Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The Safe Harbor website says the following:

The European Commission’s Directive on Data Protection went into effect in October of 1998, and would prohibit the transfer of personal data to non-European Union countries that do not meet the European Union (EU) “adequacy” standard for privacy protection.

Is there any mapping to other compliance frameworks? Would ISO 27001 or SSAE 16 (or ISAE 3402) be deemed equivalent or "adequate"?

share|improve this question
    
Can you clarify if you're looking for a framework to satisfy things with, or if you're unsure whether a US company can be considered eligible for receiving data from an EU country? –  Jeff Ferland Mar 9 '13 at 16:43
    
I'm looking to leverage a pre-existing framework to satisfy the "adequacy" provision of the Safe Harbor Framework. Basically, if one is ISO 27001 compliant can one be said to have satisfied the adequacy provision of Safe Harbor - all that is left to do is submit the form. Obviously ISO 27001 will help as opposed to not being compliant with any framework but how much? Like 90% and some tweaking to specific privacy provisions? –  Jason Mar 10 '13 at 16:39
add comment

2 Answers

up vote 0 down vote accepted

http://export.gov/safeharbor/eu/eg_main_018476.asp

It seems there is us eu safe harbour framework that is required in order to get comply and its all on choice basis. See link for more info.

Can others standards can help you achieve safe harbor compliance?

I say yes, and this is the response it says..

"ISO 27001 has a way of satisfying compliance requirements on all these various statures and regulations with just minor adjustments. It can help you comply with Safe Harbor, PCI DSS, SOX, and GLB".

Complete article

Why?How?(Some research)

FRAMEWORK REQUIREMENTS?

To self-certify for the Safe Harbor, organizations can provide to the Department of Commerce (or its designee) a letter – signed by a corporate officer on behalf of the organization that is joining the Safe Harbor – that contains at least the following information:

  1. name of organization, mailing address, email address, telephone and fax numbers;
  2. description of the activities of the organization with respect to personal information received from the EU; and description of the organization’s privacy policy for such personal information, including:

    1. Where the privacy policy is available for viewing by the public,
    2. its effective date of implementation,
    3. a contact office for the handling of complaints, access requests, and any other issues arising under the Safe Harbor,

    4. the specific statutory body that has jurisdiction to hear any claims against the organization regarding possible unfair or deceptive practices and violations of laws or regulations governing privacy (and that is listed in the annex to the Principles),

    5. name of any privacy programs in which the organization is a member,
    6. method of verification (e.g. in-house, third party) (see FAQ 7: Verification) , and
    7. the independent recourse mechanism that is available to investigate unresolved complaints.

How can one establish that their Harbor privacy practices are true and those privacy practices have been implemented as represented and in accordance with the Safe Harbor Principles?

To meet the verification requirements of the Enforcement Principle, an organization may verify such attestations and assertions either through self-assessment or outside compliance reviews. Under the self-assessment approach, such verification would have to indicate that an organization’s published privacy policy regarding personal information received from the EU is accurate, comprehensive, prominently displayed, completely implemented and accessible. It would also need to indicate that its privacy policy conforms to the Safe Harbor

Qualification requirements To qualify for the Safe Harbor scheme, a US organisation has three options. It can:

  1. develop its own self-regulatory privacy policy which conforms to the Safe Harbor requirements; or
  2. join a self-regulatory privacy programme which adheres to the requirements, organised by firms such as VeriSign and TRUSTe; or
  3. be subject to a statutory or other body of law or rules which effectively achieves the same standards.

REAL example This is how verisign doing it ; i think you should think in the same lines. Their privacy statements reads the following

Verisign made the following changes to its online Privacy Statement: Reorganized discussion of cookies for greater clarity in the reasons that Verisign uses them; modified language regarding collection and use of unidentified user visits to Verisign websites and use of cookies and other tracking technologies, such as in retargeted advertising; added more clarification regarding when and how we use cookies; provided better clarity regarding retention of personal information; indicated Verisign’s EU/Swiss Safe Harbor certification; changed the company’s address in two instances

Mapping standard with safe harbor requirements In the pdf link given there is much emphasis given on the development on in-house privacy policies. The document gives one such reference to Website privacy describing how can web beacons be used to track user activities. All users of that website by known of this risk. It makes all sense.

Now, if you know about Policy framework for organizations. It works like this.

Policy ->  Standards -> Guidelines and Procedures ...

Example the framework requirements entails

"...conducting initial and periodic reviews and "seeding" (tracking unique identifiers in our site's database"

ISO-27001 control objective

A.10.10 Monitoring Objective: To detect unauthorised information processing activities

  1. A.10.10.1 Audit logging Audit logs recording user activities, exceptions, and information security events shall be produced and kept for an agreed period to assist in future investigations and access control monitoring.

  2. A.10.10.2 Monitoring system use Procedures for monitoring use of information processing facilities shall be established and the results of the monitoring activities reviewed regularly.

This is the closest requirement to control mapping you can get. The most you can do now to rhyme it more with privacy requirements is tell your DBA and security analysts to be more vigilant on all web-tag usage. Why it worked? The benefit of having standard in the first place. STANDARDS makes compliance easy:)

share|improve this answer
    
Had to delete old and write new, since previously had become comm wiki status. –  Saladin Mar 9 '13 at 20:54
add comment

EU Data Protection Directive and the EU-US Safe Harbor are privacy focused.

ISO 27001 and SSAE16/SOC1 could, but would not likely address this in the same way. ISO 27001 is focused on aligning and building in processes for information security. SSAE16/SOC1 is focused on controls which would affect financial statements, and is not intended for public distribution or government review (unless the government is a utilizing the sub service organization).

However, a SOC2/SOC3 report based on the Trust Principles can include the Privacy Principle, you can read the Privacy Principle as published by the AICPA. ISO/IEC 29100:2011 from ISO would be a standard more aligned with the EU Data Directive.

To really get a good understanding of the modern concepts of privacy, you will want to start at the Fair Information Practices Principles which were originally developed by the US in the 1970s, eventually influencing the EU Data Protection Directive, which then comes back to the US via the Safe Harbor provisions. Currently, in the US there is no overarching omnibus privacy law with this level of specificity. A good place to start your research and learning on privacy legislation is over at the IT Law Wiki on Wikia.

share|improve this answer
    
@ISO 27001 can be used to do just that. Kindly see my answer for more explanation. Control objectives as standards would normally call are laid down to provide different compliance requirements satisfaction and can be mapped accordingly. –  Saladin Mar 9 '13 at 18:23
1  
@asadz: ISO 27001 is about building an seucring an organization's internal IS management system. It is not focused on protecting those who provide information to the organization. The EU Data Directive is about protecting the privacy of individuals. The Safe Harbor framework is a set of guidelines which the US has developed for US business because of the EU Data Directive's requirements for those outside of the EU to still protect the data of EU citizens. –  Eric G Mar 9 '13 at 19:32
1  
@asadz: The ISO requirements you specify below address security event monitoring. A logging facility could implement DLP-like capabilities, but the ISO 27001 objectives you cite are about capturing security events on the system, not protecting private data. Above I have already cited the ISO standard geared specifically at security. –  Eric G Mar 9 '13 at 19:34
    
You have understood the jest of the my answer; i said i meant if you already have a standard like ISO 27001 it helps to qualify –  Saladin Mar 9 '13 at 19:35
    
I also think you are missing on the verisign article i mentioned in the article they told it explicitly that how they are monitoring the activities in order to be compliant? If you already are iso-27001 it means there is a assurance level meet because iso 27001 control objective which i have also linked talks about just the same. –  Saladin Mar 9 '13 at 19:37
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.