Cultivating Appropriate Privacy Risk

[Commentary] Landscaping a yard requires careful planning and site assessment. As the landscape matures, a gardener proactively assesses changes and addresses them. Privacy teams need a parallel approach -- assess an initiative when beginning to plant in the privacy landscape and continue to assess how change impacts the entire privacy landscape. Assessing privacy risk associated with change challenges privacy teams, but they can take steps to cultivate an appropriate risk landscape.

The risk management survey from the International Association fo Privacy Professionals and Bloomberg Law did not fully explore assessing risk associated with change. If privacy risk is solely viewed as non-compliance with stated legal or security policies, standards or procedures, this would be natural. Once an assessed initiative is planted in the privacy landscape, there may be an assumption that its compliance is evergreen and changes will not impact its risk profile. My experience indicates this is false hope.

[Brad Reimer is a principal privacy/risk management analyst at Deluxe Corporation]