel Buttafogo, Director-Risk Management, is Juniper's fraud expert. He provided an overview of fraud in the card industry and discussed some of the challenges he faces as a risk manager. Larry Drexler is General Counsel and the Chief Privacy Officer at Juniper. Following Buttafogo's remarks, he led a more general discussion on how fraud protection and security can be placed in the context of the broader public policy debate on information privacy. This paper summarizes these two executives' presentations and is supplemented by additional research.

WE-D-230A-01: Panel: HIPAA Compliance and the Medical Physicist

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) made sweeping changes in the ways in which information regarding individuals' health care must be stored and transmitted electronically. Most AAPM members will have some familiarity with the resulting changes to policy and procedures implemented by health care providers and hospitals. The roll‐out of Rules developed by the Department of Health and Human Services (HHS) in response to the Act is now approaching completion. With the dust beginning to settle it is a good time to review what is and is not required under the HIPAA umbrella. The intent of the Act is laudable. It contains provisions to safeguard an individual's access to their own health care information and some degree of control over its use (“Privacy”), provisions mandating standardization of electronic information exchange for health information in order to streamline transmittal of information between health care entities (“Electronic Data Interchange”), and provisions requiring that covered entities take certain measures to safeguard individuals' information against unintended exposure (“Security”). Unfortunately, as is often the case with sweeping Federal regulation, there is a great deal of misinformation and confusion in the marketplace about the Rules and their implications. This arises partly because, while most of the requirements are clear, the detailed mechanisms for compliance must be developed and implemented locally. This is a situation quite analogous to radioactive materials licensing, with which we are all familiar. Often one is unsure of one's degree of compliance until one is actually inspected, a very uncomfortable place to be when there are both fines and bad publicity at stake. Uncertainty creates ample opportunity for unscrupulous consultants to prey on the anxiety of health care administrators by recommending excessive or misdirected “compliance” measures, thus compounding an already difficult transition. We have all seen this dynamic in action. Another unfortunate outcome of the poorly‐informed implementation of layers of unbending bureaucracy in the name of compliance is that sometimes restrictions are imposed locally on information flow which are ultimately against the best interest of the patient. For instance, an absolute local prohibition on releasing patient‐specific treatment planninginformation may be directly in conflict with a Medical Physicist's need to send problematic data to a vendor to obtain timely resolution of a software anomaly. The bulk of our attention in this session will be directed to clarifying the impact of the Rules on the practicing Medical Physicist. The question is not easily answered as the impact on a given Medical Physicist depends very much on the situation in which the Medical Physicist operates. We have in common that many of us act as de factoInformation System managers in our departments and as such have a certain degree of practical responsibility for monitoring access to patient‐specific information. The degree to which we are formally responsible for compliance may vary greatly, though, depending on the specifics of our contractual relationship to the hospital or other entity for which we are performing services. It is in the Medical Physicist's interest to be clear regarding both the responsibilities and the restrictions on practice that might be included in any agreements regarding HIPAA compliance that they might be asked to sign as a condition of employment. A good working knowledge of the basics of the Act and the Rules is a useful starting point. We are fortunate indeed to have four expert Panelists representing four different perspectives on these questions. They are respectively (in order of their presentations) a member of the American College of Radiology's legal office, the Chief Privacy Officer for a major vendor of Radiation Oncologyinformation management systems, the Local Security Coordinator for a mid‐sized Regional Hospital, and a Senior Analyst with the Department of Health and Human Service's Office of Civil Rights (responsible for enforcement of the Rules). The goals of this Panel are to: 1. Briefly review the scope, structure and timeline of the Act and subsequently developed Rules, and introduce some of the specific jargon of HIPAA. 2. Clarify to whom the Rules apply and the chain of responsibility for compliance. 3. Discuss the specific impact on Medical Physicists of HIPAA and the local implementation of compliance programs. 4. Dispel some common myths about the requirements imposed by HIPAA and, conversely, highlight compliance issues that may be less widely appreciated. 5. Suggest some proactive strategies that Medical Physicists can employ to prevent conflicts with local compliance policy.

