Fill the GAPP: generally accepted privacy principles are little-known, but mighty useful.

• Author: Harden, Stuart H.
• Position: GAPPNEWS

No, it's not a misprint.

Although many CPAs have spent much of their professional life dealing with GAAP (generally accepted accounting principles), this article concerns GAPP--generally accepted privacy principles.

WHAT IS GAPP?

We are all familiar with privacy concerns: the rights and obligations of individuals and organizations with respect to the collection, use, disclosure and retention of personal information. We have all submitted personal information to organizations. We have been provided with privacy notices by organizations that collect our data and have received assurance that our personal information will be kept confidential and only shared with others in certain disclosed instances. We have been informed that we can opt not to have our information shared with others.

Still, how can we be assured that our information is safe?

Developed as a joint project of the AICPA and the Canadian Institute of Chartered Accountants, GAPP is a tool for all CPAs.

CPAs in public practice will be able to offer clients a range of services, including privacy strategic and business planning; privacy gap and risk analysis; privacy policy design and implementation; and independent verification of privacy controls, which includes attestation engagements. And CPAs in industry can enhance their value to their employers by offering privacy advisory services and performing internal assessments against something they can measure--GAPP.

UNDERLYING PRINCIPLES

There are 10 generally accepted privacy principles:

1. Management: The entity defines, documents, communicates and assigns accountability for its privacy policies and procedures.

2. Notice: The entity provides notice about its privacy policies and procedures and identifies the purposes for which personal information is collected, used, retained and disclosed.

3. Choice and Consent: The entity describes the choices available to the individual and obtains implicit or explicit consent with respect to the collection, use and disclosure of personal information.

4. Collection: The entity collects personal information only for the purposes identified in the notice.

5. Use and Retention: The entity limits the use of personal information to the purposes identified in the notice and for which the individual has provided implicit or explicit consent. The entity retains personal information for only as long as necessary to fulfill the stated purposes.

6. Access: The entity provides individuals with access to their...