Applying Risk Management Strategies to Information Privacy Protection: A Conceptual Approach

REQUIRED) This paper examines the application of risk management strategies to the protection of customer information privacy at the corporate level of analysis. The emerging discipline of privacy risk management is virtually non-existent in academic discourse despite an expressed and growing interest by regulators and practitioners. We show how the concept and practices of operational risk management can be adapted to managing privacy risk using Generally Accepted Privacy Principles (GAPP) as an example. As well, we show how the risk response strategies, specifically avoidance, mitigation and transfer, are likewise useful. We conclude that there is congruence between risk management principles and privacy obligations and offer a series of questions for further research.