FTC fair information practice

Last updated

The United States Commission's fair information practice principles (FIPPs) are guidelines that represent widely accepted concepts concerning fair information practice in an electronic marketplace. [1]

Contents

Introduction

FTC Fair Information Practice Principles are the result of the commission's inquiry into the way in which online entities collect and use personal information and safeguards to assure that practice is fair and provides adequate information privacy protection. [2] The FTC has been studying online privacy issues since 1995, and in its 1998 report, [3] the Commission described the widely accepted Fair Information Practice Principles of Notice, Choice, Access, and Security. [1] The commission also identified Enforcement, the use of a reliable mechanism to provide sanctions for noncompliance as a critical component of any governmental or self-regulatory program to protect online privacy. [1] [4]

History and development

Fair Information Practice was initially proposed and named [5] by the US Secretary's Advisory Committee on Automated Personal Data Systems in a 1973 report, Records, Computers and the Rights of Citizens, [6] issued in response to the growing use of automated data systems containing information about individuals. The central contribution of the Advisory Committee was the development of a code of fair information practice for automated personal data systems. The Privacy Protection Study Commission also may have contributed to the development of FIPs principles in its 1977 report, Personal Privacy in an Information Society. [7]

As privacy laws spread to other countries in Europe, international institutions took up privacy with a focus on the international implications of privacy regulation. In 1980, the Council of Europe adopted a Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data. [8] At the same time, the Organisation for Economic Cooperation and Development (OECD) proposed similar privacy guidelines in the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. [9] The OECD Guidelines, Council of Europe Convention, and European Union Data Protection Directive [10] relied on FIPs as core principles. All three organizations revised and extended the original U.S. statement of FIPs, with the OECD Privacy Guidelines being the version most often cited in subsequent years. [11]

Principles

The core principles of privacy addressed by these principles are:

1. Notice/Awareness [12] Consumers should be given notice of an entity's information practices before any personal information is collected from them. [12] This requires that companies explicitly notify some or all of the following:

2. Choice/Consent [13] Choice and consent in an on-line information-gathering sense means giving consumers options to control how their data is used. Specifically, choice relates to secondary uses of information beyond the immediate needs of the information collector to complete the consumer's transaction. The two typical types of choice models are 'opt-in' or 'opt-out.' The 'opt-in' method requires that consumers affirmatively give permission for their information to be used for other purposes. Without the consumer taking these affirmative steps in an 'opt-in' system, the information gatherer assumes that it cannot use the information for any other purpose. The 'opt-out' method requires consumers to affirmatively decline permission for other uses. Without the consumer taking these affirmative steps in an 'opt-out' system, the information gatherer assumes that it can use the consumer's information for other purposes. Each of these systems can be designed to allow an individual consumer to tailor the information gatherer's use of the information to fit their preferences by checking boxes to grant or deny permission for specific purposes rather than using a simple "all or nothing" method. [13]

3. Access/Participation [14] Access as defined in the Fair Information Practice Principles includes not only a consumer's ability to view the data collected, but also to verify and contest its accuracy. This access must be inexpensive and timely in order to be useful to the consumer. [14]

4. Integrity/Security [15] Information collectors should ensure that the data they collect is accurate and secure. They can improve the integrity of data by cross-referencing it with only reputable databases and by providing access for the consumer to verify it. Information collectors can keep their data secure by protecting against both internal and external security threats. They can limit access within their company to only necessary employees to protect against internal threats, and they can use encryption and other computer-based security systems to stop outside threats. [15]

5. Enforcement/Redress [16] In order to ensure that companies follow the Fair Information Practice Principles, there must be enforcement measures. The FTC identified three types of enforcement measures: self-regulation by the information collectors or an appointed regulatory body; private remedies that give civil causes of action for individuals whose information has been misused to sue violators; and government enforcement that can include civil and criminal penalties levied by the government. [16]

Enforcing the principles

Currently the FTC version of the Fair Information Principles are only recommendations for maintaining privacy-friendly, consumer-oriented data collection practices, and are not enforceable by law. The enforcement of and adherence to these principles is principally performed through self-regulation. The FTC has, however, undertaken efforts to evaluate industry self-regulation practices, [17] provides guidance for industry in developing information practices, [18] and uses its authority under the FTC Act to enforce promises made by corporations in their privacy policies. [19]

