The U.S. National Institute of Standards and Technology released Version 1.0 of its Privacy Framework on January 16, 2020, giving businesses a voluntary method for assessing how their products and services affect people’s privacy. It is not a new law or regulation. For a company handling customer data, the central distinction is practical: preventing a breach does not settle whether the company’s intended use of that data can create problems for individuals. [S1][S2]
NIST illustrates the difference with smart electricity meters. Detailed records of household electricity use can reveal behavior inside a home, even when the meters operate as intended. The framework describes the possibility that people could feel surveilled; it does not report a measured rate of harm. A security control that stops an intruder from taking those records addresses a different problem from deciding how much household activity the service should collect or reveal in the first place. [S2]
The framework organizes privacy work into five broad functions: Identify-P, Govern-P, Control-P, Communicate-P and Protect-P. They cover understanding data processing and its risks, setting organizational policies, managing data, explaining its use and applying safeguards. These are continuing activities, not five boxes that establish compliance once ticked. The approach considers data through collection, use, sharing, retention and disposal, rather than treating protection of stored records as the entire task. [S2]
For a product team, the actionable comparison is between a Current Profile and a Target Profile. In NIST’s terminology, the first records privacy outcomes already achieved; the second sets the outcomes the organization wants to achieve. Comparing them identifies gaps, an improvement plan and the staffing or funding needed. The framework allows organizations to tailor those selections to their business, risks and the needs of affected people; it does not require every organization to implement every listed activity. [S2]
Consider a hypothetical retailer planning to combine purchase records with address information for a new service. NIST’s launch notice warns that combining two types of data can make the result sensitive even if each seemed unremarkable alone. Our suggested starting point would be to document the purpose, recipients and retention period of the combined records, then specify which uses or disclosures the proposed service should restrict. The Current Profile would describe what actually happens; the Target Profile would describe the chosen outcome. Evidence that the restriction works would be more useful than merely announcing a privacy initiative. This is an illustrative application, not a reported retailer deployment or a finding that such a combination is always harmful. [S1][S2]
The same specificity matters when evaluating a supplier. NIST says Profiles can supply a prioritized list of privacy requirements for buying decisions, including comparisons where available products leave known gaps. Its separate Implementation Tiers describe an organization’s processes and resources; progression is not compulsory, and not every organization needs Tier 3 or Tier 4. NIST bases successful implementation on the outcomes in the Target Profile, not the Tier label. A company can therefore ask which required outcomes a service meets and what evidence supports that answer, without mistaking a framework label for proof that its particular data use complies with the law. [S2]
Source documents
- NIST Releases Version 1.0 of Privacy Frameworkhttps://www.nist.gov/news-events/news/2020/01/nist-releases-version-10-privacy-framework
- NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf