BS ISO IEC 15944-8-2012 Information technology Business Operational View Identification of privacy protection requirements as external constraints on business transactions《信息技术 商业运.pdf

1、raising standards worldwideNO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAWBSI Standards PublicationBS ISO/IEC 15944-8:2012Information technology Business Operational View Part 8: Identification of privacy protection requirements as external constraints on business transactions

2、 BS ISO/IEC 15944-8:2012 BRITISH STANDARDNational forewordThis British Standard is the UK implementation of ISO/IEC 15944-8:2012.The UK participation in its preparation was entrusted to TechnicalCommittee IST/40, Data management and interchange.A list of organizations represented on this committee c

3、an be obtained on request to its secretary.This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Standards Institution 2012. Published by BSI Standards Limited 2012ISBN 978 0 580 62616 6 ICS 35.240.60 C

4、ompliance with a British Standard cannot confer immunity from legal obligations.This British Standard was published under the authority of the Standards Policy and Strategy Committee on 30 April 2012.Amendments issued since publicationDate Text affectedBS ISO/IEC 15944-8:2012Reference numberISO/IEC

5、15944-8:2012(E)ISO/IEC 2012INTERNATIONALSTANDARD ISO/IEC15944-8First edition2012-04-01Information technology BusinessOperational View Part 8: Identification of privacy protectionrequirements as external constraints onbusiness transactions Technologies de linformation Vue oprationnelle daffaires Part

6、ie 8: Identification des exigences de protection de la vie prive en tant que contraintes externes sur les transactions daffaires BS ISO/IEC 15944-8:2012ISO/IEC 15944-8:2012(E) COPYRIGHT PROTECTED DOCUMENT ISO/IEC 2012 All rights reserved. Unless otherwise specified, no part of this publication may b

7、e reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. +

8、41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org Published in Switzerland ii ISO/IEC 2012 All rights reservedBS ISO/IEC 15944-8:2012ISO/IEC 15944-8:2012(E) ISO/IEC 2012 All rights reserved iiiContents Page Foreword . vii 0 Introduction . viii 0.1 Purpose and overview . v

9、iii 0.1.1 ISO/IEC 14662 “Open-edi Reference Model“ . viii 0.1.2 ISO/IEC 15944-1 “Business Agreement Semantic Descriptive Techniques” (“Business Operational View (BOV”) . x 0.2 Introducing the use of “Person“, “organization“ and “party“ in the context of business transaction and commitment exchange .

10、 xi 0.3 Importance and role of terms and definitions . xiii 0.4 Importance of the two classes of constraints of the Business Transaction Model (BTM) . xiii 0.5 Need for a standard based on rules and guidelines . xiv 0.6 Use of “jurisdictional domain“, and “jurisdiction“ (and “country“) in the contex

11、t of business transaction and commitment exchange . xv 0.7 Use of “identifier“ as “identifier (in business transaction)“ to prevent ambiguity xvi 0.8 Use of “privacy protection” in the context of business transaction and commitment exchange . xvi 0.9 Organization and description of this document xvi

12、i 1 Scope 1 1.1 Statement of scope . 1 1.2 Exclusions 2 1.2.1 Functional Services View (FSV) . 2 1.2.2 Internal behaviour of organizations (and public administration) . 2 1.2.3 “organization Person” 2 1.2.4 Overlap of and/or conflict among jurisdictional domains as sources of privacy protection requ

13、irements 2 1.2.5 Publicly available personal information 3 1.3 Aspects currently not addressed 4 1.4 IT-systems environment neutrality 7 2 Normative references 9 2.1 ISO/IEC, ISO and ITU . 9 2.2 Referenced specifications 10 3 Terms and definitions . 11 4 Symbols and abbreviations 41 5 Fundamental pr

14、inciples and assumptions governing privacy protection requirements in business transactions involving individuals (external constraints perspective) . 43 5.1 Introduction 43 5.2 Exceptions to the application of the privacy protection principles . 46 5.3 Fundamental Privacy Protection Principles . 46

15、 5.3.1 Privacy Protection Principle 1: Preventing Harm 46 5.3.2 Privacy Protection Principle 2: Accountability 47 5.3.3 Privacy Protection Principle 3: Identifying Purposes 50 5.3.4 Privacy Protection Principle 4: Informed Consent 50 5.3.5 Privacy Protection Principle 5: Limiting Collection . 52 5.3

