Fundamental Principles and Concepts of a Privacy Information Management System
What a PIMS is
A privacy information management system (PIMS) is the management system an organization uses to govern how it handles personally identifiable information (PII) - information that can be related, directly or indirectly, to an identified or identifiable individual. ISO/IEC 27701 defines the PIMS as an extension of an ISMS, so privacy governance and information security governance are designed to work as one system, not two parallel ones.
The three roles
- PII principal - the individual the PII is about.
- PII controller - determines the purposes and means of processing (the 'why and how').
- PII processor - processes PII on behalf of, and on the documented instructions of, a controller.
An organization can hold both roles for different processing activities, which drives which Annex applies (A for controllers, B for processors).
Principles to know
Privacy principles commonly cited from ISO/IEC 29100 include consent and choice, purpose legitimacy and specification, collection limitation, data minimization, use/retention/disclosure limitation, accuracy and quality, openness/transparency/notice, individual participation and access, accountability, information security, and privacy compliance.
Privacy is wider than security
Security protects confidentiality, integrity and availability of information, usually for the organization's benefit. Privacy adds lawfulness, fairness, transparency, purpose limitation, retention limits, accuracy and individual rights. A privacy failure is not always a security failure (e.g. processing for an undisclosed purpose), and a security failure is not always a privacy failure.
Traps
Assuming certification to ISO/IEC 27701 proves legal compliance such as GDPR conformance - it does not. Confusing controller and processor in scenario questions. Treating privacy as confidentiality only.
Rule of thumb: whoever decides 'why and how' is the controller; whoever processes 'on instruction' is the processor. Determine this per processing activity before anything else.