Fair Information Practices: Overview and Application to the Omnibus Approach

1. Fair Information Practices Overview and Application to the Omnibus Approach

2. <ul><li>Thank you for checking out this presentation on SlideShare . </li></ul><ul><li>This presentation provides a high level overview of the Fair Information Practices and the creation of an Omnibus Privacy Law. The presentation is designed to inform lawmakers on the background and benefits of creating and Omnibus Privacy Law in the United States, as such laws already exist in other parts of the world such as the European Union. </li></ul><ul><li>This is the first of three presentations on this topic. </li></ul>Presentation Overview For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

3. Agenda <ul><li>Introduction </li></ul><ul><li>Background </li></ul><ul><li>Value of the Omnibus Approach </li></ul><ul><li>Practices in Depth </li></ul><ul><li>Conclusion </li></ul><ul><li>Questions </li></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

4. Introduction <ul><li>In order to increase privacy protections for our citizens, it becomes necessary to create a uniform set of privacy laws that apply broadly across multiple sectors </li></ul><ul><li>The current sectoral approach is limited to specific situations and does not provide general protections of citizen personal and private information </li></ul><ul><li>In order to combat cyber crime, such as identity theft and misuse of private records for discrimination, privacy laws based upon the Fair Information Practices developed by the United States in the 1970s are presently required </li></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

5. Background: What are the Fair Information Practices? <ul><li>Originally developed in 1973 by the U.S. Dep't. of Health, Education and Welfare, Secretary's Advisory Committee on Automated Personal Data Systems </li></ul><ul><li>These practices outlined in the early1970s have been enacted into law in countries throughout the world </li></ul><ul><li>It is important to remember that the practices themselves are not laws, but serve as a framework to build legislation and regulations </li></ul><ul><li>At times, the practices outlined in this report may seem to overlap, however, it is important to consider each perspective on the complete problem </li></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

6. Value of the Omnibus Approach <ul><li>Allows for standardization across sectors </li></ul><ul><ul><li>Current approaches are administered with sectoral bias </li></ul></ul><ul><ul><li>Uniform enforcement and authority across sectors </li></ul></ul><ul><ul><li>Reduces loopholes in sectors with weak administration </li></ul></ul><ul><li>Increases individual privacy protection </li></ul><ul><ul><li>Reduces unsolicited and unknown usage of private information </li></ul></ul><ul><ul><li>Allows for monitoring and correction of private information </li></ul></ul><ul><li>Uniformity with global standards </li></ul><ul><ul><li>Facilitates globalized and multinational business operations </li></ul></ul><ul><ul><li>Can help with protect citizen data outside of United States </li></ul></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

7. In Depth: Collection limitation <ul><li>Overview </li></ul><ul><ul><li>Information collected should be of a limited scope </li></ul></ul><ul><ul><li>Should be obtained with knowledge and/or consent </li></ul></ul><ul><ul><li>Collection should be obtained in a fair and legal manner </li></ul></ul><ul><li>How this protects an individual’s privacy </li></ul><ul><ul><li>Individuals are aware that their information is being collected </li></ul></ul><ul><ul><li>Individuals understand by whom this information is being obtained and for what purpose it will be used </li></ul></ul><ul><ul><li>No extraneous information is collected, which limits possible misuse or vulnerability if other safeguards are defeated </li></ul></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

8. In Depth: Data quality <ul><li>Overview </li></ul><ul><ul><li>Information obtained should only be relevant to the purpose for which is it being collected </li></ul></ul><ul><ul><li>Information should be current and accurate in relation to the purpose of the collection activities </li></ul></ul><ul><li>How this protects an individual’s privacy </li></ul><ul><ul><li>Information which is not relevant is not vulnerable to attack </li></ul></ul><ul><ul><li>Once information is outdated or is no longer relevant it will need to be removed or updated which reduces exposure </li></ul></ul><ul><ul><li>Accurate and current information ensures that fair decisions will be made over time </li></ul></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