16、.6 Privacy Protection Principle 6: Limiting Use, Disclosure and Retention 54 5.3.7 Privacy Protection Principle 7: Accuracy . 57 5.3.8 Privacy Protection Principle 8: Safeguards 58 5.3.9 Privacy Protection Principle 9: Openness 59 5.3.10 Principle Protection Principle 10: Individual Access 60 5.3.11

17、 Privacy Protection Principle 11: Challenging Compliance . 62 BS ISO/IEC 15944-8:2012ISO/IEC 15944-8:2012(E) iv ISO/IEC 2012 All rights reserved5.4 Requirement for tagging (or labelling) data elements in support of privacy protection requirements 63 6 Collaboration space and privacy protection .65 6

18、.1 Introduction 65 6.2 Basic Open-edi collaboration space: Buyer and seller .65 6.3 Collaboration space: The role of buyer (as individual), seller and regulator 66 7 Public policy requirements of jurisdictional domains .69 7.1 Introduction 69 7.2 Jurisdictional domains and public policy requirements

19、 .69 7.2.1 Privacy protection70 7.2.2 Person and external constraints: Consumer protection .72 7.2.3 Individual accessibility 73 7.2.4 Human rights 74 7.2.5 Privacy as a right of an “individual” and not the right of an organization or public administration 74 8 Principles and rules governing the est

20、ablishment, management and use of identities of an individual .77 8.1 Introduction 77 8.2 Rules governing the establishment of personae, identifiers and signatures of an individual 78 8.3 Rules governing the assignment of unique identifiers to an individual by Registration Authorities (RAs) .84 8.4

21、Rules governing individual identity, authentication, recognition, and use .85 8.5 Legally recognized individual identifies (LRIIs) .90 9 Person component individual sub-type .93 9.1 Introduction 93 9.2 Role qualification of a Person as an individual 93 9.3 Persona and legally recognized names (LRNs)

22、 of an individual 94 9.4 Truncation of legally recognized names of individuals .94 9.5 Rules governing anonymization of individuals in a business transaction .95 9.6 Rules governing pseudonymization of personal information in a business transaction 97 10 Process component 99 10.1 Introduction 99 10.

23、2 Planning 99 10.3 Identification .99 10.4 Negotiation 100 10.5 Actualization 100 10.6 Post-Actualization . 100 11 Data component 101 11.1 Introduction . 101 11.2 Rules governing the role of Business Transaction Identifier (BTI) in support of privacy protection requirements 101 11.3 Rules governing

24、state of change management of business transactions in support of privacy protection requirements . 102 11.4 Rules governing records retention of personal information in a business transaction . 102 11.5 Rules governing time/date referencing of personal information in a business transaction 103 12 T

25、emplate for identifying privacy protection requirements on business transactions 105 12.1 Introduction and basic principles . 105 12.2 Template structure and contents 105 12.3 Template for specifying the scope of an Open-edi scenario . 106 12.4 Consolidated template of attributes of Open-edi scenari

26、os, roles and information bundles 113 13 Conformance statement . 119 13.1 Introduction . 119 13.2 Conformance to the ISO/IEC 14662 Open-edi Reference Model and the multipart ISO/IEC 15944 eBusiness standard 119 13.3 Conformance to ISO/IEC 15944-8 119 BS ISO/IEC 15944-8:2012ISO/IEC 15944-8:2012(E) IS

27、O/IEC 2012 All rights reserved vAnnex A (normative) Consolidated list of terms and definitions with cultural adaptability: ISO English and ISO French language equivalency . 120 A.1 Introduction 120 A.2 ISO English and ISO French . 120 A.3 Cultural adaptability and quality control. 120 A.4 Organizati

28、on of Annex A Consolidated list in matrix form 121 A.5 Consolidated list of ISO/IEC 15944-8 terms and definitions . 122 Annex B (normative) Consolidated set of rules in existing Parts of ISO/IEC 15944 of particular relevance to privacy protection requirements as external constraints on business tran

29、sactions . 185 B.1 Introduction 185 B.2 Organization of Annex B: Consolidated list in matrix form 185 B.3 Consolidated list of rules in ISO/IEC 15944-1 pertaining to external constraints relevant to supporting privacy protection requirements . 186 B.4 Consolidated list of rules in ISO/IEC 15944-2 pe

30、rtaining to external constraints of relevance to supporting privacy protection requirements . 189 B.5 Consolidated list of rules in ISO/IEC 15944-5 pertaining to external constraints of relevance to supporting privacy protection requirements . 190 B.6 Consolidated list of rules in ISO/IEC 15944-7 pe

