Summit 2011 Working Sessions/Session073

Global Summit 2011 Home Page
Global Summit 2011 Tracks

Privacy - Personal Data/PII, Legislation and OWASP
Please see/use the 'discussion' page for more details about this Working Session
Working Sessions Operational Rules - Please see here the general frame of rules.

WORKING SESSION IDENTIFICATION
Short Work Session Description	Privacy is a growing area of concern in the US, and might have greater awareness & understanding in the EU than security. Should OWASP say more about protecting personal data? Security is just one aspect of data protection, but many data breaches have been the result of application vulnerabilities. This session will begin by working through OWASP's draft response to the FTC's staff report "Protecting Consumer Privacy in an Era of Rapid Change - A Framework for Businesses and Policymakers" to complete it and use this as a way to draw out ideas. This session will be useful for project leaders, as well as anyone in sectors collecting, processing or storing personal data (e.g. of consumers, citizens and employees).
Related Projects (if any)	Application Security Verification Standard - V9 Data Protection Application Security Desk Reference (ASDR) - Vulnerabilities - Privacy Violation
Email Contacts & Roles	Chair Colin Watson	Operational Manager	Mailing list Please use discussion page http://www.owasp.org/index.php/Talk:Summit_2011_Working_Sessions/Session073

WORKING SESSION SPECIFICS
Objectives	Identify privacy enhancing & verification aspects of existing tools and documents Create a one-page OWASP projects-to-privacy cross reference factsheet
Venue/Date&Time/Model	Venue/Room OWASP Global Summit Portugal 2011	Date & Time	Discussion Model participants and attendees

WORKING SESSION OPERATIONAL RESOURCES
Projector, whiteboards, markers, Internet connectivity, power

WORKING SESSION ADDITIONAL DETAILS

The protection of personal data has been an important concern of organisations, especuially in Europe where European legislation has driven continent-wide adoption. In North America, the US HIPAA and Canadian Privacy Act have driven privacy initiatives. With the adoption of principles and processes such as "privacy by design", "privacy impact assessments" and "building privacy in", backed with strong regulation, organizations are having to make privacy a central part of their business practices. Growing public concern about use of their personal data, mis-use by organizations and personal data breaches are leading to increased, rather than decreased government intervention in this area. Individuals themselves are more aware of their powers and there are growing trends such as vendor relationship management, where organisations need to take an external, rather than internal, viewpoint. Privacy issues are nothing new, but some more recent examples are: US Federal Trade Commission (FTC) Preliminary Staff Report on Privacy, 12 December 2010 European Parliament Asks the European Commission to Protect Online Users from Advertising, 15 December 2010 Members Appointed to US Privacy and Civil Liberties Oversight Board, 16 December 2010 Department of Commerce Publishes Green Paper Recommending Creation of a Privacy 'Bill of Rights' for Internet Users, 16 December 2010 Department of Commerce Official Holds Briefing on EU Data Protection Forum, 11 January 2011 Can we map projects (tools and sections in resources) to business drivers such as "privacy"? Privacy aspects are referred to through the OWASP wiki (including projects): But there is not any central guide, and perhaps what there is, does not have enough depth. ASVS includes a whole verification topic about data protection and the ASDR has a page on privacy as a "vulnerability". The OWASP Top ten 2010 mentions personal data in the context of insecure cryptographic storage, but privacy protection is of course much wider than encrypting data. It is of course much wider than application security: But is OWASP offering the correct guidance in this area? Should OWASP be doing more?

WORKING SESSION OUTCOMES / DELIVERABLES
Proposed by Working Group	Approved by OWASP Board
Complete and approve OWASP's response to the FTC's staff report "Protecting Consumer Privacy in an Era of Rapid Change - A Framework for Businesses and Policymakers"	After the Board Meeting - fill in here.
A white paper discussing how the privacy ecosystem overlaps with the OWASP ecosystem and whether there should be more bridges built between them.	After the Board Meeting - fill in here.
	After the Board Meeting - fill in here.
	After the Board Meeting - fill in here.
	After the Board Meeting - fill in here.
	After the Board Meeting - fill in here.
	After the Board Meeting - fill in here.
	After the Board Meeting - fill in here.

Working Session Participants

(Add you name by clicking "edit" on the tab on the upper left side of this page)

WORKING SESSION PARTICIPANTS
Name	Company	Notes & reason for participating, issues to be discussed/addressed
Matthew Chalmers @
Lorna Alamri @
Achim Hoffmann @	sic[!]sec	see items at Overhauling OWASP website session
Elke Roth-Mandutz @	GSO-University of Applied Sciences	web privacy research project
David Campbell @
Abraham Kang