Fair Information Practices: Implementing In Businesses

1. Fair Information Practices Business Process Requirements for Compliance

2. <ul><li>Thank you for checking out this presentation on SlideShare </li></ul><ul><li>This presentation provides an overview of how businesses will need to adapt to requirements that would come about if an Omnibus Privacy Law was passed in the United States. It highlights the business processes that will need to be implemented in order to comply with the Fair Information Practices on which such a law would be based. </li></ul><ul><li>This is the second of three presentations on this topic </li></ul>Presentation Overview For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

3. Agenda <ul><li>Introduction </li></ul><ul><li>Meeting Compliance with Practices </li></ul><ul><li>Audit Considerations </li></ul><ul><li>Conclusion </li></ul><ul><li>Questions </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

4. Introduction <ul><li>The Fair Information Practices provide a framework of concepts which will allow your organization to safeguard the private information of your employees and customers </li></ul><ul><li>The new omnibus law will help simplify the confusion resulting from variations in current sectoral privacy laws </li></ul><ul><li>These practices are already common in other parts of the world, by complying with the new US laws you will also simplify many of your cross-border business processes </li></ul><ul><li>Failure to understand and comply with the new laws may result in fines are other enforcement action </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

5. Collection Limitation <ul><li>While traditionally an organization wanted to maximize it knowledge of an individual, this principle requires you minimize your collected records to specific purposes </li></ul><ul><li>Forms must be limited only to necessary information; For example, an online account creation form should not ask about average income unless it is directly related to the service being provided </li></ul><ul><li>Information is only collected into system where it can be accounted for and monitored. Customer information is collected through a specific form </li></ul><ul><li>Remember, usage of private information is opt-in, not opt-out. Consent is required for any data collection </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

6. Data Quality <ul><li>Information should be relevant to the stated collection purpose and should be accurate and up-to-date </li></ul><ul><li>It is your obligation to keep records updated through internal auditing and interaction with the customers; Using inaccurate information can lead to poor decision making and harm to your organization or individuals </li></ul><ul><li>You must create procedures for making sure that information is as accurate and timely as needed </li></ul><ul><li>You provide easy mechanisms for users to update information as necessary between planned updates </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

7. Purpose Specification <ul><li>You are responsible to disclose why you collect the personal information of any individual </li></ul><ul><li>Your privacy policies should explicitly state the purpose and need for the collection of specific information </li></ul><ul><li>Full disclosure is also required should your policies or terms change; “silent” updates to policies are no longer acceptable </li></ul><ul><li>Internal users must understand the specific purpose and should not use data beyond its original consented purpose </li></ul><ul><li>The purpose of collection should be reviewed, information should be removed if that purpose is no longer necessary </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

8. Use Limitation <ul><li>If information is collected for some purpose, it cannot simply be used for another process out of convenience </li></ul><ul><li>Individuals must agree to secondary usage ahead of time </li></ul><ul><li>Your organization must have a information disposal policy in order to ensure that information cannot accidently be used beyond its initial purpose </li></ul><ul><li>Implement physical or technological access controls in order to limit when and who can access information </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

9. Security Safeguards <ul><li>Data must be secured both physically and technologically </li></ul><ul><li>Individual information sets may require different safeguards and varying levels of protection </li></ul><ul><li>The safeguards you implement must provide discrete access that can later be audited; For example, individual user account and physical sign-in sheets </li></ul><ul><li>If a safeguard is breached, you are responsible to notify customers about the incident </li></ul><ul><li>Personal information is stored and transmitted using secure connections and media </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

10. Openness <ul><li>Your organization’s privacy policies and practices must be public knowledge and individuals should easily be able to learn about how you use personal information </li></ul><ul><li>It should not be difficult to find this information, and it should be written in a clear and understandable manner </li></ul><ul><li>You must provide a contact point for individuals to ask questions or seek clarifications </li></ul><ul><li>Privacy terms, conditions, policies, and usage statements must easily be obtainable by users for review </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

11. Individual Participation <ul><li>Individuals have the right to know what information you store about them and to access this information. </li></ul><ul><li>Individuals also have the right to request correction and can challenge any denial of the above rights </li></ul><ul><li>You should not make it difficult to obtain information and provide the information is a useful and readable manner </li></ul><ul><li>You should make it easy for individuals to file corrections and should record any disagreements not changed </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

12. Accountability <ul><li>Your organization is responsible to follow the other practices outlined above. You can be held responsible for failures to safeguard personal information </li></ul><ul><li>Because you are accountable, you must regularly review and revise your practices to ensure privacy protection </li></ul><ul><li>It is important to remember that under the omnibus law, ALL private data is protected, not specific subset of data </li></ul><ul><li>If your organization is large enough, you should appoint a specific individual or group to monitor and manage your organization’s privacy practices and policies </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

13. Audit Considerations <ul><li>Must be able to provide policy statements and documentation on procedures for auditor review </li></ul><ul><li>Should have clear documentation about the purpose and usage of all personal data collections </li></ul><ul><li>Must be able to demonstrate physical and technical protections of information and access controls </li></ul><ul><li>You should log when and by whom all information is collected, used, modified, and deleted </li></ul><ul><li>Take a walk in your customers shoes to ensure that all practices are in their favor and that they can in fact easily access or correct data, and find and understand policies </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

14. Conclusions <ul><li>You are responsible to ensure that both your system and employees follow the Fair Information Practices </li></ul><ul><li>An individual must opt-in to the collection of personal information and must be informed of how it will be used and how your organization’s privacy policies affect him </li></ul><ul><li>Information collection should be minimized and relegated to the specific purpose for which consent was given </li></ul><ul><li>Information must be accurate and timely, and procedures must exist to correct or challenge this information </li></ul><ul><li>If you handle private information, you are accountable for its usage and safety, as well as maintenance or disposal </li></ul>For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman

16. <ul><li>The reference list for this presentation is shared among multiple presentations, please see the full article for this presentation available at http://www.ericgoldman.name </li></ul>References For more presentations visit: http://www.ericgoldman.name - Copyright 2009 Eric Goldman