Law / Frameworks / NIST Privacy Framework / Control-P
NIST Privacy Framework, Control-PCT.DP-P4
System or device configurations permit selective collection or disclosure of data elements.NIST Privacy Framework, version 1.0, January 2020, CT.DP-P4
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of .
- 4
- laws
- 4
- places
- 0
- with court rulings behind them
- 0
- not yet in force
The same ground elsewhere linked through the kinds of duty both controls are mapped from
- NIST AI RMFMAP 1.6 System requirements (e.g., “the system shall respect the privacy of its users”) are...
- NIST AI RMFMAP 5.1 Likelihood and magnitude of each identified impact (both potentially beneficial and...
- NIST AI 600-1GAI-RISK-03 Dangerous, Violent, or Hateful Content
- NIST AI 600-1GAI-RISK-07 Human-AI Configuration
- OWASP Agentic Top 10ASI09 Human-Agent Trust Exploitation
- MIT mitigations2.3 Model Safety Engineering
- MIT mitigations2.4 Content Safety Controls
Sensitive categories
3 laws, 3 places| Place | Law | What it asks, as read here |
|---|---|---|
 Brazil |
LGPD, sensitive personal data and children's data |
Process a child's or adolescent's personal data only with specific, highlighted consent from at least one parent or legal guardian, except to contact the parent once without storing the data or to protect the child, and never condition participation in a game, application, or other activity on more personal data than the activity strictly needs. |
 Colorado |
SB 24-041, Protecting Minors' Online Data |
Do not collect a minor's precise geolocation data beyond what is necessary to provide the service, and do not use a design feature meant to significantly increase, sustain, or extend a minor's use of the service without consent. |
 United States |
HIPAA Privacy Rule |
Do not use or disclose protected health information except as the Privacy Rule permits or requires, and limit use and disclosure to the minimum necessary. |
Data subject rights
1 law, 1 place| Place | Law | What it asks, as read here |
|---|---|---|
 South Carolina |
South Carolina Age-Appropriate Design Code, general applicability and minor-protective design duties |
Apply default privacy settings and limit profiling, targeted advertising, and precise-geolocation collection for a known minor user, and provide parental controls. |
Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.