Test Security Subgroup: Data Protection

1
Test Security Subgroup Data Protection

• Ashok Sarathy, GMAC
• Peg Jobst, GMAC
• Mark Poole, Pearson VUE

2
Testing within the U.S.

• Abide by the promises you make
• Notice
• Consent
• Security

Privacy Online Fair Information Practice
http//www.ftc.gov/reports/privacy2000/privacy2000
.pdf
3
Testing Internationally

• Data Privacy Standards
• Global Organization
• Collects personal information
• Provides adequate protection
• SafeHarbor (example)
• Seven Principles

4
Data Protection

• SafeHarbor (7 principles)
• Notice
• Choice
• Onward Transfer
• Access
• Security
• Data Integrity
• Enforcement

5
Notice
6
Choice
7
Onward Transfer
8
Data Protection
9
Integrity and Security
Security
Integrity

• Relevant for intended use

• Reasonable measures to protect data

10
Enforcement

• Dispute Resolution
• Verify Commitments
• Remedy Problems
• Self Certification
• Example
• Security Incident Process

11
Data Collection

• Applicability to Testing Organizations
• File Notices
• Comply with local laws
• Stay Current

12
Roles and Classifications

• Data Controller
• Data Processor

• Sensitive
• Non-sensitive

13
Data Protection

• Data Processing Template
• DP Template
• Country Specific Template
• Country Template

14
Data Protection
15
Data Protection