Since self-regulatory initiatives fall short of ideal implementation of the principles (the 2000 FTC Report noted, for example, that self-regulatory initiatives lacked meaningful monitoring and enforcement policies and practices), the Commission recommends that the United States Congress enact legislation that, in conjunction with continuing self-regulatory programs, will ensure adequate protection of consumer privacy online. [20] "The legislation recommended by the Commission would set forth a basic level of privacy protection for consumer-oriented commercial Web sites" and "would establish basic standards of practice for the collection of information online...consumer-oriented commercial Web sites that collect personal identifying information from or about consumers online... would be required to comply with the four widely-accepted fair information practices." [11]

The principles, however, form the basis of many individual laws at both the federal and state levels—called the "sectoral approach." Examples are the Fair Credit Reporting Act, the Right to Financial Privacy Act, the Electronic Communications Privacy Act, the Video Privacy Protection Act (VPPA), and the Cable Television Protection and Competition Act. [21] Additionally, the principles continue to serve as a model for privacy protections in newly developing areas, such as in designing Smart Grid programs. [22]

Other proposals regarding 'fair information'

The Organisation for Economic Co-operation and Development (OECD) and European Union, among others, have adopted more comprehensive approaches to fair information practices. The OECD principles provide added protections via the Individual Participation principle where specific requirements are made for access and modification of personally collected information by the individual and the Accountability principle (a data controller should be accountable for complying with measures which give effect to the principles stated above). [23] [24]

The European Union Data Protection Directive is another model for comprehensive privacy protections. [25] [26]

Criticism of the FTC principles

The FIPPs are criticized by some scholars for being less comprehensive in scope than privacy regimes in other countries, in particular in the European Union and other OECD countries. Additionally, the FTC's formulation of the principles has been criticized in comparison to those issued by other agencies. The FTC's 2000 version of FIPs is shorter and less complete than the privacy protection principles issued by the Privacy Office of the Department of Homeland Security in 2008, which include eight principles closely aligned with the OECD principles. [21]

Some in the privacy community criticize the FIPPs for being too weak, allowing too many exemptions, failing to require a privacy agency, failing to account for the weaknesses of self-regulation, and not keeping pace with information technology. [27] Many privacy experts have called for omnibus privacy protection legislation in the US [28] in lieu of the current blend of self-regulation and selective codification in certain sectors. [29]

Critics from a business perspective often prefer to limit FIPs to reduced elements of notice, consent, and accountability. They complain that other elements are unworkable, expensive, or inconsistent with openness or free speech principles. [11]

Some commentators argue that consumers do not have a fair say in the consent process. For example, customers provide their health information such as their social insurance number or health card number while making on-line an appointment for a dental check-up. Customers are commonly asked to sign an agreement stating that a ‘third-party may have an access to the information you provide under certain conditions.’ The certain conditions are rarely specified in any part of the agreement. Later on, the third-party may share the information with their subsidiary institutions. Thus, access to customers’ personal information is beyond their control. [30]

See also

Related Research Articles

<span class="mw-page-title-main">Children's Online Privacy Protection Act</span> American federal cyber law in 2000

The Children's Online Privacy Protection Act of 1998 (COPPA) is a United States federal law, located at 15 U.S.C. §§ 6501–6506.

Information privacy is the relationship between the collection and dissemination of data, technology, the public expectation of privacy, contextual information norms, and the legal and political issues surrounding them. It is also known as data privacy or data protection.

<span class="mw-page-title-main">Data Protection Directive</span> EU directive on the processing of personal data

The Data Protection Directive, officially Directive 95/46/EC, enacted in October 1995, was a European Union directive which regulated the processing of personal data within the European Union (EU) and the free movement of such data. The Data Protection Directive was an important component of EU privacy and human rights law.

Center for Democracy & Technology (CDT) is a Washington, D.C.–based 501(c)(3) nonprofit organisation that advocates for digital rights and freedom of expression. CDT seeks to promote legislation that enables individuals to use the internet for purposes of well-intent, while at the same time reducing its potential for harm. It advocates for transparency, accountability, and limiting the collection of personal information.

A privacy policy is a statement or legal document that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or client's data. Personal information can be anything that can be used to identify an individual, not limited to the person's name, address, date of birth, marital status, contact information, ID issue, and expiry date, financial records, credit information, medical history, where one travels, and intentions to acquire goods and services. In the case of a business, it is often a statement that declares a party's policy on how it collects, stores, and releases personal information it collects. It informs the client what specific information is collected, and whether it is kept confidential, shared with partners, or sold to other firms or enterprises. Privacy policies typically represent a broader, more generalized treatment, as opposed to data use statements, which tend to be more detailed and specific.

Personal data, also known as personal information or personally identifiable information (PII), is any information related to an identifiable person.

