ISO PAS 17002:2004 pdf download Conformity assessment — Confidentiality — Principles and requirements
1 Scope
This Publicly Available Specification (PAS) contains principles and requirements for the element ofconfidentiality as it relates to conformity assessment.
lt is an internal tool for use in the lSO standards development process by lSO/CASCO working groups whenaddressing the element of confidentiality in the preparation of their documents.
This Publicly Available Specification is not a stand-alone normative document to be used directly in conformitassessment activities.
2 Normative references
The following referenced documents are indispensable for the application of this document. For datedreferences, only the edition cited applies. For undated references, the latest edition of the referenceddocument (including any amendments) applies.
ISO/IEC 17000, Conformity assessment- Vocabulary and general principles
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 17000 apply.NOTEThe use of the term “body” in this PAS means either an accreditation body or a confority assessment bodyas defined in ISO/IEC 17000.
4 Principles of confidentiality
4.1 To gain access to the information needed to conduct effective conformity assessment activities, thebody needs to provide confidence that confidential information will not be disclosed.
4.2Al organizations and individuals have the right to have protected any proprietary information that theyprovide.
4.3 Managing the balance between confidentiality and public disclosure related requirements affectsstakeholders’ trust and their perception of value in the conformity assessment activities being performed.
NOTElt is intended that there will be a separate PAS covering the common element of public disclosure.
Requirements for confidentiality
5.1General
In developing this PAS it was recognised that there are varying degrees of specificity that ISO/CASCOworking groups should consider. As a result the requirements in this clause are categorized into three levels oispecificity as follows.
a)Obligatory: these are specific drafted requirements that shall be used by ISO/CASCO working groupswhere the element has to be addressed, without modification, except for substitution of more specificterms. For example, the phrase “Conformity assessment activities shall be undertaken impartially”, maybe substituted more specifically with “Management system certification activities shall be undertakenimpartially”. Justification is required from ISO/CASCO working groups that do not use these requirementswhen dealing with the relevant common element.
Recommended: these are drafted requirements that working groups should use if they wish to have agreater degree of specification. Modification is permissible.
Suggested: these are considerations that could be taken into account in the drafting of requirements bytheISO/CASCO working group.
By providing for these different levels of specificity, the PAS achieves the lSO/CASCO intent to have anagreed statement on elements that are common to all conformity assessment activities, and at the same timemaintains some flexibility for specific wording by individual ISO/CASCO working groups.
5.2General requirements
The following requirements are obligatory
The body shall be responsible, through legally enforceable commitments, for the management of allainformation obtained or created during the performance of conformity assessment activities. The bodshall inform the client,in advance, of the information it intends to place in the public domain. Except forinformation that the client makes publicly available, or when agreed between the body and the client (e.g.for the purpose of responding to complaints), all other information is considered proprietary informationand shall be regarded as confidential.
When the body is required by law or authorized by contractual arrangements to release confidential6information, the client or individua concerned shall, unless prohibited by law, be notified of theinformation provided.
dInformation about the client obtained from sources other than the client (e.g. complainant, regulators)shall be treated as confidential.