Stakeholders in information privacy and data protection

When refering to responsibilities and roles in personal information processing, many names are used for the involved stakeholders. This page introduces the important stakeholder names and concepts.

Data protection terminology

In dat protection regulation, three major stakeholder roles are commonly used:

Data subject: A natural person governed by data protection legislation whose personal data is being collected, stored and/or processed.
Data controller: An entity (often organization) that is responsible for data processing of a data subject's personal data. A data controller is in control of the processing application, and in addition has the legal relationship with the data subjects that governs provacy policies and informed data subejct consent.
Data processor: A processing entity engaged by the data controller. The processor activities are governed by and held liable against the controller.

The roles and responsibilities of controllers and processors are extensively defined in the European General Data Protection Regulation (GDPR) in chapter 1, article 4, which defines the rules for personal data processing in the European Union.

Stakeholders in business contexts

Stakeholders in privacy and data protection are those human beings or organizations involved in the processing of personal information. They represent business interests, society as a whole (societal values as well as government interests), individuals being processed, government regulators, and technology vendors. Other stakeholders may be consumer groups and activist groups.

For the sake of this course module, we focus on the stakeholders in those organizations that are responsible for digital products and services that process personal data.

OASIS defines the organizational stakeholders as:

Chief privacy officer (CPO / DPO): Manager responsible of all matters concerning privacy and data protection. Also called "DPO" - Data protection officer.
IT Architect: IT specialist designing software and systems.
Business Analyst: Business specialist developing the business aspects of an application.
Team Privacy Champion: Team specialist responsible for privacy issues.
Senior Developer: Often team leader or project leader, responsible for strategic development decisions.
Line of Business Owner: Manager responsible for operations or overall business based on application. Could be product manager, operations manager or other functions.
Legal Department: Processes legal and policy related matters, compliance documents and complaints.
Chief Information Officer: Overall responsibility for IT operations.

OASIS suggests that the organizational stakeholder responsibilities should be defined with the use of a table:

Organizational Stakeholder	Data Subjects	Applications	Personal Information	Policies	Domains	Data Flows & Touch points	Privacy Controls	Services and technical functionality
CPO
IT Architect
Business Analyst
Team Privacy Champion
Senior Developer
Line of Business Owner
Legal Departemt
Chief Information officer

Other stakeholders

Governments are stakeholders in data protection. They enact legislation that sanctions violations. They appoint, in addition, supervisory authorities such as data protection offices and consumer protection authorities that regulate societal and market forces. The near future may see the apperance of certification services and audit consultancies for privacy compliance. Non-government organizations (NGO) and activists are stakeholders that lobby governments or other stakeholders.

References

OASIS, "Annex Guide to Privacy by Design Documentation for Software Engineers v 1.0," OASIS pbd-se-annex-v1.0-cnd01, 25-Jun-2014, section 4. [link]
EU, GDPR FAQ, web page on data controllers: "Who can collect personal data?" [link], accessed 20171212
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), L 119/1, 2016. [link].

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.