Collaborative Research: CT-M: Privacy, Compliance and Information Risk in Complex Organizational Processes

现代组织，如企业、非营利组织、政府机构和大学，从各种来源收集和使用个人信息，并对如何管理和使用这些信息有特定的期望。因此，他们必须设法满足可能复杂多样的期望，并遵守相关的隐私法律和条例，同时尽量减少业务风险，切实有效地履行组织的核心职能。设计组织流程来管理个人信息是组织面临的最大挑战之一（例如，Deloitte和Ponemon Institute最近的一项调查[TI 07]），对现代组织可获得其个人信息的每个人都有深远的影响，即，该项目通过开发方法、算法和原型工具来应对这些挑战，这些方法、算法和原型工具用于将隐私、合规性和风险评估集成到复杂的组织流程中。它正式探讨，阐明和描述了利益相关者的隐私期望的范围和性质，以及主要法规，如HIPAA，GLBA，COPPA，巴塞尔2和Sarbanes-Oxley（SOX）。它融合了其多学科研究团队的不同观点和专业领域，其中包括三名计算机科学家，一名哲学家和来自IBM的合作研究人员。这种行业联系促进了与产品团队的互动，这些产品团队曾为涉及业务流程完整性、信息安全性、隐私和信息风险管理的复杂组织提供服务。该研究建立在“上下文完整性”（隐私的哲学帐户）以及语言和基于风险的隐私政策规范和执行的方法。为本科生和研究生提供广泛的培训和教育机会，并将研究成果纳入CMU，NYU，斯坦福大学和UPenn的课程。

Modern organizations, such as businesses, non-profits, government agencies, and universities, collect and use personal information from a range of sources, shared with specific expectations about how it will be managed and used. Accordingly, they must find ways to comply with expectations, which may be complex and varied, as well as with relevant privacy laws and regulations, while they minimize operational risk and carry out core functions of the organization efficiently and effectively. Designing organizational processes to manage personal information is one of the greatest challenges facing organizations (see, e.g., a recent survey by Deloitte and the Ponemon Institute [TI07]), with far-reaching implications for every individual whose personal information is available to modern organizations, i.e., all of us.This project responds to these challenges by developing methods, algorithms and prototype tools for integrating privacy, compliance, and risk evaluation into complex organizational processes. It explores, articulates and characterizes formally the scope and nature of privacy-expectations of stakeholders as well as those of key regulations, such as HIPAA, GLBA, COPPA, BASEL 2, and Sarbanes-Oxley (SOX). It incorporates the diverse perspectives and areas of expertise of its multidisciplinary research team, which includes three computer scientists, one philosopher, and collaborating researchers from IBM. This industry connection facilitates interaction with product teams that have served complex organizations concerned with business process integrity, information security, privacy, and information risk management. The research builds on "contextual integrity" (a philosophical account of privacy) as well as language and risk-based methods for privacy policy specification and enforcement. Extensive training and educational opportunities are provided to undergraduate and graduate students and research results integrated into courses at CMU, NYU, Stanford, and UPenn.