Privacy Risk List v2.0

	A	B	C	D	E	F	G	H
1	Preliminary results for the OWASP Top 10 Privacy Risks 2021
2	No.	Title	Frequency	Impact	Risk	Ranking 2014	Description	Comment
3	P1	Web Application Vulnerabilities	2	2.8	5.60	1	Vulnerability is a key problem in any system that guards or operates on sensitive user data. Failure to suitably design and implement an application, detect a problem or promptly apply a fix (patch) is likely to result in a privacy breach. This risk also encompasses the OWASP Top 10 List of web application vulnerabilities and the risks resulting from them.
4	P2	Operator-sided Data Leakage	1.92	2.8	5.38	2	Failure to prevent the leakage of any information containing or related to user data, or the data itself, to any unauthorized party resulting in loss of data confidentiality. Introduced either due to intentional malicious breach or unintentional mistake e.g. caused by insufficient access management controls, insecure storage, duplication of data or a lack of awareness.
5	P3	Insufficient Data Breach Response	2.24	2.4	5.38	3	Not informing the affected persons (data subjects) about a possible breach or data leak, resulting either from intentional or unintentional events; failure to remedy the situation by fixing the cause; not attempting to limit the leaks.
6	P4	Consent on Everything / Problems with getting Consent	2.37	2	4.74	New / 17	Aggregation or inappropriate use of consent to legitimate processing. Consent is "on everything" and not collected separately for each purpose (e.g. use of website and profiling for advertising)
7	P5	Non-transparent Policies, Agreements, Terms and Conditions	2.32	2	4.64	5	Not providing sufficient information to describing how data is processed, such as its collection, storage, and processing. Failure to make this information easily-accessible and understandable for non-lawyers.
8	P6	Insufficient Deletion of User Data	2.27	2	4.54	4	Failure to effectively and/or timely delete personal data after termination of the specified purpose or upon request.
9	P7	Insufficient Data Quality	1.89	2.4	4.54	New (formerly #8 as "Outdated personal data")	The use of outdated, incorrect or bogus user data. Failure to update or correct the data.
10	P8	Missing or Insufficient Session Expiration	1.88	2.4	4.51	9	Failure to effectively enforce session termination. May result in collection of additional user-data without the user’s consent or awareness.
11	P9	Inability of users to access and modify data	2.02	2.2	4.44	13	Users do not have the ability to access, change or delete data related to them.
12	P10	Collection of data not required for the user-consented purpose	2.17	2	4.34	6	Collecting descriptive, demographic or any other user-related data that are not needed for the purposes of the system. Applies primarily to data for which the user did not provide consent.
13	P11	Insufficient Data Structure Model to handle user rights	2.11	2	4.22	New
14	P12	Sharing of Data with 3rd Party	2.05	2	4.10	7
15	P13	Inappropriate Policies, Terms and Conditions	1.85	2.2	4.07	11
16	P14	Insecure Data Transfer	1.67	2.4	4.01	10
17	P15	Transfer or Processing through 3rd Party	2.15	1.8	3.87	12
18	P16	Misleading Content	2	1.8	3.60	16
19	P17	Collection without Consent	2.23	1.6	3.57	14
20	P18	Data Aggregation and Profiling	2.06	1.6	3.30	19
21	P19	Secondary Use	2.01	1.4	2.81	18
22	P20	Form field design issues	1.85	1	1.85	20
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100