Information privacy, data privacy or data protection laws provide a legal framework on how to obtain, use and store data of natural persons. The various laws around the world describe the rights of natural persons to control who is using its data. This includes usually the right to get details on which data is stored, for what purpose and to request the deletion in case the purpose is not given anymore.

The International Safe Harbor Privacy Principles or Safe Harbour Privacy Principles were principles developed between 1998 and 2000 in order to prevent private organizations within the European Union or United States which store customer data from accidentally disclosing or losing personal information. They were overturned on October 6, 2015, by the European Court of Justice (ECJ), which enabled some US companies to comply with privacy laws protecting European Union and Swiss citizens. US companies storing customer data could self-certify that they adhered to 7 principles, to comply with the EU Data Protection Directive and with Swiss requirements. The US Department of Commerce developed privacy frameworks in conjunction with both the European Union and the Federal Data Protection and Information Commissioner of Switzerland.

Privacy law is the body of law that deals with the regulating, storing, and using of personally identifiable information, personal healthcare information, and financial information of individuals, which can be collected by governments, public or private organisations, or other individuals. It also applies in the commercial sector to things like trade secrets and the liability that directors, officers, and employees have when handling sensitive information.

BBB National Programs, an independent non-profit organization that oversees more than a dozen national industry self-regulation programs that provide third-party accountability and dispute resolution services to companies, including outside and in-house counsel, consumers, and others in arenas such as privacy, advertising, data collection, child-directed marketing, and more. The Center for Industry Self-Regulation (CISR) is BBB National Programs' 501(c)(3) non-profit foundation. CISR supports responsible business leaders in developing fair, future-proof best practices, and the education of the public on the conditions necessary for industry self-regulation.

<span class="mw-page-title-main">FTC regulation of behavioral advertising</span> US Regulations on Advertising Targeted by Online Activity

The United States Federal Trade Commission (FTC) has been involved in oversight of the behavioral targeting techniques used by online advertisers since the mid-1990s. These techniques, initially called "online profiling", are now referred to as "behavioral targeting"; they are used to target online behavioral advertising (OBA) to consumers based on preferences inferred from their online behavior. During the period from the mid-1990s to the present, the FTC held a series of workshops, published a number of reports, and gave numerous recommendations regarding both industry self-regulation and Federal regulation of OBA. In late 2010, the FTC proposed a legislative framework for U.S. consumer data privacy including a proposal for a "Do Not Track" mechanism. In 2011, a number of bills were introduced into the United States Congress that would regulate OBA.

In the middle of 2009 the Federal Trade Commission filed a complaint against Sears Holdings Management Corporation (SHMC) for unfair or deceptive acts or practices affecting commerce. SHMC operates the sears.com and kmart.com retail websites for Sears Holdings Corporation. As part of a marketing effort, some users of sears.com and kmart.com were invited to download an application developed for SHMC that ran in the background on users' computers collecting information on nearly all internet activity. The tracking aspects of the program were only disclosed in legalese in the middle of the End User License Agreement. The FTC found this was insufficient disclosure given consumers expectations and the detailed information being collected. On September 9, 2009 the FTC approved a consent decree with SHMC requiring full disclosure of its activities and destruction of previously obtained information.

In re Gateway Learning Corp, 138 F.T.C. 443 File No. 042-3047, was an investigatory action by the Federal Trade Commission (FTC) of the Gateway Learning Corporation, distributor of Hooked on Phonics. In its complaint, the FTC alleged that Gateway had committed both unfair and deceptive trade practices by violating the terms of its own privacy policy and making retroactive changes to its privacy policy without notifying its customers. Gateway reached a settlement with the FTC, entering into a consent decree in July 2004, before formal charges were filed.

<span class="mw-page-title-main">David Vladeck</span>

David C. Vladeck is the former director of the Bureau of Consumer Protection of the Federal Trade Commission, an independent agency of the United States government. He was appointed by the chairman of the FTC, Jon Leibowitz, on April 14, 2009, shortly after Leibowitz became chairman.

Privacy by design is an approach to systems engineering initially developed by Ann Cavoukian and formalized in a joint report on privacy-enhancing technologies by a joint team of the Information and Privacy Commissioner of Ontario (Canada), the Dutch Data Protection Authority, and the Netherlands Organisation for Applied Scientific Research in 1995. The privacy by design framework was published in 2009 and adopted by the International Assembly of Privacy Commissioners and Data Protection Authorities in 2010. Privacy by design calls for privacy to be taken into account throughout the whole engineering process. The concept is an example of value sensitive design, i.e., taking human values into account in a well-defined manner throughout the process.