31、rtaining to external constraints of relevance to supporting privacy protection requirements . 194 Annex C (normative) Business Transaction Model (BTM): Classes of constraints 200 Annex D (normative) Integrated set of information life cycle management (ILCM) principles in support of information law c

32、ompliance 205 D.1 Introduction 205 D.2 Purpose 205 D.3 Approach 206 D.4 Integrated set of information life cycle management (ILCM) principles 206 Annex E (normative) Key existing concepts and definitions applicable to the establishment, management, and use of identities of a single individual. 209 A

33、nnex F (normative) Coded domains for specifying state change and record retention management in support of privacy protection requirements . 211 F.1 Introduction 211 F.2 State changes 212 F.2.1 Introduction 212 F.2.2 Specification of state changes allowed to personal information . 213 F.2.3 Store ch

34、ange type . 214 F.3 Records retention 216 F.4 Records destruction 218 Bibliography 220 BS ISO/IEC 15944-8:2012ISO/IEC 15944-8:2012(E) vi ISO/IEC 2012 All rights reservedFigures Page Figure 1 Open-edi environment Open-edi Reference Model ix Figure 2 Integrated view - Business operational requirements

35、: External constraints focus. xi Figure 3 Primary sources for privacy protection principles . 45 Figure 4 Concept of a business collaboration . 66 Figure 5 Privacy collaboration space (of a business transaction) including the role of a regulator . 68 Figure 6 Common public policy requirements, i.e.,

36、 external constraints, applying to a business transaction where the “buyer” is an “individual” 70 Figure 7 Illustration of relationships of links of a (real world) individual to (its) persona (e) to identification schemas and resulting identifiers to associated Person signatures in the context of di

37、fferent business transactions and governing rules . 80 Figure 8 Illustration of range of links between personae and identifiers of an individual identity(ies) of an individual 86 Figure 9 Illustration of two basic options for establishment of a recognized individual identity (rii) 89 Figure C.1 Busi

38、ness Transaction Model - Fundamental components (Graphic illustration) 200 Figure C.2 UML-based Representation of Figure C.1 Business Transaction Model . 201 Figure C.3 Business Transaction Model: Classes of constraints 204 Tables Page Table 1 Template for specifying the scope of an Open-edi scenari

39、o 106 Table 2 Consolidated template of attributes of Open-edi scenarios, roles and information bundles . 113 Table F.1 ISO/IEC 15944-5:05 Codes for specifying state changes allowed for the values of Information Bundles and Semantic Components 213 Table F.2 ISO/IEC 15944-5:06 Codes representing store

40、 change type for Information Bundles and Semantic Components . 215 Table F.3 ISO/IEC 15944-5:02 Codes Representing Specification of Records Retention Responsibility 216 Table F.4 ISO/IEC 15944-5:04 Codes representing retention triggers . 218 Table F.5 ISO/IEC 15944-5:03 Codes representing dispositio

41、n of recorded information 219 BS ISO/IEC 15944-8:2012ISO/IEC 15944-8:2012(E) ISO/IEC 2012 All rights reserved viiForeword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. Nation

42、al bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest.

43、Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the r

44、ules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires a

45、pproval by at least 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC 15944-8 was prepared

46、by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 32, Data management and interchange. ISO/IEC 15944 consists of the following parts, under the general title Information technology Business Operational View: Part 1: Operational aspects of Open-edi for implementation

47、 Part 2: Registration of scenarios and their components as business objects Part 4: Business transaction scenarios Accounting and economic ontology Part 5: Identification and referencing of requirements of jurisdictional domains as sources of external constraints Part 6: Technical introduction to e-

48、Business modelling Technical Report Part 7: eBusiness vocabulary Part 8: Identification of privacy protection requirements as external constraints on business transactions Part 10: Coded domains The following parts are under preparation: Part 3: Open-edi description techniques (OeDTs) Part 9: Tracea

49、bility framework BS ISO/IEC 15944-8:2012ISO/IEC 15944-8:2012(E) viii ISO/IEC 2012 All rights reserved0 Introduction 0.1 Purpose and overview Modelling business transactions using scenarios and scenario components is done by specifying the applicable constraints on the data content using explicitly stated rules. The Open-edi Reference Model identified two basic classes of constraints, “internal constraints“ and “external constraints“. External constraints appl