Privacy Risk Assessment Methodology

隐私风险评估方法

• 批准号: MC_PC_21030
• 负责人: Michael Boniface
• 金额: $ 31.79万
• 依托单位: University of Southampton
• 依托单位国家: 英国
• 项目类别: Intramural
• 财政年份: 2022
• 资助国家: 英国
• 起止时间: 2022 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=MC_PC_21030
• 关键词: Privacy; Risk; Assessment; Methodology

Organisations responsible for data protection must demonstrate that sharing data for research does not put individuals at undue risk of harm. Such harms relate to a person’s right to privacy, for example, someone’s identity is revealed or that data is used unlawfully.Organisations aim to reduce harm by privacy risk management. Although best practice principles such as the Five Safes are used, there is no standard privacy risk assessment approach. This leaves organisations to make their own choices about levels of risk and how they should be managed.Personal data may be held in many organisations. Often research requires combinations of data e.g., studying patients from hospital to recovery may combine medical data with other data from social care and digital health. With no standard risk assessment approach, it’s hard for multiple organisations to assess and manage risk consistently.PRiAM aims to deliver a way to assess privacy risks for data managed by multiple organisations. Engaging experts and members of the public in research use cases, a privacy risk assessment framework will be developed and demonstrated using a security decision support tool. The framework and evaluation of usability and efficiency will be published ensuring widespread impact.

负责数据保护的组织必须证明，共享研究数据不会使个人面临不当的伤害风险。此类伤害与个人的隐私权有关，例如，某人的身份被泄露或数据被非法使用。组织旨在通过隐私风险管理来减少伤害。尽管使用了“五个安全”等最佳实践原则，但没有标准的隐私风险评估方法。这使得组织可以自行选择风险级别以及如何管理风险。许多组织可能持有个人数据。研究通常需要数据的组合，例如，研究患者从医院到康复的过程可能会将医疗数据与来自社会护理和数字健康的其他数据结合起来。由于没有标准的风险评估方法，多个组织很难一致地评估和管理风险。PRiAM 旨在提供一种评估多个组织管理的数据的隐私风险的方法。让专家和公众参与研究用例，将使用安全决策支持工具开发和演示隐私风险评估框架。可用性和效率的框架和评估将被发布，以确保产生广泛的影响。

项目成果

DARE UK PRiAM Project D2 Report: A Privacy Risk Assessment Framework for Safe Collaborative Research: Risk Tiers for a consistent and transparent use of the five safes framework

DARE UK PRiAM 项目 D2 报告：安全协作研究的隐私风险评估框架：五个安全框架的一致和透明使用的风险等级

• 发表时间: 2022
• 作者: Boniface M

DARE UK PRiAM Project D3 Report: Privacy Risk Framework Application Guide

DARE UK PRiAM 项目 D3 报告：隐私风险框架应用指南

• 发表时间: 2022
• 作者: BonifaceM

DARE UK PRiAM Project D4 Report: Public Engagement: Understanding private individuals' perspectives on privacy and privacy risk

DARE UK PRiAM 项目 D4 报告：公众参与：了解私人对隐私和隐私风险的看法

• 发表时间: 2022
• 作者: BonifaceM

Towards a socio-technical approach for privacy requirements analysis for next-generation trusted research environments

面向下一代可信研究环境的隐私需求分析的社会技术方法

• DOI: 10.1049/icp.2022.2061
• 发表时间: 2022
• 作者: Carmichael L

DARE UK PRiAM Project D1 Report-Privacy Risk Assessment Requirements for Safe Collaborative Research: Exploring Emerging Data Patterns and Needs of Advanced Analytics in Cross Council Research Networks through Use Case Analysis (2.0)

DARE UK PRiAM 项目 D1 报告 - 安全协作研究的隐私风险评估要求：通过用例分析探索跨理事会研究网络中的新兴数据模式和高级分析需求 (2.0)

• 发表时间: 2022
• 作者: Boniface M