Confirmation Bias in the Privacy Profession: Common Misreading of the NIST Privacy
summary
Claims that many users misread the NIST Privacy Framework are supported by a review of about 40 videos and 50 articles and by pointing to concrete confusions: the framework defines 100 subcategories as outcomes not controls, it uses the word data to cover harms beyond legal “personal data”, implementation tiers measure risk sophistication not process maturity, and privacy risk is about individual harm not organizational compliance. The result: frequent mismapping of controls, metrics, and risk targets.
AI-written summary · about
chapters (8)
- 0:00Privacy community intro
- 1:13NIST Privacy Framework overview
- 3:23Confirmation bias in interpretation
- 4:28Outcomes vs controls in privacy
- 5:31Data versus personally identifiable information
- 6:55Implementation tiers vs maturity
- 7:37Privacy risk vs org risk
- 9:24Common language in privacy
related talks
40mCompliance Made Easy—Simplify Your Approach to Privacy
01h 13mBuilding Privacy Foundations Today for Tomorrow’s Tech.
16mCache-22: Doing Privacy Engineering with Privacy Standards
50mPrivacy Standards in the Context of Information Security
12mUsing Privacy Infrastructure to Kickstart AI Governance: NIST AI Risk Management Case...
01h 14mPerspective: Achieving Meaningful Privacy in Technology and Design
50mIntegrating Privacy Protections into National Security Systems
35mEmpowering Users: A Framework For Informed Consent