+PM-22 [P] Personally Identifiable Information Quality Management

PM-22 [P] Personally Identifiable Information Quality Management

Control

Develop and document organization-wide policies and procedures for:
  1. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;
  2. Correcting or deleting inaccurate or outdated personally identifiable information;
  3. Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and
  4. Appeals of adverse decisions on correction or deletion requests.

Discussion

Personally identifiable information quality management includes steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposition of personally identifiable information. Organizational policies and procedures for personally identifiable information quality management are important because inaccurate or outdated personally identifiable information maintained by organizations may cause problems for individuals. Organizations consider the quality of personally identifiable information involved in business functions where inaccurate information may result in adverse decisions or the denial of benefits and services, or the disclosure of the information may cause stigmatization. Correct information, in certain circumstances, can cause problems for individuals that outweigh the benefits of organizations maintaining the information. Organizations consider creating policies and procedures for the removal of such information. The senior agency official for privacy ensures that practical means and mechanisms exist and are accessible for individuals or their authorized representatives to seek the correction or deletion of personally identifiable information. Processes for correcting or deleting data are clearly defined and publicly available. Organizations use discretion in determining whether data is to be deleted or corrected based on the scope of requests, the changes sought, and the impact of the changes. Additionally, processes include the provision of responses to individuals of decisions to deny requests for correction or deletion. The responses include the reasons for the decisions, a means to record individual objections to the decisions, and a means of requesting reviews of the initial determinations. Organizations notify individuals or their designated representatives when their personally identifiable information is corrected or deleted to provide transparency and confirm the completed action. Due to the complexity of data flows and storage, other entities may need to be informed of the correction or deletion. Notice supports the consistent correction and deletion of personally identifiable information across the data ecosystem.

Assessment Objective

  1. organization-wide policies for personally identifiable information quality management are developed and documented;
  2. organization-wide procedures for personally identifiable information quality management are developed and documented;
    1. the policies address reviewing the accuracy of personally identifiable information across the information life cycle;
    2. the policies address reviewing the relevance of personally identifiable information across the information life cycle;
    3. the policies address reviewing the timeliness of personally identifiable information across the information life cycle;
    4. the policies address reviewing the completeness of personally identifiable information across the information life cycle;
    5. the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;
    6. the procedures address reviewing the relevance of personally identifiable information across the information life cycle;
    7. the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;
    8. the procedures address reviewing the completeness of personally identifiable information across the information life cycle;
    1. the policies address correcting or deleting inaccurate or outdated personally identifiable information;
    2. the procedures address correcting or deleting inaccurate or outdated personally identifiable information;
    1. the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
    2. the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
    1. the policies address appeals of adverse decisions on correction or deletion requests;
    2. the procedures address appeals of adverse decisions on correction or deletion requests.

Assessment Method

Examine

Privacy program plan policies and procedures addressing personally identifiable information quality management, information life cycle documentation, and sample notices of correction or deletion records of monitoring PII quality management practices documentation of reviews and updates of policies and procedures

Interview

Organizational personnel with privacy program information dissemination responsibilities organizational personnel with privacy responsibilities

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is blocked by PM-22 [P] Personally Identifiable Information Quality Management – Assessment Procedure
is blocked by Data Quality Operations
is blocked by Data Quality Management