Privacy Risk Assessment Methodology

点击翻译按钮获取中文摘要

Organisations responsible for data protection must demonstrate that sharing data for research does not put individuals at undue risk of harm. Such harms relate to a person’s right to privacy, for example, someone’s identity is revealed or that data is used unlawfully.Organisations aim to reduce harm by privacy risk management. Although best practice principles such as the Five Safes are used, there is no standard privacy risk assessment approach. This leaves organisations to make their own choices about levels of risk and how they should be managed.Personal data may be held in many organisations. Often research requires combinations of data e.g., studying patients from hospital to recovery may combine medical data with other data from social care and digital health. With no standard risk assessment approach, it’s hard for multiple organisations to assess and manage risk consistently.PRiAM aims to deliver a way to assess privacy risks for data managed by multiple organisations. Engaging experts and members of the public in research use cases, a privacy risk assessment framework will be developed and demonstrated using a security decision support tool. The framework and evaluation of usability and efficiency will be published ensuring widespread impact.