4.1 Privacy Risk Models and Frameworks: Contextual Integrity, Calo, Solove, FIPPs, OECD, NIST, and FAIR

Certified Information Privacy Technologist CIPT

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: CIPT Exam Overview and Study Plan

1.1 CIPT Exam Facts, Blueprint, and Study Plan

2 Chapter 2: The Privacy Technologist's Legal and Procedural Role

2.1 Privacy Function Roles: DPO, Data Owner, Steward, Custodian, Legal, and Security 2.2 Translating Legal and Regulatory Requirements into Technical Controls 2.3 Notices, Policies, and Oversight of Privacy Operations, Audits, and Third Parties

3 Chapter 3: Technical Responsibilities: Risk Concepts and Incident Response

3.1 Risk Concepts: Threat, Vulnerability, Attack, Exploit, and Privacy Risk 3.2 Technical Support for Privacy Incident and Breach Response

4 Chapter 4: Privacy Risk Models, Frameworks, and Threat Models

4.1 Privacy Risk Models and Frameworks: Contextual Integrity, Calo, Solove, FIPPs, OECD, NIST, and FAIR 4.2 Privacy Threat Models: LINDDUN and MITRE PANOPTIC

5 Chapter 5: Data Ethics and Automated Decision-Making

5.1 Legal Versus Ethical Processing and the Social Impact of Privacy-Affecting Designs 5.2 Identifying and Minimizing Bias in Automated Decision-Making

6 Chapter 6: Minimizing Privacy Risk During Data Collection

6.1 Notice, Consent Management, and Choice Architecture 6.2 Managing Privacy Risk in Automatic Collection and Telemetry 6.3 Extracting Personal Data from Publicly Available Sources 6.4 Data Retention, Destruction, and Cryptographic Erasure 6.5 Data Minimization Techniques 6.6 Implementing Data Processing Segregation

7 Chapter 7: Minimizing Privacy Risk During Data Use: Aggregation, PETs, and Secondary Use

7.1 Minimizing Privacy Risk from Aggregation and Inference 7.2 De-identification, Pseudonymization, and Tokenization 7.3 Microdata Protection: k-Anonymity, l-Diversity, and t-Closeness 7.4 Advanced PETs: Differential Privacy, Secure Multi-Party Computation, and Homomorphic Encryption 7.5 Secondary Use, Function Creep, and Purpose Limitation Controls

8 Chapter 8: Minimizing Privacy Risk During Dissemination

8.1 Disclosure and Accessibility Controls: APIs, Egress, and Clean Rooms 8.2 Countering Distortion, Exposure, Breach of Confidentiality, Blackmail, and Appropriation 8.3 Defense in Depth: Identity, Access Management, and Authentication

9 Chapter 9: Intrusion, Decisional Interference, and Dark Patterns

9.1 Minimizing Intrusion and Decisional Interference: Behavioral Advertising, Profiling, Cyberbullying, and Social Engineering 9.2 Dark Patterns and Deceptive Design

10 Chapter 10: Privacy Risks Related to Software Security

10.1 Detecting and Fixing Software Privacy Vulnerabilities 10.2 Intrusion Detection and Prevention, and Privacy in Change Management 10.3 Service Providers, Third-Party SDKs, and Supply Chain Risk

11 Chapter 11: Tracking and Surveillance Technologies

11.1 Privacy Risks and Impacts of E-Commerce 11.2 Audio and Video Surveillance, Wearables, and IoT 11.3 Privacy Issues Around Biometrics: Facial, Voice, Fingerprint, and DNA Data 11.4 Privacy Risks and Impacts of Location Tracking 11.5 Internet Monitoring and Web Tracking: Cookies, Fingerprinting, and GPC

12 Chapter 12: Workplace Technologies: AI, Communications, and Monitoring

12.1 Identifying and Minimizing Privacy Risks in AI, Machine Learning, and Deep Learning 12.2 Privacy Risks of Communications Technologies: Video Calls, Messaging, Mobile Devices, Social Media, and Gaming 12.3 Workplace Monitoring and BYOD Privacy

13 Chapter 13: Monitoring and Managing Privacy Risk

13.1 Privacy Audits, IT Control Reviews, KRIs, and KPIs 13.2 Completing Privacy and Data Protection Impact Assessments

14 Chapter 14: Implementing Privacy by Design

14.1 Cavoukian's Seven Foundational Principles of Privacy by Design 14.2 Privacy Goals, Objectives, and Translating High-Level Specifications into Low-Level Specifications 14.3 Hoepman's Privacy Design Strategies: Data-Oriented Strategies 14.4 Hoepman's Privacy Design Strategies: Process-Oriented Strategies

