IBM signs on developers to help automate privacy management

"Protecting privacy is an industry-wide concern in the Middle East. IBM is constantly developing new technology to make it easier to build privacy enforcement into privacy-sensitive applications of any size," said Bashar Kilani, Manager of IBM Software Group for Middle East, Egypt and Pakistan. "Major software vendors, custom application vendors and enterprises should take an active role in automating privacy management to reduce privacy violations and reduce privacy enforcement costs."

This represents an important new capability that developers can use to build automated privacy protection into existing and new applications to help protect privacy. Automated privacy management helps companies reduce the costs of managing privacy across the enterprise, and increasing productivity of systems administration staff.

Using the two new tools -- the Reference Monitor for Tivoli Privacy Manager and Declarative Privacy Monitoring for Tivoli Privacy Manager -- developers can reduce the time and expertise needed to create new monitors for their applications.

These monitors link new and existing applications to privacy management software, allowing developers to build privacy rules and audit reporting into the applications without having to hard-code privacy functions into each individual application. By making applications "privacy aware" automatically, updating privacy policies can become easier and more manageable.

For example, a developer of Java™ 2 Enterprise Edition (J2EE) financial applications can use Declarative Privacy Monitoring for Tivoli Privacy Manager to help protect sensitive, personal financial data contained in Web-based Java applications without requiring modifications to Java code. This technology allows J2EE Web applications to be deployed to work with Tivoli Privacy Manager without having to modify the application code.

IBM Tivoli Privacy Manager monitors applications or databases and authorizes access to personal information based on business purposes defined in an XML-based privacy policy administered from a central server. When new or updated private data is submitted or updated, the monitors automatically collect consent information and create an audit trail of the access requests and directs Tivoli Privacy Manager to record information about the data submission. The application monitor collects:

• whose data is being accessed
• who is accessing the data (application and/or user)
• time that the access occurred
• whether the access complied with the policy in effect.

IBM Tivoli Privacy Manager is the industry's first automated privacy management software. Developed in conjunction with the IBM Privacy Management Advisory Council, a cross-industry team of security and privacy experts, the software provides facilities for both auditing and enforcing privacy rules while minimizing the impact to existing applications. The IBM Privacy Management Advisory Council includes the more than 25 member companies - spanning finance, healthcare, government and other industries - that help shape product design and strategic direction.