Collaborative Research: CT-M: Privacy, Compliance and Information Risk in Complex Organizational Processes

现代组织，如企业、非营利组织、政府机构和大学，从一系列来源收集和使用个人信息，共享关于如何管理和使用这些信息的具体期望。因此，他们必须想方设法遵守可能复杂多样的期望以及相关的隐私法律和法规，同时将业务风险降至最低，并高效率和有效地履行组织的核心职能。设计组织流程以管理个人信息是组织面临的最大挑战之一(参见德勤和Ponemon Institute最近的一项调查[TI07])，这对其个人信息可供现代组织使用的每个人，即我们所有人都具有深远的影响。该项目通过开发将隐私、合规性和风险评估整合到复杂组织流程中的方法、算法和原型工具来应对这些挑战。它正式探索、阐明和描述了隐私的范围和性质--利益相关者的期望，以及HIPAA、GLBA、COPPA、巴塞尔2和萨班斯-奥克斯利(SOX)等关键法规的期望。它融合了其多学科研究团队的不同视角和专业领域，其中包括三名计算机科学家、一名哲学家和来自IBM的合作研究人员。这种行业联系促进了与产品团队的交互，这些团队曾为涉及业务流程完整性、信息安全、隐私和信息风险管理的复杂组织提供服务。这项研究建立在“语境完整性”(对隐私的哲学描述)以及语言和基于风险的隐私政策规范和执行方法的基础上。为本科生和研究生提供广泛的培训和教育机会，并将研究成果整合到CMU、纽约大学、斯坦福大学和宾夕法尼亚大学的课程中。

Modern organizations, such as businesses, non-profits, government agencies, and universities, collect and use personal information from a range of sources, shared with specific expectations about how it will be managed and used. Accordingly, they must find ways to comply with expectations, which may be complex and varied, as well as with relevant privacy laws and regulations, while they minimize operational risk and carry out core functions of the organization efficiently and effectively. Designing organizational processes to manage personal information is one of the greatest challenges facing organizations (see, e.g. a recent survey by Deloitte and the Ponemon Institute [TI07]), with far-reaching implications for every individual whose personal information is available to modern organizations, i.e. all of us.This project responds to these challenges by developing methods, algorithms and prototype tools for integrating privacy, compliance, and risk evaluation into complex organizational processes. It explores, articulates and characterizes formally the scope and nature of privacy-expectations of stakeholders as well as those of key regulations, such as HIPAA, GLBA, COPPA, BASEL 2, and Sarbanes-Oxley (SOX). It incorporates the diverse perspectives and areas of expertise of its multidisciplinary research team, which includes three computer scientists, one philosopher, and collaborating researchers from IBM. This industry connection facilitates interaction with product teams that have served complex organizations concerned with business process integrity, information security, privacy, and information risk management. The research builds on "contextual integrity" (a philosophical account of privacy) as well as language and risk-based methods for privacy policy specification and enforcement. Extensive training and educational opportunities are provided to undergraduate and graduate students and research results integrated into courses at CMU, NYU, Stanford, and UPenn.