Privacy Risk Folded Into a Security Register
CareWell Devices makes a diabetes management app used by 120,000 patients in four countries and also sells population insights. Its risk register was built for the ISO/IEC 27001 programme: each asset is scored likelihood times impact on a 5x5 matrix, and 'impact' is defined as cost to CareWell - regulatory fines, lost revenue, remediation effort. The privacy team's entries were folded into the same register last year under the instruction 'use the existing method'. A new 'population health insights' feature now exports glucose-trend aggregates at postcode-sector level to two insurers; the last privacy impact assessment was in 2021 and covered the patient-facing app only. The internal auditor reported that risk assessment 'conforms' because every asset has a score and an owner. A clinician warned in a meeting that a postcode sector of 4,000 people can contain fewer than 30 patients with the condition. The transition gap analysis is due in six weeks.
1. Critique the current risk method against what ISO/IEC 27701 expects. What is missing when privacy risk is folded into an information-security register scored on organisational impact?
Read the worked answer
The method measures the wrong harm. Information security risk and privacy risk are related but not identical: the security register asks what happens to CareWell if confidentiality, integrity or availability fails, priced in fines and revenue. Privacy risk asks what happens to PII principals - patients - when data is used, shared, linked or re-identified: discrimination, distress, loss of trust, physical or social harm. Folding the second into the first systematically under-scores it, because a disclosure that harms 4,000 patients but costs CareWell little scores 'low'.
Missing elements: a privacy risk criterion expressed as impact on PII principals, not only on the organisation; assessment of harm arising from lawful but invasive processing as well as from incidents; consideration of context (health data, vulnerability, small-area geography); interested parties including patients and regulators; traceability from assessment to treatment decisions. Also missing is a re-assessment trigger: the 2021 assessment predates the insights feature, so the register is scoring an asset whose purpose has changed, which invalidates the 'conforms' conclusion however many owners are listed.
2. Set out how the population health insights feature should be assessed: method, criteria, participants, and the decision rule for requiring a privacy impact assessment.
Read the worked answer
Treat it as a new processing activity, not an extension. Steps: update the processing register with the new purpose, the two insurer recipients, data categories and the aggregation method; run a privacy impact assessment - health data, large scale, new disclosure to commercial third parties and plausible re-identification each independently justify one; assess re-identification quantitatively rather than by assertion (cell counts per postcode sector, combination with insurer-held data, k-anonymity thresholds, whether 'aggregate' survives a join attack); test necessity and proportionality, including whether the purpose can be met with less granular data; define treatment - minimum cell size, suppression, noise, contractual prohibition on re-identification, access limits, retention, and a release gate; involve privacy/DPO, data science, security, legal and clinical staff, with a documented challenge from someone independent of the product team; and obtain sign-off from an accountable owner who accepts residual risk in writing.
Decision rule: if re-identification risk cannot be reduced below an agreed threshold, the feature does not ship as designed. The clinician's figure is not an objection to note - it is the assessment input.
3. What should the internal auditor's conclusion have been, and what evidence would demonstrate a corrected approach?
Read the worked answer
The conclusion should have been that conformity could not be demonstrated. The audit tested whether a score existed, not whether the method assessed the right risk - the difference between auditing form and auditing effect. Evidence of a corrected approach: a documented privacy risk criterion referencing harm to PII principals; one risk assessment per processing activity in the register, with the insights feature carrying its own and the small-cell concern either quantified or explicitly accepted; a PIA record with necessity and proportionality analysis plus treatment decisions; traceability from assessment to Annex A controls and to the SoA; management review minutes showing residual privacy risk accepted by a named accountable person; and a monitoring measure such as re-identification test results or cell-size exceptions reported to the privacy forum. The auditor should also have raised the stale 2021 assessment as a finding rather than a footnote. A transition auditor will ask exactly this: show me a privacy risk you decided was acceptable, and who decided it.