189 – Specify the purpose of data collection

Summary

The system must specify the purpose of personal data collection (OECD.9, ISACA.G31.3.), and it must do so before requesting the users consent for the collection.

Description

Applications usually request or collect personal data from their users. Such collection must be properly justified according to the legal requirements of each nation. These reasons must be accessible for the user in a clear manner, using easily understandable language and before requesting their consent for the collection and processing of data.

Supported In

Advanced: True

References

• EPRIVACY-6_4. Traffic data
• EPRIVACY-9_1. Location data other than traffic data
• GDPR-13_1-3. Information to be provided where personal data are collected from the data subject
• GDPR-14_1-4. Information to be provided where personal data have not been obtained from the data subject
• GDPR-30. Records of processing activities
• GDPR-R39. Principles of data processing
• GDPR-R40. Lawfulness of data processing
• GDPR-R45. Fulfillment of legal obligations
• SOC2-P4_1. Additional criteria for privacy (related to use, retention, and disposal)
• SOC2-P6_1. Additional criteria for privacy (related to disclosure and notification)
• CCPA-1798_100. General duties of businesses that collect personal information
• CPRA-1798-100. Right to know what personal information is being collected
• GLBA-502_A. Obligations with respect to disclosures of personal information – Notice requirements
• NYSHIELD-5575_B_6. Personal and private information
• PDPA-4_13. Consent required
• PDPA-4_14. Provision of consent
• PDPA-4_20. Notification of purpose
• POPIA-3A_13. Purpose specification - Collection for specific purpose
• PDPO-6_31. Matching procedure request
• PDPO-S1_1. Purpose and manner of collection of personal data
• HITRUST-13_a. Privacy notice
• HITRUST-13_d. Consent required
• LGPD-26. Rules
• OWASPRISKS-P4. Consent on everything
• OWASPRISKS-P10. Collection of data not required for the user-consented purpose
• ASVS-8_3_3. Sensitive private data
• SIGLITE-SL_154. Do agreements with third parties who have access or potential access to scoped data, address confidentiality, audit, security, and privacy, including but not limited to incident response, monitoring, data sharing and secure disposal of scoped data?
• SIG-P_1_5_3. Privacy
• CASA-8_3_3. Sensitive Private Data
• OWASPMASVS-PRIVACY-3. The app is transparent about data collection and usage

Weaknesses

• 088 – Privacy violation

Last updated

2024/01/18