Definition Privacy Controls are administrative, technical and physical safeguards employed within an organization or Domain in order to protect PI. They are the means by which privacy policies are satisfied in an operational setting. Specify Inherited Privacy Controls Objective Specify the required Privacy Controls which are inherited from Domains or Systems within Domains. Example: The utility inherits a Privacy Control associated with the Electric ID (EVID) from the vehicle Vehicle’s privacy policies. manufacturer’s The utility inherits the Operational Privacy Control Requirements, expressed as privacy consumer’s preferences, via a link with the customer communications portal when she plugs her EV into friend charging station. Rick’s The utility must apply privacy preferences to the current transaction. The Utility accesses Jane’s Jane’s privacy preferences and learns that Jane does not want her association with Rick exported to the third party partners. privacy settings differ around his PI, Utility’s Even though Rick’s Jane’s to the association being transmitted out of the privacy is sufficient to prevent Utility’s commutative association. Thus if Rick were to charge his batteries at the association car’s Jane’s, between them would also not be shared with third parties. Specify Internal Privacy Controls Objective Specify the Privacy Controls which are mandated by internal Domain olicies. Example Use Limitation Internal Privacy Controls The Utility complies with California Code SB 1476 of 2010 (Public Utilities Code §§ 8380-8381 Use Limitation). It implements the 2011 California Public Utility Commission (CPUC) privacy rules, recognizing the regulatory privacy jurisdiction over it and third parties with which it shares customer data. CPUC’s Further, it adopts NIST 800-53 Appendix on Use Limitation e.g. it evaluates any J’s “Control Family” – proposed new instances of sharing PII with third parties to assess whether they are authorized and whether additional or new public notice is required. Specify Exported Privacy Controls Specify the Privacy Controls which must be exported to other Domains or to Systems Objective within Domains. Example The Utility exports privacy preferences associated with her PI to its third party partner, whose Jane’s systems are capable of understanding and enforcing these preferences. One of her requirements is to not share her EVID with marketing aggregators or advertisers.
Definition Privacy Controls are administrative, technical and physical safeguards employed within an organization or Domain in order to protect PI. They are the means by which privacy policies are satisfied in an operational setting. Specify Inherited Privacy Controls Objective Specify the required Privacy Controls which are inherited from Domains or Systems within Domains. Example: The utility inherits a Privacy Control associated with the Electric Vehicle’s ID (EVID) from the vehicle manufacturer’s privacy policies. The utility inherits the consumer’s Operational Privacy Control Requirements, expressed as privacy preferences, via a link with the customer communications portal when she plugs her EV into friend Rick’s charging station. The utility must apply Jane’s privacy preferences to the current transaction. The Utility accesses Jane’s privacy preferences and learns that Jane does not want her association with Rick exported to the Utility’s third party partners. Even though Rick’s privacy settings differ around his PI, Jane’s to the association being transmitted out of the Utility’s privacy is sufficient to prevent commutative association. Thus if Rick were to charge his car’s batteries at Jane’s, the association between them would also not be shared with third parties. Specify Internal Privacy Controls Objective Specify the Privacy Controls which are mandated by internal Domain olicies. Example Use Limitation Internal Privacy Controls The Utility complies with California Code SB 1476 of 2010 (Public Utilities Code §§ 8380-8381 Use Limitation). It implements the 2011 California Public Utility Commission (CPUC) privacy rules, recognizing the CPUC’s regulatory privacy jurisdiction over it and third parties with which it shares customer data. Further, it adopts NIST 800-53 Appendix J’s “Control Family” on Use Limitation – e.g. it evaluates any proposed new instances of sharing PII with third parties to assess whether they are authorized and whether additional or new public notice is required. Specify Exported Privacy Controls Objective Specify the Privacy Controls which must be exported to other Domains or to Systems within Domains. Example The Utility exports Jane’s privacy preferences associated with her PI to its third party partner, whose systems are capable of understanding and enforcing these preferences. One of her requirements is to not share her EVID with marketing aggregators or advertisers.
PMRM-v1%200-cs02%20Committee%20Review%20Draft%20and%20Comments%20September%201st%202015.docx