+SI-19(01) Collection

SI-19(01) Collection

Control

De-identify the dataset upon collection by not collecting personally identifiable information.

Discussion

If a data source contains personally identifiable information but the information will not be used, the dataset can be de-identified when it is created by not collecting the data elements that contain the personally identifiable information. For example, if an organization does not intend to use the social security number of an applicant, then application forms do not ask for a social security number.

Assessment Objective

the dataset is de-identified upon collection by not collecting personally identifiable information.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures personally identifiable information processing policy de-identification procedures procedures for minimizing the collection of personally identifiable information system configuration data collection mechanisms system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel responsible for de-identifying the dataset organizational personnel with information security and privacy responsibilities

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by SI-19(01) Collection – Assessment Procedure
is blocked by De-Identify Dataset Upon Collection
is blocked by Primary Source Collection For Personal Data (PD)