There are two ways to go as I see it.
1. You can take everything privacy related and break it out into its own section and have sub-headings for Legal, compliance, security, content, and social.
2. You can add a privacy section to each of the above.

Personally I think that a single section to address privacy as a whole with sub-headings is the way to go. This consolidates all the privacy information into a single “bucket” and makes it easier to reference, understand and find.

Short break out of sub-headings and specific topics covered by each:

• Legal – I think this section addresses existing laws and regulations as well as legislation that would be considered both “in process” or “under consideration”
• Compliance – This section should address what constitutes compliance to any privacy standards put in place is, how it is tracked and what the consequences of failing to comply with privacy standards entails. Examples:
o Who approves the development and creation of the application or site?
o How frequently are access audits performed?
 What are the consequences of being found in “non-compliance”
o Who is responsible for the periodic review of the policies, procedures and processes currently in place?
• Security – Section should cover how access to applications where the potential for the exposure of privacy information exists at two levels:
o What are the criteria for implementation of applications or sites where the potential for the exposure (intended or unintended) of privacy information exists? Think of this as the application layer.
 Who approves the development and creation of the application or site?
 How the site or application configured (separate web application, separate site collection, etc…)?
 What plans, processes or procedures are in place in the event of a potential breach?
 What plans, processes, procedures or policies are in place to prevent a potential breach?
o Who manages those applications or sites that contain privacy information? The personnel layer so to speak.
 What steps are required to gain access?
 Who approves access requests?
 How are requests for access tracked?
• Content – what kind of privacy related information is allowed to be collected?
o Names and addresses
o Social Security numbers
o Pictures
o Home phone numbers
o Education
• Social – what kind of information can the general user population share about themselves
o Names and addresses
o Pictures
o Home phone numbers
o Education
o Personal activities(going on vacation or something similar).

Just a quick list I’ve had rattling around in my head as I think about how to put this into a session for a SharePoint Saturday or BPC in March. It could probably be better categorized with some more thought. As soon I finish up the writing project I have going on I’ll try and clean it up some more and add to it and will send it to you.

– Jay

Reply