+SI-18 [P] Personally Identifiable Information Quality Operations
---+SI-18(04) [P] Individual Requests

SI-18 [P] Personally Identifiable Information Quality Operations

Control

  1. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [Assignement: organization-defined frequency] ; and
  2. Correct or delete inaccurate or outdated personally identifiable information.

Discussion

Personally identifiable information quality operations include the steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of personally identifiable information. Personally identifiable information quality operations include editing and validating addresses as they are collected or entered into systems using automated address verification look-up application programming interfaces. Checking personally identifiable information quality includes the tracking of updates or changes to data over time, which enables organizations to know how and what personally identifiable information was changed should erroneous information be identified. The measures taken to protect personally identifiable information quality are based on the nature and context of the personally identifiable information, how it is to be used, how it was obtained, and the potential de-identification methods employed. The measures taken to validate the accuracy of personally identifiable information used to make determinations about the rights, benefits, or privileges of individuals covered under federal programs may be more comprehensive than the measures used to validate personally identifiable information used for less sensitive purposes.

Assessment Objective

    1. the accuracy of personally identifiable information across the information life cycle is checked [Assignement: frequency];
    2. the relevance of personally identifiable information across the information life cycle is checked [Assignement: frequency];
    3. the timeliness of personally identifiable information across the information life cycle is checked [Assignement: frequency];
    4. the completeness of personally identifiable information across the information life cycle is checked [Assignement: frequency];
  2. inaccurate or outdated personally identifiable information is corrected or deleted.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures personally identifiable information processing policy documentation addressing personally identifiable information quality operations quality reports maintenance logs system audit records audit findings system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel responsible for performing personally identifiable information quality inspections organizational personnel with information security responsibilities organizational personnel with privacy responsibilities

1. Přehled

SI-18(04) [P] Individual Requests

Control

Correct or delete personally identifiable information upon request by individuals or their designated representatives.

Discussion

Inaccurate personally identifiable information maintained by organizations may cause problems for individuals, especially in those business functions where inaccurate information may result in inappropriate decisions or the denial of benefits and services to individuals. Even correct information, in certain circumstances, can cause problems for individuals that outweigh the benefits of an organization maintaining the information. Organizations use discretion when determining if personally identifiable information is to be corrected or deleted based on the scope of requests, the changes sought, the impact of the changes, and laws, regulations, and policies. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding appropriate instances of correction or deletion.

Assessment Objective

personally identifiable information is corrected or deleted upon request by individuals or their designated representatives.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures personally identifiable information processing policy system configuration individual requests records of correction or deletion actions performed system audit records system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel responsible for responding to individual requests for personally identifiable information correction or deletion organizational personnel with information security and privacy responsibilities

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by SI-18 [P] Personally Identifiable Information Quality Operations – Assessment Procedure
is blocked by Data Quality Operations