Collaborative Research: CT-M: Privacy, Compliance and Information Risk in Complex Organizational Processes

合作研究：CT-M：复杂组织流程中的隐私、合规性和信息风险

• 批准号: 0831124
• 负责人: Helen Nissenbaum
• 金额: $ 18.75万
• 依托单位: New York University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2008
• 资助国家: 美国
• 起止时间: 2008-09-01 至 2014-02-28
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0831124&HistoricalAwards=false
• 关键词: Collaborative; Research; CT; Privacy; Compliance

Modern organizations, such as businesses, non-profits, government agencies, and universities, collect and use personal information from a range of sources, shared with specific expectations about how it will be managed and used. Accordingly, they must find ways to comply with expectations, which may be complex and varied, as well as with relevant privacy laws and regulations, while they minimize operational risk and carry out core functions of the organization efficiently and effectively. Designing organizational processes to manage personal information is one of the greatest challenges facing organizations (see, e.g. a recent survey by Deloitte and the Ponemon Institute [TI07]), with far-reaching implications for every individual whose personal information is available to modern organizations, i.e. all of us.This project responds to these challenges by developing methods, algorithms and prototype tools for integrating privacy, compliance, and risk evaluation into complex organizational processes. It explores, articulates and characterizes formally the scope and nature of privacy-expectations of stakeholders as well as those of key regulations, such as HIPAA, GLBA, COPPA, BASEL 2, and Sarbanes-Oxley (SOX). It incorporates the diverse perspectives and areas of expertise of its multidisciplinary research team, which includes three computer scientists, one philosopher, and collaborating researchers from IBM. This industry connection facilitates interaction with product teams that have served complex organizations concerned with business process integrity, information security, privacy, and information risk management. The research builds on "contextual integrity" (a philosophical account of privacy) as well as language and risk-based methods for privacy policy specification and enforcement. Extensive training and educational opportunities are provided to undergraduate and graduate students and research results integrated into courses at CMU, NYU, Stanford, and UPenn.

现代组织，例如企业，非营利组织，政府机构和大学，从一系列来源收集和使用个人信息，并与有关如何管理和使用的特定期望共享。因此，他们必须找到遵守期望的方法，这些期望可能复杂而多样化，以及相关的隐私法律和法规，同时降低了运营风险并有效地，有效地执行组织的核心功能。设计组织流程以管理个人信息是组织面临的最大挑战之一（例如，Deloitte和Ponemon Institute [TI07]的最新调查），对每个人都可以使用的每个人都可以对我们所有人的个人信息，即对这些项目的挑战响应这些挑战，并将私人构建构建方法弥补这些挑战，并且对每个人的个人信息都提供了深远的影响。组织过程。它探索，表达和表达并正式地描述了利益相关者的隐私期望的范围和性质，以及HIPAA，GLBA，COPPA，BASEL 2和SARBANES-OXLEY（SOX）等关键法规的范围和性质。它结合了其多学科研究团队的各种观点和专业知识，其中包括三位计算机科学家，一名哲学家和IBM合作研究人员。这种行业连接促进了与已经为业务流程完整性，信息安全，隐私和信息风险管理的复杂组织提供服务的产品团队的互动。该研究基于“上下文完整性”（隐私的哲学说明）以及基于语言和风险的隐私政策规范和执法方法。为本科和研究生提供了广泛的培训和教育机会，并将研究成果集成到CMU，NYU，Stanford和Upenn的课程中。