BS EN 16571-2014 Information technology RFID privacy impact assessment process《信息技术 射频识别隐私影响评估过程》.pdf
《BS EN 16571-2014 Information technology RFID privacy impact assessment process《信息技术 射频识别隐私影响评估过程》.pdf》由会员分享,可在线阅读,更多相关《BS EN 16571-2014 Information technology RFID privacy impact assessment process《信息技术 射频识别隐私影响评估过程》.pdf(108页珍藏版)》请在麦多课文档分享上搜索。
1、BSI Standards PublicationBS EN 16571:2014Information technology RFIDprivacy impact assessmentprocessBS EN 16571:2014 BRITISH STANDARDNational forewordThis British Standard is the UK implementation of EN 16571:2014.The UK participation in its preparation was entrusted to TechnicalCommittee IST/34, Au
2、tomatic identification and data capturetechniques.A list of organizations represented on this committee can beobtained on request to its secretary.This publication does not purport to include all the necessaryprovisions of a contract. Users are responsible for its correctapplication. The British Sta
3、ndards Institution 2014. Published by BSI StandardsLimited 2014ISBN 978 0 580 81786 1ICS 35.240.60Compliance with a British Standard cannot confer immunity fromlegal obligations.This British Standard was published under the authority of theStandards Policy and Strategy Committee on 30 June 2014.Amen
4、dments issued since publicationDate Text affectedBS EN 16571:2014EUROPEAN STANDARD NORME EUROPENNE EUROPISCHE NORM EN 16571 June 2014 ICS 35.240.60 English Version Information technology - RFID privacy impact assessment process Technologies de linformation - Processus dvaluation dimpact sur la vie p
5、rive des applications RFID Verfahren zur Datenschutzfolgenabschtzung (PIA) von RFID This European Standard was approved by CEN on 14 May 2014. CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a na
6、tional standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN member. This European Standard exists in three official versions (English, French, German). A v
7、ersion in any other language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions. CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus
8、, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingd
9、om. EUROPEAN COMMITTEE FOR STANDARDIZATION COMIT EUROPEN DE NORMALISATION EUROPISCHES KOMITEE FR NORMUNG CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels 2014 CEN All rights of exploitation in any form and by any means reserved worldwide for CEN national Members. Ref. No. EN 16571:20
10、14 EBS EN 16571:2014EN 16571:2014 (E) 2 Contents Page Foreword 5 Introduction .6 1 Scope 7 2 Normative references 7 3 Terms and definitions .7 4 Symbols and abbreviations . 11 5 Structure of this European Standard 12 6 Field of reference for this European Standard 12 6.1 RFID as defined by the EU RF
11、ID Recommendation 12 6.2 RFID application as defined by the EU RFID Recommendation 13 6.3 RFID operator as defined by the EU RFID Recommendation . 13 6.4 Relationship between the RFID PIA and data protection and security . 14 6.5 Relevant inputs for the PIA process . 17 6.5.1 General . 17 6.5.2 The
12、privacy capability statement 17 6.5.3 The Registration Authority 17 6.5.4 RFID PIA templates . 17 7 RFID operators organizational objectives of the RFID PIA . 17 7.1 Overview 17 7.2 Meeting and exceeding legal requirements . 18 7.3 When to undertake the RFID PIA . 19 7.3.1 General . 19 7.3.2 Underta
13、king a PIA at the design stage before the RFID system becomes operational 19 7.3.3 Undertaking a PIA at a review and update the design-based PIA . 19 7.3.4 Undertaking a PIA to contribute to the development of a template 19 7.3.5 Undertaking a PIA with an established template . 20 7.3.6 Undertaking
14、a PIA at the introduction of a new function within the RFID application 20 7.3.7 Undertaking a PIA based on changes in RFID technology 20 7.3.8 Undertaking a PIA when a privacy breach has been reported . 20 8 Tools to simplify the process 21 8.1 RFID operator responsibility . 21 8.2 RFID technology
15、privacy capability tools - overview 21 8.3 Registration of RFID privacy capability statements by RFID product manufacturers 21 8.3.1 General . 21 8.3.2 Obligations of the Registration Authority 21 8.3.3 Appointment 22 8.3.4 Resignation . 22 8.3.5 Responsibilities of the RFID product manufacturers .
