INTERNATIONAL ISO/IEC STANDARD 19944-1 First edition 2020-10 Cloud computing and distributed platforms - Data flow, data categories and data use - Part 1: Fundamentals Informatique en nuage et plates-formes distribuees - Flux de données, categories de donneées et utilisation des donnees Partie 1: Principes de base Reference number IEC IS0/IEC 19944-1:2020(E) ISO IS0/IEC2020 IS0/IEC 19944-1:2020(E) COPYRIGHTPROTECTEDDOCUMENT @IS0/IEC2020 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either IsO at the address below or Iso's member body in the country of the requester. ISO copyright office CP 401 : Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone: +4122 749 0111 Email: [email protected] Website: www.iso.org Published in Switzerland ii @ IS0/IEC 2020 - All rights reserved IS0/IEC 19944-1:2020(E) Contents Page Foreword ..vi Introduction .vii Scope 2 Normative references. 3 Terms and definitions. .1 3.1 Terms related to data categories. 2 3.2 Terms related to cloud services and devices ecosystem 3.3 Terms related to privacy 3 3.4 Terms related to organizational data. 3.5 Terms related to artificial intelligence. 3.6 General terms. 6 4 Abbreviated terms. 6 5 Structure of this document 5.1 Document organization 1 5.2 Overview and reference architecture 5.3 Data taxonomies, data categories and data use statement structure. .7 Overview of devices and cloud services ecosystems. 1 6 6.1 Background and context - - Impact of devices and personalized cloud services. 6.2 Ecosystem of devices and cloud services.. 8 6.3 Devices and multiple user sub-roles. 9 6.3.1 General. 6.3.2 Bring your own device. .10 Extending the CCRA to the devices and cloud services ecosystem 12 7.1 Overview 12 7.2 Personal and organizational environments 12 7.3 Device impact on the CCRA: User view... 12 7.3.1 Cioud service provider. .12 7.3.2 Cloud service customer 13 7.4 Device impact on the CCRA: functional view 14 7.4.1 General. 14 7.4.2 Functional components in the functional view 15 7.4.3 Functional view: data flows. 16 8 Data taxonomy .18 8.1 Overview 18 8.2 Data categories 19 8.2.1 General. 19 8.2.2 Customer content data 20 8.2.3 Derived data. .21 8.2.4 Cloud service provider data 23 8.2.5 Account data 24 8.3 Data identification qualifiers 24 8.3.1 General. .24 8.3.2 Identified data 25 8.3.3 Pseudonymized data 25 8.3.4 Unlinked pseudonymized data 25 8.3.5 Anonymized data. 25 8.3.6 Aggregated data. 25 8.4 Orthogonal facets of data. 26 8.4.1 General. 26 8.4.2 Perspective used in the definition of data facets 28 8.4.3 Common orthogonal data facets 28 @ IS0/IEC 2020 - All rights reserved ii IS0/IEC 19944-1:2020(E) 8.4.4 Use of data facets to describe data taxonomy. .34 9 Data processing and use categories .34 9.1 Overview .34 9.2 Data processing categories. .34 9.2.1 General .34 9.2.2 Data partitioning. 35 9.2.3 Data integration. .35 9.2.4 Data fusion 36 9.2.5 Data improvement. .36 9.2.6 Encryption. 36 9.2.7 Replication 36 9.2.8 Data Deletion. .36 9.2.9 Re-identification 37 9.3 Data use categories. .37 9.3.1 General. 37 9.3.2 Provide .38 9.3.3 Improve 38 9.3.4 Personalize 39 9.3.5 Offer upgrades or upsell. 39 9.3.6 Market/advertize/promote .39 9.3.7 Share... 40 9.3.8 Collect 41 9.3.9 Train (AI system) .41 9.4 Scopes: Boundaries of collection and use of data 41 9.4.1 Scope concepts 41 9.4.2 Scopetypes 41 9.4.3 Scope characteristics. 43 9.4.4 Network connection between scopes 43 9.4.5 Control of source scope over result scope 44 10 Data use statements. .44 10.1 Overview 44 10.2 Data use statement structure 45 10.2.1 Structure definition. .45 10.2.2 Describing the scope of applications and cloud services that apply to use statements. 47 10.2.3 Assumptions about