1、BSI Standards Publication BS ISO/IEC 29101:2013 Information technology Security techniques Privacy architecture frameworkBS ISO/IEC 29101:2013 BRITISH STANDARD National foreword This British Standard is the UK implementation of ISO/IEC 29101:2013. The UK participation in its preparation was entruste
2、d to Technical Committee IST/33, IT - Security techniques. A list of organizations represented on this committee can be obtained on request to its secretary. This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. Th
3、e British Standards Institution 2013. Published by BSI Standards Limited 2013 ISBN 978 0 580 59542 4 ICS 35.040 Compliance with a British Standard cannot confer immunity from legal obligations. This British Standard was published under the authority of the Standards Policy and Strategy Committee on
4、31 October 2013. Amendments issued since publication Date Text affectedBS ISO/IEC 29101:2013Reference number ISO/IEC 29101:2013(E) ISO/IEC 2013INTERNATIONAL STANDARD ISO/IEC 29101 First edition 2013-10-15 Information technology Security techniques Privacy architecture framework Technologies de linfo
5、rmation Techniques de scurit Architecture de rfrence de la protection de la vie prive BS ISO/IEC 29101:2013 ISO/IEC 29101:2013(E) COPYRIGHT PROTECTED DOCUMENT ISO/IEC 2013 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
6、 or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Case postale 56
7、CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org Published in Switzerland ii ISO/IEC 2013 All rights reservedBS ISO/IEC 29101:2013 ISO/IEC 29101:2013(E) ISO/IEC 2013 All rights reserved iiiContents Page Foreword .v Introductionvi 1 Scope1 2 Norma
8、tive references1 3 Terms and definitions .1 4 Symbols and abbreviated terms 1 5 Overview of the privacy architecture framework .2 5.1 Elements of the framework.2 5.2 Relationship with management systems3 6 Actors and PII 3 6.1 Overview.3 6.2 Phases of the PII processing life cycle .4 6.2.1 Collectio
9、n .4 6.2.2 Transfer 5 6.2.3 Use 5 6.2.4 Storage .6 6.2.5 Disposal6 7 Concerns 6 7.1 Overview.6 7.2 The privacy principles of ISO/IEC 29100.7 7.3 Privacy safeguarding requirements 7 8 Architectural views8 8.1 Introduction8 8.2 Component view8 8.2.1 Privacy settings layer9 8.2.2 Identity management an
10、d access management layer .12 8.2.3 PII layer.14 8.3 Actor view.21 8.3.1 ICT system of the PII principal .21 8.3.2 ICT system of the PII controller .21 8.3.3 ICT system of the PII processor.22 8.4 Interaction view .23 8.4.1 Privacy settings layer23 8.4.2 Identity and access management layer.24 8.4.3
11、 PII layer.24 Annex A (informative) Examples of the PII-related concerns of an ICT system.26 Annex B (informative) A PII aggregation system with secure computation .32 Annex C (informative) A privacy-friendly, pseudonymous system for identity and access control management 39 Annex D (informative) Re
12、lating privacy principles to information security controls 45 BS ISO/IEC 29101:2013 ISO/IEC 29101:2013(E) iv ISO/IEC 2013 All rights reservedFigures Figure 1 Elements of the privacy architecture framework in context 2 Figure 2 The actors and their ICT systems according to ISO/IEC 29101. 4 Figure 3 T
13、he architecture of the ICT system of the PII principal. 21 Figure 4 The architecture of the ICT system of the PII controller . 22 Figure 5 The architecture of the ICT system of the PII processor 23 Figure 6 The deployment of components in the privacy settings layer. 24 Figure 7 The deployment of com
14、ponents in the identity and access management layer. 24 Figure 8 The deployment of components in the PII layer . 25 Figure B.1 Deployment of the secure computation system 33 Figure B.2 The architecture for the PII entry ICT system 33 Figure B.3 The architecture for the study coordinator ICT system .