From the Editor's desktop

When I recently sent a plea to the Bulletin Advisory Board for possible topics, the one they most enthusiastically endorsed was social informatics. The excellent attendance at social informatics sessions at the 2004 Annual Meeting in Providence also indicates widespread interest. But what is it? This plaintive cry came from a number of sources, so we are attempting to provide enlightenment. Dave Penniman of the University at Buffalo agreed to put this issue together. He solicited excellent papers that range from general discussions of the field to examples of what social informaticians study, how they do it and what it all means to those of us involved in systems design, change management and other fields where we have the power to inflict technology on the unwary, albeit with the best of intentions. Dave Penniman, Steve Sawyer and Alex Halavais tackle the field in general - the who, why and how of social informatics. Elisabeth Davenport looks at its application in the workplace, while Kristin Eschenfelder describes the findings of a case study that exemplifies the social aspects of the use of information and communications technologies. Specifically she and her colleagues explore why people continue to post DeCSS, a largely superceded program that broke the software-based protection system on commercial DVDs, on their websites. An emerging subspecialty of social informatics is community informatics, in which researchers and practitioners single out the “community” as its unit of analysis. In the next issue of the Bulletin, Ann Bishop and Chip Brace will conclude our two-issue look at social informatics with an in-depth look at community informatics. In other arrticles in this issue of the Bulletin, Andrew Dillon reports his impressions from the 6th IA Summit in Montreal, while our frequent contributor Lee Strickland – formerly the chief privacy officer for the CIA among other government posts and now a faculty member at University of Maryland College of Information Studies – contributes his perspective on the controversies surrounding the USA Patriot Act. While he focuses particularly on those authorizations that will expire at the end of 2005 unless they are renewed and on sections that affect libraries and other information providers, he also reviews key provisions that are not expiring and strategies that might provide better guarantees of protection against possible abuses of the act.

What is a Chief Privacy Officer? An Analysis Based on Mintzberg's Taxonomy of Managerial Roles

Given the growing concern over information privacy abuse, potential lawsuits, and threats of increased government privacy legislation, an increasing number of firms are resorting to Chief Privacy Officers (CPOs) as a means to cope with information privacy. However, little is yet known about the job responsibilities and roles of this emerging corporate position. This study examines the critical managerial roles of CPOs. Drawing from in-depth interviews at three large firms and from secondary sources of data, this study uses Mintzberg's framework for managerial work to develop a taxonomy of key managerial roles for the emerging position of Chief Privacy Officer. From our analysis, we conclude that Chief Privacy Officers function with role responsibilities in four main areas: informational (monitor, disseminator, spokesperson), interpersonal (figurehead, liaison), conflict management (disturbance handler, negotiator), and strategic management (entrepreneur). Our analysis also suggests that no single managerial role is most important. Rather, multiple roles are required of CPOs. To meet these multiple role requirements, effective CPOs must possess strong business, communications, and technical skills. Our results suggest that Chief Privacy Officers tend to operate at high levels of organizational hierarchies as evidenced by the importance of their externally related job roles of figurehead, liaison, and spokesperson.

The complex web of regulation in the US: the case of privacy

Privacy regulation involving the internet presently is a complex mix of Federal laws and laws of other countries, mixed with a tangle of self-regulation. With a long queue of bills pending in the Congress, and numerous State Attorneys General looking at adopting some form of privacy legislation, privacy is a hot-button issue among regulators. All of this policy interest, coupled with growing consumer concern over privacy – especially in the aftermath of September 11, 2001 – has led many firms to realise privacy no longer is a topic that can be ignored. In response, many companies have created a new senior level, corporate post to deal with privacy issues: the Chief Privacy Officer (CPO). In 2001, there were thought to be fewer than 100 people with the CPO title, or its equivalent. That number has grown dramatically and may now exceed 1000. The CPO title now exists in organisations across industries as diverse as health care, insurance, high tech, telecommunications, universities, hospitals, and others. Not only in the USA, but around the world, firms are creating this position to sort out the legal, ethiqcal and social issues with privacy. This paper looks at the role CPOs play in establishing both corporate privacy policy as well as public privacy policy. It also examines those industries that have embraced this approach to dealing with privacy concerns, and considers the implications of this new corporate position in the ongoing debate over privacy protections.

A Strategic Response to the Broad Spectrum of Internet Abuse

The primary responsibility of the Chief Privacy Officer (CPO) is to protect online consumer privacy by developing an organization's privacy policy and ensuring compliance with privacy laws and regulations. However, the explosive growth of Internet use for business has brought about an escalation of concerns including reduced consumer confidence in Internet-related business activities, risk of financial loss, and legal liability from sources categorized as external and internal to the organization. Does the new CPO position provide adequate consideration of the increasing risks? This article discusses the far-reaching types of misconduct and risks organizations face. the article concludes by proposing the strategic response of an expanded role for the CPO. in addition to overseeing Internet privacy issues, the newly defined role of Chief Privacy and Integrity Officer (CPIO) would encompass Internet integrity. This entails formulating or reformulating an expressed Internet use policy, undertaking ongoing training and other means to maintain awareness of issues, monitoring internal sources, implementing defenses against external sources, and securing adequate liability insurance. the effectiveness of this new role, in overseeing these responsibilities, would be determined by assessing current operations, implementing proactive measures to reduce potential misuse, and continuously keeping abreast of technological advances, legislative and regulatory initiatives, and new areas of vulnerability.