The views of privacy auditors regarding standards and methodologies
The views of privacy auditors regarding standards and methodologies
复制标题
隐私审计师对标准和方法的看法
DOI：
10.1108/medar-07-2018-0367
复制
发表时间：
2019
影响因子：
3.5
通讯作者：
Gehan Gunasekara
中科院分区：
文献类型：
--
作者：
David Lau;Alan Toy;David Hay;Gehan Gunasekara
目的本文旨在揭示不同的隐私审计师的做法，揭示在这种做法的任何相似之处的程度。其目的是调查隐私审计师使用的做法的驱动程序，并确定潜在的改进隐私审计的做法，使隐私审计可以更好地服务于stakeholder.Design/methodology/approachSix半结构化访谈七个隐私审计师和监管机构和分析师在澳大利亚，加拿大，新西兰和美国被用作我们分析的基础。FindingsThe研究表明，一些隐私审计师认为隐私作为一个组织问题，这意味着组织内的所有员工都应该了解与组织及其客户相关的隐私问题。由于这种做法超越了隐私审计的单纯合规方法，它表明有一种方法可以避免仅仅适用国家数据隐私法标准的方法，这种方法受到批评，因为它不适用于全球应用和跨境数据的现状。采访的主题表明，隐私审计面临着重大的挑战，如缺乏一个隐私审计专业和提高组织和个人对信息隐私的权利和义务的认识的困难。独创性/valuePrivacy审计大多是未经探索的学术研究和鲜为人知的驱动程序背后的隐私审计的做法。这项研究是第一个记录隐私审计师对他们使用的做法的看法。它还提出了新的结果有关的驱动程序的隐私审计的做法和隐私审计的受益人的利益。它建立在论证隐私最佳实践存在的研究基础上（Toy，2013; Toy和Hay，2015），并通过提供为什么隐私审计员可以从使用隐私最佳实践中受益的原因来扩展这一论点。
PurposeThis paper aims to uncover the practices of different privacy auditors to reveal the extent of any similarities in such practices. The purpose is to investigate the drivers of practices used by privacy auditors and to identify potential for improvements in the practice of privacy auditing so that privacy audits may better serve stakeholders.Design/methodology/approachSix semi-structured interviews with seven privacy auditors and regulators and an analyst across Australia, Canada, New Zealand and the USA are used as the basis for our analysis.FindingsThe study shows that some privacy auditors view privacy as an organizational issue, which means that all staff within an organization should understand the privacy issues that are relevant to the organization and to its customers. Because this practice goes beyond a mere compliance approach to privacy auditing, it indicates that there is a way to avoid the approach of merely applying standards from national data privacy laws which is an approach that has been subject to criticism because it is not applicable to the current situation of global applications and cross-border data. The interview themes demonstrate that privacy audits face significant challenges, such as the lack of a privacy auditing profession and the difficulty of raising the awareness of organizations and individuals regarding information privacy rights and duties.Originality/valuePrivacy auditing is mostly unexplored by academic research and little is known about the drivers behind the practice of privacy auditing. This study is the first to document the views of privacy auditors regarding the practices that they use. It also presents novel results regarding the drivers of the practice of privacy auditing and the interests of the beneficiaries of privacy audits. It builds on research that argues for the existence of best practices for privacy (Toy, 2013; Toy and Hay, 2015) and it extends this argument by providing reasons why privacy auditors may benefit from the use of best practices for privacy.