It seems there is us eu safe harbour framework that is required in order to get comply and its all on choice basis. See link for more info.
Can others standards can help you achieve safe harbor compliance?
I say yes, and this is the response it says..
"ISO 27001 has a way of satisfying compliance requirements on all these various statures and regulations with just minor adjustments. It can help you comply with Safe Harbor, PCI DSS, SOX, and GLB".
To self-certify for the Safe Harbor, organizations can provide to the
Department of Commerce (or its designee) a letter – signed by a
corporate officer on behalf of the organization that is joining the
Safe Harbor – that contains at least the following information:
- name of organization, mailing address, email address, telephone and fax numbers;
description of the activities of the organization with respect to personal information received from the EU; and description of the
- its effective date of implementation,
a contact office for the handling of complaints, access requests, and any other issues arising under the Safe Harbor,
the specific statutory body that has jurisdiction to hear any claims against the organization regarding possible unfair or deceptive
practices and violations of laws or regulations governing privacy (and
that is listed in the annex to the Principles),
- name of any privacy programs in which the organization is a member,
- method of verification (e.g. in-house, third party) (see FAQ 7: Verification) , and
- the independent recourse mechanism that is available to investigate unresolved complaints.
How can one establish that their Harbor privacy practices are true and those privacy practices have been implemented as represented and in accordance with the Safe Harbor Principles?
To meet the verification requirements of the Enforcement Principle, an
organization may verify such attestations and assertions either
through self-assessment or outside compliance reviews.
personal information received from the EU is accurate, comprehensive,
prominently displayed, completely implemented and accessible. It would
To qualify for the Safe Harbor scheme, a US organisation has three options. It can:
- join a self-regulatory privacy programme which adheres to the requirements, organised by firms such as VeriSign and TRUSTe; or
- be subject to a statutory or other body of law or rules which effectively achieves the same standards.
This is how verisign doing it ; i think you should think in the same lines. Their privacy statements reads the following
Mapping standard with safe harbor requirements
In the pdf link given there is much emphasis given on the development on in-house privacy policies. The document gives one such reference to Website privacy describing how can web beacons be used to track user activities. All users of that website by known of this risk. It makes all sense.
Now, if you know about Policy framework for organizations. It works like this.
Policy -> Standards -> Guidelines and Procedures ...
Example the framework requirements entails
"...conducting initial and periodic reviews and "seeding" (tracking unique identifiers in our site's database"
ISO-27001 control objective
A.10.10 Monitoring Objective: To detect unauthorised information processing activities
A.10.10.1 Audit logging
Audit logs recording user activities, exceptions, and information security events shall be produced and kept for an agreed period to assist in future investigations and access control monitoring.
A.10.10.2 Monitoring system use
Procedures for monitoring use of information processing facilities shall be established and the results of the monitoring activities reviewed regularly.
This is the closest requirement to control mapping you can get. The most you can do now to rhyme it more with privacy requirements is tell your DBA and security analysts to be more vigilant on all web-tag usage. Why it worked? The benefit of having standard in the first place. STANDARDS makes compliance easy:)