15、 35 Figure B.4 The architecture for the secure data analysis application . 36 Figure C.1 An overview of the architecture actors and their interactions 40 Figure C.2 Architecture of the ICT system of the University Credential Issuer. 41 Figure C.3 Architecture of the ICT system of the student. 42 Fig
16、ure C.4 Architecture of the Course Evaluation Application 43 Tables Table 1 Example of the relationship between privacy principles and the components in the privacy settings layer 12 Table 2 Example of the relationship between privacy principles and the components in the identity and access manageme
17、nt layer 15 Table 3 Example of the relationship between privacy principles and the components in the PII layer 20 Table A.1 Examples of the relationship between concerns and the components in the privacy settings layer29 Table A.2 Examples of the relationship between concerns and the components in t
18、he identity and access management layer 29 Table A.3 Examples of the relationship between concerns and the components in the PII layer 30 Table A.4 Examples of the relationship between privacy principles and the high-level concerns 31 Table D.1 Privacy principles and their corresponding information
19、security controls 45 BS ISO/IEC 29101:2013 ISO/IEC 29101:2013(E) ISO/IEC 2013 All rights reserved vForeword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that
20、 are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other internat
21、ional organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in
22、the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at
23、least 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC 29101 was prepared by Joint Technic
24、al Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, Security techniques. BS ISO/IEC 29101:2013 ISO/IEC 29101:2013(E) vi ISO/IEC 2013 All rights reservedIntroduction This International Standard describes a high-level architecture framework and associated controls for the safeguard
25、ing of privacy in information and communication technology (ICT) systems that store and process personally identifiable information (PII). The privacy architecture framework described in this International Standard provides a consistent, high-level approach to the implementation of privacy controls
26、for the processing of PII in ICT systems; provides guidance for planning, designing and building ICT system architectures that safeguard the privacy of PII principals by controlling the processing, access and transfer of personally identifiable information; and shows how privacy enhancing technologi
27、es (PETs) can be used as privacy controls. This International Standard builds on the privacy framework provided by ISO/IEC 29100 to help an organization define its privacy safeguarding requirements as they relate to PII processed by any ICT system. In some countries, privacy safeguarding requirement
28、s are understood to be synonymous with data protection/privacy requirements and are the subject of data protection/privacy legislation. This International Standard focuses on ICT systems that are designed to interact with PII principals. BS ISO/IEC 29101:2013 INTERNATIONAL STANDARD ISO/IEC 29101:201
29、3(E) ISO/IEC 2013 All rights reserved 1Information technology Security techniques Privacy architecture framework 1 Scope This International Standard defines a privacy architecture framework that: specifies concerns for ICT systems that process PII; lists components for the implementation of such sys
30、tems; and provides architectural views contextualizing these components. This International Standard is applicable to entities involved in specifying, procuring, architecting, designing, testing, maintaining, administering and operating ICT systems that process PII. It focuses primarily on ICT syste
31、ms that are designed to interact with PII principals. 2 Normative references The following documents, in whole or in part, are normatively referenced in this document and are indispensable for its application. For dated references, only the edition cited applies. For undated references, the latest e
32、dition of the referenced document (including any amendments) applies. ISO/IEC 29100:2011, Information technology Security techniques Privacy framework ISO/IEC/IEEE 42010:2011, Systems and software engineering Architecture description 3 Terms and definitions For the purposes of this document, the ter
33、ms and definitions given in ISO/IEC 29100 and ISO/IEC/IEEE 42010 apply. 4 Symbols and abbreviated terms The following abbreviations apply to ISO/IEC 29101: ICT Information and Communication Technology PET Privacy Enhancing Technology PII Personally Identifiable Information BS ISO/IEC 29101:2013 ISO/
34、IEC 29101:2013(E) 2 ISO/IEC 2013 All rights reserved5 Overview of the privacy architecture framework 5.1 Elements of the framework The privacy architecture framework presented in ISO/IEC 29101 is intended as a technical reference for developers of ICT systems that process PII. This standard does not