15 Chapter 15: Evaluating Privacy Risks in User Experiences

15.1 Privacy in User Experience: UX Concepts and Usability Testing 15.2 Value Sensitive Design

16 Chapter 16: Privacy Engineering Objectives, Architecture, and the Development Life Cycle

16.1 NIST Privacy Engineering Objectives: Predictability, Manageability, and Disassociability 16.2 Enterprise Architecture, Data Flow Mapping, Lineage, and Cross-Border Transfers 16.3 Managing Privacy Risk in the Software Development Life Cycle 16.4 Applying LINDDUN Threat Modeling in Engineering

17 Chapter 17: Managing and Monitoring Privacy Controls

17.1 Data Inventories, Records of Processing Activities, and Asset Discovery 17.2 Privacy Code Review and Runtime Behavior Monitoring

4.1 Privacy Risk Models and Frameworks: Contextual Integrity, Calo, Solove, FIPPs, OECD, NIST, and FAIR

Key Takeaways Explain This Topic AI

Contextual integrity holds that an information flow is appropriate only if it matches the norms of its context, described by sender, recipient, subject, information type, and transmission principle.

Ryan Calo divides privacy harm into subjective harm (the perception of unwanted observation) and objective harm (the unanticipated or coerced use of information against a person).

Solove's 2006 taxonomy groups 16 privacy problems into information collection, information processing, information dissemination, and invasions.

The 1980 OECD Guidelines (revised 2013) set eight principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation, and accountability.

The NIST Privacy Framework 1.0 organizes privacy risk management into Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P; FAIR quantifies risk from loss event frequency and loss magnitude.

Last updated: October 2026

4.1 Privacy Risk Models and Frameworks: Contextual Integrity, Calo, Solove, FIPPs, OECD, NIST, and FAIR

Quick Summary: A risk model defines what a privacy risk is (which flows or harms count), while a framework organizes how an organization finds and manages those risks. The CIPT BoK names Nissenbaum's contextual integrity, Calo's harm dimensions, FAIR, the NIST and NICE frameworks, the FIPPs, and the OECD principles. Solove's taxonomy supplies much of the BoK's own vocabulary (aggregation, exposure, blackmail, appropriation, distortion, intrusion, decisional interference). Exam questions usually describe a scenario and ask which model best explains it, or which framework function an activity belongs to.

No single model captures every privacy problem. Security has the CIA triad; privacy has several complementary lenses. Experienced technologists combine them: contextual integrity to test whether a new data flow fits expectations, Solove's taxonomy or NIST's catalog to name the specific problem, and a quantitative method such as FAIR to decide how much to spend on the fix.

Nissenbaum's Contextual Integrity

Philosopher Helen Nissenbaum introduced contextual integrity in "Privacy as Contextual Integrity" (2004) and developed it in the book Privacy in Context (2010). Its central claim is that privacy is neither pure secrecy nor pure control; it is the appropriate flow of information . Every social context (health care, employment, banking, friendship, education) has informational norms about how information should move. A flow respects privacy when it matches those norms and violates privacy when it breaks them.

A flow is described by five parameters:

• Parameter Question Example in a Health App
• Sender Who passes the information on? The patient's app
• Recipient Who receives it? The patient's physician, or an advertising network
• Subject Whom is it about? The patient
• Information type (attribute) What kind of information? Medication list

Transmission principle Under what conditions does it flow? In confidence, with consent, as required by law, in exchange for payment

The same medication list flowing from patient to physician in confidence fits health-care norms. The same list flowing to an advertising network for targeting changes the recipient and the transmission principle, so it violates contextual integrity even if the patient clicked "I agree" on a long consent screen.

Why technologists use it: contextual integrity maps directly onto data flow diagrams. Each arrow in a diagram is a flow with a sender, recipient, subject, attribute, and transmission principle, so a design review can ask, for every new arrow, which norm governs the context and whether the arrow fits it. Contextual integrity also explains why "public" data can still be private: scraping public profiles into a searchable database changes both the recipients and the transmission principle.

Evaluating a new flow: Nissenbaum's heuristic is to describe the new flow, identify the prevailing context and its norms, locate the parameters that changed, and then ask whether the change supports or undermines the values and purposes of that context. A new flow is not automatically wrong; it needs a justification grounded in the context's goals.