16、22 8.4 RFID technology privacy capability tools - details 23 8.4.1 RFID integrated circuit privacy capabilities . 23 8.4.2 RFID tag privacy capabilities . 23 8.4.3 RFID interrogator privacy capabilities 23 8.4.4 The default privacy capability statement . 23 8.4.5 Using CEN/TR 16672 to construct priv
17、acy capabilities for products using proprietary protocols 24 8.5 Templates 24 8.5.1 General . 24 BS EN 16571:2014EN 16571:2014 (E) 3 8.5.2 Developing a template 24 8.5.3 Who should prepare the templates? . 25 8.5.4 The role of stakeholders in template development . 25 9 RFID PIA - a process approach
18、 26 9.1 Introduction 26 9.2 Process Steps 26 9.3 Achieving the correct level of detail 27 9.3.1 General . 27 9.3.2 Level 0 no PIA . 27 9.3.3 Level 1 small scale PIA 27 9.3.4 Level 2 PIA focussed on the controlled domain of the application 27 9.3.5 Level 3 Full scale (complete) PIA of the application
19、 . 28 9.3.6 Reducing the effort for the SME organization 28 9.4 Process methodology . 29 10 Preparing the RFID functional statement 30 11 Preparing the description of the RFID applications 31 11.1 Introduction 31 11.2 Multiple applications . 31 11.3 RFID application overview 32 11.3.1 General . 32 1
20、1.3.2 Determine which RFID technology is intended or being used . 32 11.3.3 Determine the RFID components used in the application 33 11.3.4 RFID applications on portable devices . 34 11.4 Data on the RFID tag . 36 11.4.1 General . 36 11.4.2 Determine what inherent identifiable features are possessed
21、 by the RFID tag 36 11.4.3 Listing the data elements encoded on the RFID tag 37 11.4.4 Determine whether encoded data can be considered identifiable . 37 11.4.5 Determine whether personal data is encoded on the tag . 38 11.5 Additional data on the application . 38 11.6 RFID data processing 38 11.7 I
22、nternal transfer of RFID data . 39 11.8 External transfer of RFID data 39 11.9 RFID application description sign off 39 12 Risk Assessment . 40 12.1 Procedural requirements derived from the RFID Recommendation 40 12.1.1 Common procedure requirements for all RFID operators 40 12.1.2 Requirements for
23、retailers that are RFID operators 41 12.1.3 Procedure requirements for manufacturers of products eventually sold to consumers 42 12.2 Asset identification and valuation . 42 12.2.1 General . 42 12.2.2 Identification of assets 43 12.2.3 Valuing assets . 44 12.3 Threat identification and evaluation 47
24、 12.3.1 General . 47 12.3.2 Identification and classification of threats . 48 12.3.3 Evaluating threats . 49 12.3.4 The process for the SME organization 50 12.4 Identifying vulnerabilities and enumerating the associated risk levels 50 12.4.1 Basic procedure 50 12.4.2 Procedure to account for exposur
- 1.请仔细阅读文档,确保文档完整性,对于不预览、不比对内容而直接下载带来的问题本站不予受理。
- 2.下载的文档,不会出现我们的网址水印。
- 3、该文档所得收入(下载+内容+预览)归上传者、原创作者;如果您是本文档原作者,请点此认领!既往收益都归您。
本资源只提供5页预览,全部文档请下载后查看!喜欢就下载吧,查找使用更方便
10000 积分 0人已下载
下载 | 加入VIP,交流精品资源 |
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- BSEN165712014INFORMATIONTECHNOLOGYRFIDPRIVACYIMPACTASSESSMENTPROCESS 信息技术 射频 识别 隐私 影响 评估 过程 PDF

链接地址:http://www.mydoc123.com/p-573930.html