Implementing Privacy Policy in Justice Information October 31, 2007 Sharing: a Technical Framework Version 1.0
Total Page:16
File Type:pdf, Size:1020Kb
Implementing Privacy Policy in Justice Information October 31, 2007 Sharing: A Technical Framework Version 1.0 Table of Contents Acknowledgements .............................................................................................................. iii Intended Audience ............................................................................................................... iv Executive Summary .............................................................................................................. v 1. Introduction and Purpose ................................................................................................ 1 1.1. Background .......................................................................................................... 1 1.2. Assumptions ......................................................................................................... 1 1.3. Scope ................................................................................................................... 2 1.4. Out of Scope ........................................................................................................ 2 1.5. Privacy Policy Requirements Overview ................................................................ 3 2. Privacy Policy Technical Requirements ........................................................................... 5 2.1. Privacy Policy Technical Framework .................................................................... 5 2.2. Privacy Policy Technical Framework Validation .................................................. 9 2.2.1. Sample Privacy Policy Analysis .............................................................. 9 2.2.2. Traffic Stop Use Case ............................................................................. 9 2.3. Privacy Policy Metadata Requirements .............................................................. 11 2.3.1. Level of Granularity for Privacy Policy ................................................. 14 2.3.2. Enterprise Readiness for Fine-Grained Privacy Policy .......................... 15 3. Industry Standards for the Privacy Policy Framework Components .............................. 17 3.1. Electronic Policy Statements .............................................................................. 17 3.1.1. Electronic Policy Metadata Requirements ............................................ 17 3.1.2. Electronic Policy Assertion Languages (PAL) ....................................... 17 3.1.3. Electronic Policy PDP/PEP Components ............................................. 18 3.2. Message Exchanges ........................................................................................... 19 3.2.1 Identity Credentials and Message Content Metadata ............................ 19 3.2.2. Message Structure ................................................................................ 19 3.3. Audit Services .................................................................................................... 19 3.4. Standards for Sharing Security and Privacy Policies .......................................... 20 4. Privacy Policy Implementation Guidelines .................................................................... 23 4.1. Privacy Policy Business Requirements Analysis.................................................. 23 4.2. Transition From Legacy Applications to Enterprise Policy Services .................... 24 4.3. Privacy Policy Development Tools ..................................................................... 30 i Implementing Privacy Policy in Justice Information October 31, 2007 Sharing: A Technical Framework Version 1.0 4.4. Mediation of Multiple Policies ............................................................................ 32 5. Global Justice Reference Architecture (JRA) and Policy Services .................................. 33 6. Summary Recommendations ........................................................................................ 39 7. Next Steps ..................................................................................................................... 41 Appendix A: Detailed Technical Privacy Requirements .................................................. 45 Appendix B: Mapping of Technical Requirements Onto the Framework ........................ 49 Appendix C: Sample Privacy Policy Analysis ................................................................. 55 Appendix D: Privacy Policy Metadata Elements ............................................................. 61 Appendix E: Assessment of Current and Emerging Technologies Relating to Privacy .... 75 Appendix F: Glossary ..................................................................................................... 87 Appendix G: References ............................................................................................... 105 ii Implementing Privacy Policy in Justice Information October 31, 2007 Sharing: A Technical Framework Version 1.0 Acknowledgements The U.S. Department of Justice’s Global Justice Information Sharing Initiative (Global) serves as a Federal Advisory Committee to the U.S. Attorney General on critical justice information sharing initiatives. Global promotes standards-based electronic information exchange to provide justice and public safety communities with timely, accurate, complete, and accessible information in a secure and trusted environment. Global is administered by the U.S. Department of Justice, Office of Justice Programs, Bureau of Justice Assistance. Global aids its member organizations and the people they serve through a series of important initiatives. These include the facilitation of Global working groups. The Global Security Working Group (GSWG1) is one of four Global working groups covering critical topics such as intelligence, privacy, security, and standards. The GSWG is under the direction of Ms. Chelle Uecker, National Association for Court Management. The Implementing Privacy Policy in Justice Information Sharing: A Technical Framework report was developed under the leadership of Mr. John Ruegg, Los Angeles County Information Systems Advisory Body. Global would also like to recognize the technical leads of the Technical Privacy Task Team for volunteering their time to the development of the Implementing Privacy Policy in Justice Information Sharing: A Technical Framework. ▪ Mr. John Ruegg—Los Angeles County Information Systems Advisory Body, Chair, GSWG Technical Privacy Task Team ▪ Mr. Joseph Alhadeff—Oracle, GSWG Technical Privacy Task Team ▪ Mr. Jim Cabral—IJIS Institute, GSWG Technical Privacy Task Team ▪ Alan Carlson, Esquire—The Justice Management Institute, GSWG Technical Privacy Task Team ▪ Mr. Scott Fairholm—National Center for State Courts, GSWG Technical Privacy Task Team ▪ Mr. Owen M. Greenspan—SEARCH, GSWG Technical Privacy Task Team ▪ Alan Harbitter, Ph.D.—IJIS Institute, GSWG Technical Privacy Task Team ▪ Erin Kenneally, Esquire—eLCHEMY, Inc., GSWG Technical Privacy Task Team ▪ Mr. Joe Mierwa—IJIS Institute, GSWG Technical Privacy Task Team ▪ Ms. Chelle Uecker—Superior Court of California, Chair, GSWG ▪ Mr. John Wandelt—Georgia Tech Research Institute, GSWG Technical Privacy Task Team 1 For more information about the GSWG efforts, please refer to the Global Web site, http://it.ojp.gov/GSWG, for official announcements. iii Implementing Privacy Policy in Justice Information October 31, 2007 Sharing: A Technical Framework Version 1.0 Intended Audience Project Managers, Architects, and Technologists This document is intended to provide guidelines for supporting the electronic expression of privacy policy and how to convert privacy policy so that it is understandable to computers and software. This report is intended as a resource for a technical audience, including Global Justice XML Data Model (GJXDM), National Information Exchange Model (NIEM), and Global Justice Reference Architecture (JRA) implementers, architects, developers, and system integrators, as well as other justice and public safety technical practitioners. iv Implementing Privacy Policy in Justice Information October 31, 2007 Sharing: A Technical Framework Version 1.0 Executive Summary As information sharing in the justice domain expands, it has become increasingly important to find ways to use technology to help implement and enforce protections of privacy, civil liberties, and civil rights. Converting privacy policy to a form understandable to computers continues to be a significant problem and a high priority for the justice community. Implementing Privacy Policy in Justice Information Sharing: A Technical Framework seeks to fill this need by exploring approaches and alternatives to resolve technical and interoperability challenges in supporting privacy policy through automation. The goal is to identify an approach and framework for protecting privacy which will be generally applicable to information sharing in the justice environment and which can be readily implemented using existing information technology architectures, standards, and software tools. Implementing Privacy Policy in Justice Information Sharing: A Technical Framework builds on the previous work of Global and other federal and state groups. It begins with a review of basic privacy policy business requirements drawn from the Global Privacy and Information Quality Working Group’s Privacy Policy Development Guide and Implementation Templates. Based on these concepts, the privacy policy technical requirements were developed, including