Calo's Subjective and Objective Privacy Harms

Law professor Ryan Calo , in "The Boundaries of Privacy Harm" ( Indiana Law Journal , 2011), argued that privacy harms fall into two related categories:

Subjective privacy harm: the perception of unwanted observation , such as anxiety, embarrassment, or the chilling effect people feel when they believe they are being watched. An employee who stops searching for health information on a work laptop because of monitoring software suffers this harm even if no one ever reads the searches.

Objective privacy harm: the unanticipated or coerced use of information concerning a person against that person , such as identity theft after a breach, a price increase driven by an inferred trait, or a job rejection based on a scraped social media post.

Calo's dimensions matter for risk assessment because many technical controls address only objective harm (for example, encryption against theft) while leaving subjective harm untouched (for example, visible, pervasive tracking). A smart speaker that never sends audio to the cloud still causes subjective harm if people believe it does, so transparency and visible hardware indicators are part of the mitigation.

Daniel Solove's Taxonomy of Privacy Harms

In 2006, legal scholar Daniel J. Solove published a landmark taxonomy that shifted the conceptualization of privacy from an abstract right to a concrete catalog of harms. Solove recognized that privacy violations do not occur in a vacuum; they arise during specific stages of data handling. The taxonomy groups 16 distinct privacy harms into four operational categories: +-----------------------------------------------------------------------------------------+

• | DANIEL SOLOVE'S TAXONOMY OF PRIVACY |
• +----------------------------+-----------------------------+------------------------------+
• | 1. Information Collection | 2. Information Processing | 3. Information Dissemination |
• | - Surveillance | - Aggregation | - Breach of Confid. |
• | - Interrogation | - Identification | - Disclosure |
• | | - Insecurity | - Exposure |
• | | - Secondary Use | - Increased Access. |
• | | - Exclusion | - Blackmail |
• | +-----------------------------+ - Appropriation |
• | | - Distortion |
• +----------------------------------------------------------+------------------------------+
• | 4. Invasions |
• | - Intrusion |
• | - Decisional Interference |
• +-----------------------------------------------------------------------------------------+
• 1. Information Collection

Surveillance: The tracking, listening to, or recording of an individual's activities, movements, or communications. In software architecture, surveillance manifests as background location beacons, session replay scripts (e.g., recording mouse movements and form inputs), and persistent device fingerprinting.

Interrogation: Pressuring an individual to disclose information through coercive form design, intrusive onboarding workflows, or mandatory data fields that have no bearing on the requested service.

2. Information Processing

Aggregation: Gathering disparate, seemingly harmless pieces of information from multiple systems to synthesize a comprehensive profile. For example, combining a user's grocery loyalty card history with their mobile fitness app steps to infer chronic health conditions.

Identification: Associating anonymized, pseudonymous, or aggregated data records back to a specific, named human being.

Insecurity: Inadequate data maintenance, weak cryptographic storage, or careless data handling that leaves personal records exposed to potential compromise.

Secondary Use: Utilizing personal data collected for an authorized primary purpose (e.g., fulfilling an e-commerce shipment) for a completely unrelated secondary purpose (e.g., training a commercial recommendation algorithm) without the subject's consent.

Exclusion: Failing to notify individuals that their data is being processed, denying them access to view their records, or barring them from correcting inaccuracies.

3. Information Dissemination

Breach of Confidentiality: Violating an explicit or implicit obligation of trust by revealing private information to unauthorized third parties.

Disclosure: Revealing truthful personal information about an individual in a manner that damages their social standing, employment, or personal relationships.

Exposure: Revealing intimate physical, medical, or emotional aspects of an individual that violates human dignity.

Increased Accessibility: Making personal data that was previously obscure or difficult to locate instantly searchable, indexable, and accessible to the public (e.g., building a reverse lookup search engine from public court filings).

Blackmail: Threatening to expose sensitive personal data to coerce an individual into performing an action.

Appropriation: Using an individual's identity, likeness, voice, or persona for another party's commercial or reputational advantage without authorization.

Distortion: Creating or disseminating inaccurate, misleading, or out-of-context representations of an individual (e.g., training a credit-scoring model on faulty data, resulting in false debt flags).

4. Invasions

Intrusion: Disrupting an individual's tranquility, private life, or home environment (e.g., intrusive push notifications, unsolicited telemarketing, invasive desktop monitoring).