35、 set requirements for privacy policies; it assumes that a privacy policy is in place and that privacy safeguarding requirements have been defined and that appropriate safeguards will be implemented within the ICT system. This architecture framework focuses on the protection of PII. Since this is par
36、tly a security goal, ICT systems processing PII should also follow information security engineering guidelines. This architecture framework lists some information security components that are critical for safeguarding PII processed within ICT systems. The architecture framework presented is based on
37、 the model used in ISO/IEC/IEEE 42010. The stakeholders related to these concerns are the privacy stakeholders defined in ISO/IEC 29100. They are discussed in more detail in Clause 6. The concerns for the architecture framework are described in Clause 7 and include the privacy principles of ISO/IEC
38、29100 and privacy safeguarding requirements specific to an ICT system. The architecture framework is presented as follows: a. the layers of the technical architecture framework in 8.2 show the architecture from a component viewpoint. Each layer groups components with a common goal or a similar funct
39、ion; b. the deployment model in 8.3 shows the architecture framework from a standalone ICT system viewpoint. Each view shows a grouping of the components based on their deployment in the stakeholders ICT systems; and c. the views in 8.4 show the architecture framework from an interaction viewpoint.
40、The views illustrate how the components interact between ICT systems of different stakeholders. The architecture framework also presents correspondence rules between the concerns and viewpoints through the use of mapping tables. ISO/IEC 29101 actor ISO/IEC 29101 components ISO/IEC 29101 concerns Oth
41、er components Other concerns ICT system processing PII affect affect usesFigure 1 Elements of the privacy architecture framework in context Figure 1 illustrates the relationship between the elements of the privacy architecture framework. The central element of the architecture framework is the ICT s
42、ystem being built. An ISO/IEC 29101 actor uses the ICT system. The design of the ICT systems is affected by both ISO/IEC 29101 concerns and also other concerns. BS ISO/IEC 29101:2013 ISO/IEC 29101:2013(E) ISO/IEC 2013 All rights reserved 3Examples of other concerns include non-functional requirement
43、s that affect the performance, accessibility and design of the ICT system and do not affect the functional processing of PII. These other concerns are out of the scope of ISO/IEC 29101. The ICT system may contain components from the ISO/IEC 29101 privacy architecture framework as well as other compo
44、nents. These components do not process PII, but instead handle other functionality in the ICT system like providing accessibility or rendering special user interfaces. Such components are out of the scope of this standard. 5.2 Relationship with management systems The use of a management system enabl
45、es PII controllers and processors to more effectively meet their privacy safeguarding requirements using a structured approach. This structured approach also provides PII controllers and processors the ability to measure outcomes and continuously improve the management systems effectiveness. An effe
46、ctive management system is as transparent as possible but still impacts people, processes and technology. It should be part of the internal control program and risk mitigation strategy of an organization and its implementation helps to satisfy compliance with data protection and privacy regulations.
47、 6 Actors and PII 6.1 Overview The actors of the ISO/IEC architecture framework are the privacy stakeholders involved in PII processing described in ISO/IEC 29100. These actors are a. the PII principal; b. the PII controller; and c. the PII processor. NOTE The “third party” defined as one of the fou
48、r categories of the actors in ISO/IEC 29100 is out of the scope of the architecture framework specified in this standard. From the deployment viewpoint, the architecture framework is divided into three parts. Each part applies to the ICT system deployed from the viewpoint of each of these actors. Fi
49、gure 2 shows the ICT systems of the actors and the flows of PII between these ICT systems. It illustrates the logical division of functionality for the architecture framework described in this standard. It is not intended as a representation of the physical structure, organisation or ownership of ICT system hardware. BS ISO/IEC 29101:2013 ISO/IEC 29101:2013(E) 4 ISO/IEC 2013 All rights reservedFigure 2 The actors and their ICT systems according to ISO/IEC
