Below is a sample of standards and standards activities that might be of interest to the privacy community.
Recommended Practice for Privacy Considerations for IEEE 802 Technologies
This recommended practice specifies a privacy threat model for IEEE 802 technologies. It provides recommendations on how to protect against privacy threats and promotes a consistent approach to threat mitigation by IEEE 802 protocol developers.
Standard for Privacy and Security Framework for Consumer Wireless Devices
This standard defines a privacy scale that shall be applied to data that is defined as personal identifiable information that is being collected, retained, processed or shared by or among applications implemented on networked edge, fog, or cloud computing devices. This privacy scale data provides input to assessment tools that developers or users of these applications use to develop, discover, recognize, or implement appropriate privacy settings for types or levels of personal data resident on these devices.
Standard for Human Augmentation: Privacy and Security
This standard specifies requirements, systems, methods, testing and verification for human augmentation to preserve the privacy and security of both consumers and non-consumers of human augmentation. Human augmentation, also known as human enhancement, is used to refer to technologies that add to the human body and enhance human productivity or capability. Recent advancements in many technical areas have led to a large variety of implants, wearables and other technologies that could be classed as human augmentation.
Standard for Biometric Privacy
Recommended Practice for Inclusion, Dignity and Privacy in Online Gaming
This standard defines a set of recommended practices for inclusion, dignity and privacy in online gaming. It includes a descriptive taxonomy to ensure clear and concise communication between stakeholders, and a set of best practices designed to help game developers build more inclusive online communities. A reference model defining common concerns, challenges and remediation methods across all online games is also included.
Standard for Clinical Internet of Things (IoT) Data and Device Interoperability with TIPPSS - Trust, Identity, Privacy, Protection, Safety, Security
This standard establishes the framework with TIPPSS principles (Trust, Identity, Privacy, Protection, Safety, Security) for Clinical Internet of Things (IoT) data and device validation and interoperability. This includes wearable clinical IoT and interoperability with healthcare systems including Electronic Health Records (EHR), Electronic Medical Records (EMR), other clinical IoT devices, in hospital devices, and future devices and connected healthcare systems.
Standard for Requirements of Privacy-preserving Computation Integrated Platforms
This standard provides architecture and requirements of privacy-preserving computation integrated platforms, that includes: - Overview of privacy-preserving computation integrated platforms - The reference architecture of privacy-preserving computation integrated platforms - Functional requirements of privacy-preserving computation integrated platforms - Performance requirements of privacy-preserving computation integrated platforms - Security requirements of privacy-preserving computation integrated platforms.
IEEE Standard for Data Privacy Process
This standard specifies how to manage privacy issues for systems or software that collect personal data. It will do so by defining requirements that cover corporate data collection policies and quality assurance. It also includes a use case and data model for organizations developing applications involving personal information. The standard will help designers by providing ways to identify and measure privacy controls in their systems utilizing privacy impact assessments.
IEEE Standard for Transparent Employer Data Governance
IEEE Standard on Employer Data Governance provides guidelines and certifications on storing, protecting, and using employee data in an ethical and transparent way. The standard recommends tools and services that help employees make informed decisions with their personal information. The standard provides clarity and recommendations both for how employees can share their information in a safe and trusted environment as well as how employers can align with employees in this process while still utilizing information needed for regular work flows.
Standard for Machine Readable Personal Privacy Terms
IEEE Standards Project for Machine Readable Personal Privacy Terms. The purpose of the standard is to provide individuals with means to proffer their own terms respecting personal privacy, in ways that can be read, acknowledged, and agreed to by machines operated by others in the networked world. In a more formal sense, the purpose of the standard is to enable individuals to operate as first parties in agreements with others—mostly companies—operating as second parties. Note that the purpose of this standard is not to address privacy policies, since these are one-sided and need no agreement. (Terms require agreement; privacy policies do not.)
Privacy enhancing data de-identification terminology and classification of techniques
This document provides a description of privacy-enhancing data de-identification techniques, to be used to describe and design de-identification measures in accordance with the privacy principles in ISO/IEC 29100.
In particular, this document specifies terminology, a classification of de-identification techniques according to their characteristics, and their applicability for reducing the risk of re-identification.
This document is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, that are PII controllers or PII processors acting on a controller's behalf, implementing data de-identification processes for privacy enhancing purposes.
Security techniques – Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management – Requirements and guidelines
This document specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS) in the form of an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management within the context of the organization.
This document specifies PIMS-related requirements and provides guidance for PII controllers and PII processors holding responsibility and accountability for PII processing.
This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which are PII controllers and/or PII processors processing PII within an ISMS.
Information technology – Security techniques – Privacy framework
ISO/IEC 29100:2011 provides a privacy framework which
- specifies a common privacy terminology;
- defines the actors and their roles in processing personally identifiable information (PII);
- describes privacy safeguarding considerations; and
- provides references to known privacy principles for information technology.
ISO/IEC 29100:2011 is applicable to natural persons and organizations involved in specifying, procuring, architecting, designing, developing, testing, maintaining, administering, and operating information and communication technology systems or services where privacy controls are required for the processing of PII.
Information technology – Online privacy notices and consent
This document specifies controls which shape the content and the structure of online privacy notices as well as the process of asking for consent to collect and process personally identifiable information (PII) from PII principals.
This document is applicable in any online context where a PII controller or any other entity processing PII informs PII principals of processing.
Consumer protection – Privacy by design for consumer goods and services
This document establishes high-level requirements for privacy by design to protect privacy throughout the lifecycle of a consumer product, including domestic data processing by the consumer.