Decisional Interference: Manipulating or coercing an individual's personal decision-making process through behavioral profiling, targeted micro-propaganda, or algorithmic dark patterns.

The Fair Information Practice Principles (FIPPs) and the OECD Guidelines

The Fair Information Practice Principles (FIPPs) began with a 1973 report by the U.S. Department of Health, Education, and Welfare, Records, Computers and the Rights of Citizens , and underpin the U.S. Privacy Act of 1974. Different agencies have published different lists. The U.S. Department of Homeland Security's 2008 version, for example, names eight principles: transparency, individual participation, purpose specification, data minimization, use limitation, data quality and integrity, security, and accountability and auditing . The FTC's consumer-protection version emphasizes notice, choice, access, security, and enforcement.

The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980, revised in 2013) are the most influential international statement of the same ideas, and their eight principles appear in laws worldwide:

OECD Principle Engineering Translation

Collection Limitation Collect by lawful and fair means, with knowledge or consent where appropriate; schema allowlists and minimization at ingestion

• Data Quality Keep data relevant, accurate, complete, and up to date; validation and rectification flows
• Purpose Specification State purposes no later than collection; purpose tags on fields and datasets

Use Limitation No use or disclosure beyond specified purposes without consent or legal authority; purpose-based access control

Security Safeguards Reasonable protection against loss, unauthorized access, destruction, use, modification, or disclosure

Openness Be transparent about practices and the controller's identity; accurate notices and inventories

Individual Participation People can learn what is held about them, challenge it, and have it corrected or erased; access and correction APIs

Accountability The data controller is accountable for complying; evidence, audit trails, and owners

The 2013 revision added expectations for privacy management programs , security breach notification , and stronger enforcement cooperation. When an exam option says a control "implements purpose specification" or "use limitation," it is using OECD language.

The NIST Privacy Framework

On January 16, 2020, the National Institute of Standards and Technology (NIST) published the NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management (Version 1.0) . Modeled after the NIST Cybersecurity Framework (CSF), it gives engineers, lawyers, and executives a common vocabulary for privacy risk. Version 1.0 is still the final edition: NIST released a Privacy Framework 1.1 Initial Public Draft on April 14, 2025 (comments closed June 13, 2025) to realign it with CSF 2.0 and add AI-related guidance, but as of October 2026 that revision remains a draft. The five functions below are the same in both versions.

The Five Core Functions

The framework organizes privacy activities into five core Functions:

Identify-P: Developing the organizational understanding to manage privacy risk arising from data processing. Includes inventorying systems, identifying data actions across the lifecycle, mapping legal requirements, and cataloging potential privacy harms.

Govern-P: Establishing organizational privacy governance mechanisms. Includes defining executive risk tolerances, publishing internal data governance policies, training staff, and maintaining ongoing compliance monitoring.

Control-P: Developing and implementing ongoing data management activities to enable organizations and individuals to manage personal data with granularity. Includes technical controls for data minimization, automated retention schedules, schema segregation, and data subject rights fulfillment (access, correction, erasure).

Communicate-P: Developing and implementing activities to enable organizations and individuals to understand how personal data is processed. Includes deploying transparent, just-in-time notices, verifiable consent capture, and communication channels for data subject inquiries.

Protect-P: Developing and implementing data protection safeguards to prevent cybersecurity-related privacy events (e.g., unauthorized data breaches). Includes identity management, access control, network segmentation, and encryption. +-----------------------------------------------------------------------------------------+

• | NIST PRIVACY FRAMEWORK FUNCTIONS |
• +-----------------+-----------------+-----------------+-----------------+-----------------+
• | Identify-P | Govern-P | Control-P | Communicate-P | Protect-P |
• | - Inventories | - Risk appetite | - Data mgmt | - Notices | - Encryption |
• | - Data actions | - Privacy roles | - Retention | - Consent logs | - Access control|
• | - Harm analysis | - Monitoring | - Disassociation| - Transparency | - Security ops |
• +-----------------+-----------------+-----------------+-----------------+-----------------+
• Problematic Data Actions vs. Cybersecurity Incidents

A critical distinction in the NIST Privacy Framework is the definition of privacy risk :

Cybersecurity Risk: Arises from a loss of confidentiality, integrity, or availability caused by an unauthorized event (e.g., a SQL injection vulnerability exploited by an attacker).

