What is the name for the privacy strategy model that describes delegated decision making?

The de-centralized privacy strategy model is defined by the delegation of decision-making authority and responsibility for privacy management to individual business units or local functions. In this structure, each unit manages its own privacy risks and compliance activities, allowing for practices tailored to its specific operational context. This contrasts with a centralized model where a single corporate office holds all authority. The core characteristic of the de-centralized approach is this distribution and delegation of control over privacy matters.

B. De-functionalized: This is not a standard or recognized term for a privacy governance model within the IAPP framework; it is an irrelevant distractor.

C. Hybrid: This model blends centralized and de-centralized elements. While it involves delegation for implementation, ultimate policy and strategy decisions often remain with a central office, so decision-making is shared, not fully delegated.

D. Matrix: This term describes a general organizational reporting structure where employees may report to both a functional and a product manager, not a specific model for privacy governance strategy.

1. Densmore

R. (2021). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). IAPP (International Association of Privacy Professionals). In Chapter 2

"Privacy Governance

" the section on "Organizational Models

Roles and Responsibilities" describes the Local or decentralized model as one where "privacy responsibilities are delegated to individuals within each business function" (p. 43).

2. Goldberg

D.

& Mulligan

D. K. (2013). On the Privacy-Promoting Properties of the Decentralized Web. University of California

Berkeley School of Information. This paper discusses the concept of decentralization in the context of privacy

reinforcing that a core attribute is the distribution and delegation of control away from a central point

which aligns with the de-centralized governance model. (See Section 2

"Decentralization").

3. Cavoukian

A. (2011). Privacy by Design: The 7 Foundational Principles. Information and Privacy Commissioner of Ontario

Canada. While not a governance model itself

the principles of PbD can be implemented through various models. The principle of "Proactive not Reactive; Preventative not Remedial" can be more effectively managed at the local level in a de-centralized model where business units have the delegated authority to build in privacy controls from the start (p. 2).