9. In Depth: Purpose Specification <ul><li>Overview </li></ul><ul><ul><li>Purpose of collection should be disclosed prior to collection </li></ul></ul><ul><ul><li>Any changes to the original purpose should also be disclosed </li></ul></ul><ul><ul><li>Usage is limited to the purposes specified </li></ul></ul><ul><li>How this protects an individual’s privacy </li></ul><ul><ul><li>Information collected cannot later be used in some manner of which the individual does not approve or in a manner that would result in discrimination or unexpected consequences </li></ul></ul><ul><ul><li>Collection purposes and usage modifications are communicated to individuals, increasing their awareness of who has their information and for what purposes </li></ul></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

10. In Depth: Use Limitation <ul><li>Overview </li></ul><ul><ul><li>Personal information is only used for the initial purpose </li></ul></ul><ul><ul><li>Information is only reused by consent or legal authority </li></ul></ul><ul><li>How this protects an individual’s privacy </li></ul><ul><ul><li>Information cannot unknowingly be transferred to a third party </li></ul></ul><ul><ul><li>Ensures that information is not used for new purposes that arise from information collector’s new needs or motivations </li></ul></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

11. In Depth: Security Safeguards <ul><li>Overview </li></ul><ul><ul><li>Reasonable protections exist against loss, unauthorized access or disclosure, usage, and modification </li></ul></ul><ul><li>How this protects an individual’s privacy </li></ul><ul><ul><li>Users information should be protected against known attacks and methods that would breach privacy and confidentiality </li></ul></ul><ul><ul><li>Safeguards, such as access control systems also help limit accidental internal exposure that was not intended </li></ul></ul><ul><ul><li>Information is stored and transferred using secure methods to limit possible exposure or attack </li></ul></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

12. In Depth: Openness <ul><li>Overview </li></ul><ul><ul><li>Privacy practices should be public knowledge </li></ul></ul><ul><ul><li>Individuals should have easy access to practices and how their information will be used once collected </li></ul></ul><ul><li>How this protects an individual’s privacy </li></ul><ul><ul><li>Collectors of information cannot hide their practices </li></ul></ul><ul><ul><li>Privacy practices can be scrutinized by regulators </li></ul></ul><ul><ul><li>Individuals are enabled to make more informed decisions about who they should allow access to their private information and how those collectors will then use the information </li></ul></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

13. In Depth: Individual Participation <ul><li>Overview </li></ul><ul><ul><li>Individuals have the right to know what information is being collected about them and by whom </li></ul></ul><ul><ul><li>Collectors must provide easy access to information, with the ability to request corrections to the information collected </li></ul></ul><ul><ul><li>Procedures exist to challenge the denial of the above rights </li></ul></ul><ul><li>How this protects an individual’s privacy </li></ul><ul><ul><li>Ensures that records are accurate and are not misleading </li></ul></ul><ul><ul><li>Individuals have the power to stop unfair information usage </li></ul></ul><ul><ul><li>Individuals are always aware of who has what information and why they have this information </li></ul></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

14. In Depth: Accountability <ul><li>Overview </li></ul><ul><ul><li>Collectors and users of collected information are accountable to ensure the other practices are enforced </li></ul></ul><ul><ul><li>Collectors must develop practices that are in compliance </li></ul></ul><ul><li>How this protects an individual’s privacy </li></ul><ul><ul><li>Collectors are consciously aware of the requirements, they cannot claim ignorance of violating privacy rights </li></ul></ul><ul><ul><li>Collectors have a vested interest in meeting the other practices because they are ultimately responsible for any breaches of these practices </li></ul></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

15. Conclusion <ul><li>The main ideas embodied in the above practices are: </li></ul><ul><ul><li>Awareness: Individuals should know who is collecting their information, for what purpose it will be used, and how the data will be handled and protected from misuse </li></ul></ul><ul><ul><li>Consent: Information is only collected, maintained, and transferred as long as the individual provides explicit consent </li></ul></ul><ul><ul><li>Access: Individuals have the right to see what data is stored about them and to ensure that this information is accurate </li></ul></ul><ul><ul><li>Security: Personal information must be protected from unauthorized access or manipulation </li></ul></ul><ul><ul><li>Enforcement: Laws, penalties, and action must be taken to ensure holders of private information are accountable </li></ul></ul>For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman

17. <ul><li>The reference list for this presentation is shared among multiple presentations, please see the full article for this presentation available at http://www.ericgoldman.name </li></ul>References For more information please visit http://www.ericgoldman.name - Copyright 2009 Eric Goldman