Which privacy engineering objective proposed by the US National Institute of Science and Technology (NIST) decreases privacy risk by ensuring that connections between individuals and their personal data are reduced?

The NIST privacy engineering objectives are designed to guide the implementation of privacy principles. Disassociability specifically aims to reduce the privacy risk of data by preventing it from being linked or associated with individuals or other data related to them. This is achieved by processing data in a way that severs the connection between the data and the individual, thereby protecting their identity and making re-identification more difficult. This objective directly addresses the scenario of reducing connections between individuals and their personal data.

B. Manageability: This objective focuses on providing individuals with control over their personal data, including its access, alteration, and deletion, not on breaking links between data and identity.
C. Minimization: This objective focuses on collecting, using, and retaining the least amount of personal data necessary for a specific purpose, which is different from disassociating the data.
D. Predictability: This objective ensures that data processing is consistent and occurs as expected by the individual, providing transparency and reliability, not reducing data-to-individual connections.

1. National Institute of Standards and Technology (NIST). (2017). NISTIR 8062: An Introduction to Privacy Engineering and Risk Management in Federal Systems. Section 2.3.1, Page 8. "Disassociability is the enabling of the processing of personal information or events without association to individuals or devices beyond the operational requirements of the system."

2. Brooks, S., Garcia, M., Lefkovitz, N., Lightman, S., & Nadeau, E. (2020). NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0. Page 4. The framework discusses how Core Functions like "Protect-P" support disassociability through data-in-transit and data-at-rest protection measures.