Collaborative Research: CT-M: Privacy, Compliance and Information Risk in Complex Organizational Processes

现代组织，如企业、非营利组织、政府机构和大学，从各种来源收集和使用个人信息，并对如何管理和使用这些信息抱有特定的期望。因此，他们必须找到符合期望的方法，这些期望可能是复杂和多样的，以及相关的隐私法律和法规，同时他们将运营风险降至最低，并有效地执行组织的核心职能。设计组织流程来管理个人信息是组织面临的最大挑战之一（参见Deloitte和Ponemon Institute最近的一项调查[TI07]），这对现代组织中每个个人的个人信息都有深远的影响，即我们所有人。该项目通过开发方法、算法和原型工具来应对这些挑战，将隐私、合规和风险评估集成到复杂的组织流程中。它探索、阐明并正式描述了利益相关者的隐私期望的范围和性质，以及关键法规的范围和性质，如HIPAA、GLBA、COPPA、BASEL 2和萨班斯-奥克斯利（SOX）。它整合了其多学科研究团队的不同观点和专业领域，其中包括三位计算机科学家，一位哲学家和来自IBM的合作研究人员。这种行业连接促进了产品团队之间的交互，这些产品团队为涉及业务流程完整性、信息安全、隐私和信息风险管理的复杂组织提供服务。这项研究建立在“上下文完整性”（一种关于隐私的哲学解释）以及隐私政策规范和执行的语言和基于风险的方法的基础上。为本科生和研究生提供广泛的培训和教育机会，并将研究成果纳入CMU、纽约大学、斯坦福大学和宾夕法尼亚大学的课程。

Modern organizations, such as businesses, non-profits, government agencies, and universities, collect and use personal information from a range of sources, shared with specific expectations about how it will be managed and used. Accordingly, they must find ways to comply with expectations, which may be complex and varied, as well as with relevant privacy laws and regulations, while they minimize operational risk and carry out core functions of the organization efficiently and effectively. Designing organizational processes to manage personal information is one of the greatest challenges facing organizations (see, e.g. a recent survey by Deloitte and the Ponemon Institute [TI07]), with far-reaching implications for every individual whose personal information is available to modern organizations, i.e. all of us.This project responds to these challenges by developing methods, algorithms and prototype tools for integrating privacy, compliance, and risk evaluation into complex organizational processes. It explores, articulates and characterizes formally the scope and nature of privacy-expectations of stakeholders as well as those of key regulations, such as HIPAA, GLBA, COPPA, BASEL 2, and Sarbanes-Oxley (SOX). It incorporates the diverse perspectives and areas of expertise of its multidisciplinary research team, which includes three computer scientists, one philosopher, and collaborating researchers from IBM. This industry connection facilitates interaction with product teams that have served complex organizations concerned with business process integrity, information security, privacy, and information risk management. The research builds on "contextual integrity" (a philosophical account of privacy) as well as language and risk-based methods for privacy policy specification and enforcement. Extensive training and educational opportunities are provided to undergraduate and graduate students and research results integrated into courses at CMU, NYU, Stanford, and UPenn.