+SI-19(02) Archiving
|
SI-19(02) Archiving
Control
Prohibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.
Discussion
Datasets can be archived for many reasons. The envisioned purposes for the archived dataset are specified, and if personally identifiable information elements are not required, the elements are not archived. For example, social security numbers may have been collected for record linkage, but the archived dataset may include the required elements from the linked records. In this case, it is not necessary to archive the social security numbers.
Assessment Objective
the archiving of personally identifiable information elements is prohibited if those elements in a dataset will not be needed after the dataset is archived.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
system configuration documentation
data archiving mechanisms
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel responsible for de-identifying the dataset
organizational personnel with dataset archival responsibilities
organizational personnel with information security and privacy responsibilities
1. Oversigt
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|