A pragmatic approach to privacy risk optimization: privacy by design for business practices

This paper introduces Nymity’s Privacy Risk Optimization Process (PROP), a process that enables the implementation of privacy into operationalpolicies and procedures, which embodies in Privacy by Design for businesspractices. The PROP is based on the International Organization for Standardization (ISO) concept that risk can be positive and negative; and further defines RiskOptimization as a process whereby organizations strive to maximize positive risksand mitigate negative ones. The PROP uses these concepts to implement privacyinto operational policies and procedures. This paper was produced by Nymity andthe Office of the Information and Privacy Commissioner of Ontario, Canada. It waspresented by Terry McQuay, President of Nymity, at “Privacy by Design: TheDefinitive Workshop,” in Madrid, Spain, on November 2nd, 2009. The workshopwas hosted by Dr. Ann Cavoukian, Information and Privacy Commissioner ofOntario, Canada, and Yoram Hacohen, Head of the Israeli Law, Information andTechnology Authority