+PT-04 Consent
---+PT-04(01) Tailored Consent
---+PT-04(02) Just-in-time Consent
---+PT-04(03) Revocation

PT-04 Consent

Control

Implement [Assignement: tools or mechanisms] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.

Discussion

Consent allows individuals to participate in making decisions about the processing of their information and transfers some of the risk that arises from the processing of personally identifiable information from the organization to an individual. Consent may be required by applicable laws, executive orders, directives, regulations, policies, standards, or guidelines. Otherwise, when selecting consent as a control, organizations consider whether individuals can be reasonably expected to understand and accept the privacy risks that arise from their authorization. Organizations consider whether other controls may more effectively mitigate privacy risk either alone or in conjunction with consent. Organizations also consider any demographic or contextual factors that may influence the understanding or behavior of individuals with respect to the processing carried out by the system or organization. When soliciting consent from individuals, organizations consider the appropriate mechanism for obtaining consent, including the type of consent (e.g., opt-in, opt-out), how to properly authenticate and identity proof individuals and how to obtain consent through electronic means. In addition, organizations consider providing a mechanism for individuals to revoke consent once it has been provided, as appropriate. Finally, organizations consider usability factors to help individuals understand the risks being accepted when providing consent, including the use of plain language and avoiding technical jargon.

Assessment Objective

the [Assignement: tools or mechanisms] are implemented for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures consent policies and procedures consent tools and mechanisms consent presentation or display (user interface) evidence of individuals’ consent privacy plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with information security and privacy responsibilities

1. Panoramica

PT-04(01) Tailored Consent

Control

Provide [Assignement: mechanisms] to allow individuals to tailor processing permissions to selected elements of personally identifiable information.

Discussion

While some processing may be necessary for the basic functionality of the product or service, other processing may not. In these circumstances, organizations allow individuals to select how specific personally identifiable information elements may be processed. More tailored consent may help reduce privacy risk, increase individual satisfaction, and avoid adverse behaviors, such as abandonment of the product or service.

Assessment Objective

[Assignement: mechanisms] are provided to allow individuals to tailor processing permissions to selected elements of personally identifiable information.

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures consent policies and procedures consent tools and mechanisms consent presentation or display (user interface) privacy plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with user interface or user experience responsibilities organizational personnel with information security and privacy responsibilities
PT-04(02) Just-in-time Consent

Control

Present [Assignement: consent mechanisms] to individuals at [Assignement: frequency] and in conjunction with [Assignement: personally identifiable information processing].

Discussion

Just-in-time consent enables individuals to participate in how their personally identifiable information is being processed at the time or in conjunction with specific types of data processing when such participation may be most useful to the individual. Individual assumptions about how personally identifiable information is being processed might not be accurate or reliable if time has passed since the individual last gave consent or the type of processing creates significant privacy risk. Organizations use discretion to determine when to use just-in-time consent and may use supporting information on demographics, focus groups, or surveys to learn more about individuals’ privacy interests and concerns.

Assessment Objective

[Assignement: consent mechanisms] are presented to individuals [Assignement: frequency] and in conjunction with [Assignement: personally identifiable information processing].

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures consent policies and procedures privacy plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with user interface or user experience responsibilities organizational personnel with information security and privacy responsibilities
PT-04(03) Revocation

Control

Implement [Assignement: tools or mechanisms] for individuals to revoke consent to the processing of their personally identifiable information.

Discussion

Revocation of consent enables individuals to exercise control over their initial consent decision when circumstances change. Organizations consider usability factors in enabling easy-to-use revocation capabilities.

Assessment Objective

the [Assignement: tools or mechanisms] are implemented for individuals to revoke consent to the processing of their personally identifiable information.

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures consent revocation policies and procedures consent revocation user interface or user experience privacy plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with user interface or user experience responsibilities organizational personnel with information security and privacy responsibilities

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by PT-04 Consent – Assessment Procedure
is blocked by Data Subject Consent
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.