Post by pujadas on Oct 20, 2023 22:44:37 GMT -5
The article “ 7 Laws of Identity: The Case for Privacy-Embedded Laws of Identity in the Digital Age ” by Ann Cavoukian, Ph.D., offers a deep and insightful look at the importance of privacy and identity in our ever-changing digital age. evolution. The document updates Identity Laws permeated by privacy, in particular, Fair Information Practices . One can also see an intrinsic relationship with Privacy by Design , or Privacy by Design, a framework developed by Cavoukian as Information and Privacy Commissioner of the Province of Ontario, which was recently accentuated with the creation of the ISO 31700 standard, adopted from February 2023.
The objective of this article is to briefly demonstrate the applicability of controls set out in the ISO standard for the implementation of the 7 Identity Laws in an organization's privacy governance program. With this focus, we list three topics: 1. What are the ws data 7 Laws of Identity? 2. The new ISO 31700 and Privacy By Design. 3. ISO 31700 controls applied. What are the 7 Laws of Identity? The digital era has brought with it countless technological innovations that have transformed the way we live, work and connect. However, this technological advancement also raises significant questions about privacy and the protection of personal data.
The emergence of digital identity technologies is, without a doubt, a universal advancement and facilitator for identifying people. However, we must be careful that an interoperable identity system is not distorted and becomes a surveillance structure (CAVOUKIAN). Thus, the 7 Laws of Identity were formulated in an open blog of experts under the leadership of Kim Cameron, the then head of identity architecture at Microsoft, in 2005. Professor Ann Cavoukian, reformulated the Laws of Identity, or, also called Technologically Necessary Principles in Identity Management, which can serve as the basis for a more secure and privacy-centered digital identity system. These laws are: LAW 1: Personal Control and Consent Technical identification systems should only reveal information that identifies a user with the user's consent. Personal control is fundamental to privacy, as is freedom of choice.
Consent is fundamental for both. LAW 2: Minimum Disclosure for Limited Use: Data Minimization The identity system should disclose as little identifiable information as possible, as this is the most stable and long-term solution. Furthermore, it is the solution that offers the greatest privacy protection. LAW 3: Justifiable Parties: Access only to those who need to know Identity systems must be designed in such a way that the disclosure of identifiable information is limited to those parties who need it and their access is justifiable. This is in line with imposing limitations on the disclosure of personal information and allowing access only on a need to know basis. LAW 4: Targeted Identity: Protection and Accountability A universal identification system must be flexible and respect people's privacy.