Privacy Risk: Can arise as a byproduct of data processing itself. NIST defines a problematic data action as "a data action that could cause an adverse effect for individuals." NIST's illustrative catalog lists nine problematic data actions (appropriation, distortion, induced disclosure, insecurity, re-identification, stigmatization, surveillance, unanticipated revelation, and unwarranted restriction) and the problems they cause: dignity loss, discrimination, economic loss, loss of self-determination (loss of autonomy, loss of liberty, physical harm), and loss of trust.

Crucially, problematic data actions frequently occur when the system operates in full compliance with security policies and without any security incident occurring.

FAIR: Quantitative Risk Analysis Applied to Privacy

Traditional enterprise risk assessments rely on qualitative "heat maps" (e.g., scoring risk as High, Medium, or Low). Qualitative matrices suffer from subjective bias, inconsistent scoring across teams, and difficulty justifying control spending to executives.

Factor Analysis of Information Risk (FAIR) is a quantitative risk ontology published as the Open Group's Open FAIR standard and promoted by the FAIR Institute. Privacy engineers, notably R. Jason Cronk and Stuart Shapiro, have adapted FAIR to privacy: the "threat event" becomes a problematic data action and the loss analysis includes the harm to individuals, not only the cost to the organization. This adaptation is often called FAIR privacy analysis.

The Structure of a FAIR Analysis

FAIR expresses risk as a probability distribution of loss over a stated period (typically one year):

Risk = Loss Event Frequency × Loss Magnitude \text{Risk} = \text{Loss Event Frequency} \times \text{Loss Magnitude} Risk = Loss Event Frequency × Loss Magnitude

Loss Event Frequency (LEF): How often a loss event is expected, derived from Threat Event Frequency (how often the triggering action occurs) and Vulnerability (the probability that the action results in loss).

Loss Magnitude (LM): How large the loss is when it happens, usually estimated as a range (minimum, most likely, maximum) and simulated.

Primary vs. Secondary Loss and the Six Forms of Loss

Open FAIR separates primary loss , which the primary stakeholder (the organization) suffers directly from the event, from secondary loss , which arises when secondary stakeholders (customers, regulators, courts, partners) react to it. It then classifies every loss into six forms of loss :

• Form of Loss Typical Privacy Example Usually Primary or Secondary
• Productivity Engineers diverted to emergency deletion work Primary

Response Forensics, legal counsel, notification letters, call centers Primary (and secondary when driven by stakeholders)

Replacement Re-issuing credentials or rebuilding a compromised data store Primary

Fines and Judgments GDPR fines (up to 4% of worldwide annual turnover or EUR 20 million), class-action settlements Secondary

• Competitive Advantage Loss of proprietary data or models Secondary
• Reputation Customers and partners leave after a privacy scandal Secondary

FAIR privacy analysis adds a step standard FAIR leaves out: it estimates the frequency and magnitude of harm to individuals (for example, using NIST's problem categories or Calo's harm dimensions), so that a processing activity that is cheap for the organization but harmful to people is not scored as "low risk." Quantified output (for example, "a 15% annual probability of a $4.2 million loss from SDK location aggregation") lets engineering leadership compare mitigation costs with expected loss.

NIST and NICE: Frameworks for Organizing People and Activities

The NIST Privacy Framework (above) organizes activities . The NICE Workforce Framework for Cybersecurity (NIST SP 800-181 Rev. 1, November 2020; its components were updated to version 2.0.0 in March 2025) organizes people : it defines work roles, competency areas, and Task, Knowledge, and Skill (TKS) statements, including roles such as privacy compliance. NIST has also been developing a Privacy Workforce Taxonomy keyed to the Privacy Framework. Together they help a privacy technologist answer "who is responsible for this control, and what skills do they need?" when building a privacy engineering program. NIST frameworks also connect to one another: the Privacy Framework shares its structure with the Cybersecurity Framework, so a single program can cover both the Protect-P outcomes and security outcomes without duplicating work.

Choosing the Right Lens on the Exam

• Scenario Cue Best-Fitting Model or Framework
• "The data moved to a new recipient under different conditions" Contextual integrity
• "Users feel watched and change their behavior" Calo's subjective harm
• "Combining datasets revealed new facts" Solove's aggregation (information processing)
• "Organize the program into functions and outcomes" NIST Privacy Framework
• "Put a dollar range on the risk" FAIR
• "Principles such as purpose specification and use limitation" OECD Guidelines / FIPPs
• "Define roles and skills for the privacy team" NICE Framework / NIST Privacy Workforce Taxonomy