A dark pattern is "a user interface that has been carefully crafted to trick users into doing things, such as buying overpriced insurance with their purchase or signing up for recurring bills". User experience designer Harry Brignull coined the neologism on 28 July 2010 with the registration of darkpatterns.org, a "pattern library with the specific goal of naming and shaming deceptive user interfaces".

The gathering of personally identifiable information (PII) is the practice of collecting public and private personal data that can be used to identify an individual for both legal and illegal applications. PII owners often view PII gathering as a threat and violation of their privacy. Meanwhile, entities such as information technology companies, governments, and organizations use PII for data analysis of consumer shopping behaviors, political preference, and personal interests.

Financial privacy laws regulate the manner in which financial institutions handle the nonpublic financial information of consumers. In the United States, financial privacy is regulated through laws enacted at the federal and state level. Federal regulations are primarily represented by the Bank Secrecy Act, Right to Financial Privacy Act, the Gramm-Leach-Bliley Act, and the Fair Credit Reporting Act. Provisions within other laws like the Credit and Debit Card Receipt Clarification Act of 2007 as well as the Electronic Funds Transfer Act also contribute to financial privacy in the United States. State regulations vary from state to state. While each state approaches financial privacy differently, they mostly draw from federal laws and provide more stringent outlines and definitions. Government agencies like the Consumer Financial Protection Bureau and the Federal Trade Commission provide enforcement for financial privacy regulations.

Privacy laws vary from state to state within the United States of America. Several states have recently passed new legislation that adapt to changes in cyber security laws, medical privacy laws, and other privacy related laws. State laws are typically extensions of existing United States federal laws, expanding them or changing the implementation of the law.

The following is a list of laws providing an overview of laws and regulations that aim to protect consumers from microtransactions.

References

  1. 1 2 3 Federal Trade Commission, Fair Information Practice Principles. Archived March 31, 2009, at the Wayback Machine
  2. ↑ "Privacy: From principles to practice". Consumer Information. 2018-05-11. Retrieved 2021-04-09.
  3. ↑ Federal Trade Commission, Privacy Online: A Report to Congress (June 1998).
  4. ↑ "Privacy Online: Fair Information Practices in the Electronic Marketplace: A Federal Trade Commission Report to Congress". Federal Trade Commission. 2000-05-01. Retrieved 2020-12-13.
  5. ↑ US Secretary's Advisory Committee on Automated Personal Data Systems, Records, Computers and the Rights of Citizens , Chapter IV: Recommended Safeguards for Administrative Personal Data Systems (1973).
  6. ↑ US Secretary's Advisory Committee on Automated Personal Data Systems, Records, Computers and the Rights of Citizens (1973).
  7. ↑ Privacy Protection Study Commission, Personal Privacy in an Information Society Archived 2008-11-27 at the Wayback Machine (July 1977).
  8. ↑ Council of Europe, Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data (Jan. 28, 1981).
  9. ↑ Organisation for Economic Cooperation and Development (OECD), OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (Sep. 23, 1980).
  10. ↑ European Union Data Protection Directive, Directive 95/46/EC http://docs.cpuc.ca.gov/published/proceedings/R0812009.htm Archived 2010-03-11 at the Wayback Machine
  11. 1 2 3 Robert Gellman, Fair Information Practices: A Basic History (Apr. 10, 2017).
  12. 1 2 3 Federal Trade Commission, Fair Information Practice Principles (FIPs), 1. Notice/Awareness. Archived March 9, 2010, at the Wayback Machine
  13. 1 2 Federal Trade Commission, Fair Information Practice Principles (FIPs), 2. Choice/Consent. Archived March 9, 2010, at the Wayback Machine
  14. 1 2 Federal Trade Commission, Fair Information Practice Principles (FIPs), 3. Access/Participation. Archived March 9, 2010, at the Wayback Machine
  15. 1 2 Federal Trade Commission, Fair Information Practice Principles (FIPs), 4. Integrity/Security. Archived March 9, 2010, at the Wayback Machine
  16. 1 2 Federal Trade Commission, Fair Information Practice Principles (FIPs), 5. Enforcement/Redress. Archived March 9, 2010, at the Wayback Machine
  17. ↑ FTC Industry Association Guidelines http://www.ftc.gov/reports/privacy3/industry.shtm#Industry%20Association%20Guidelines%20A Archived 2010-05-30 at the Wayback Machine
  18. ↑ Protecting Personal Information: A Guide for Business http://www.ftc.gov/infosecurity/
  19. ↑ Enforcing Privacy Promises: Section 5 of the FTC Act http://www.ftc.gov/privacy/privacyinitiatives/promises.html
  20. ↑ FTC 2000 Privacy Report http://www.ftc.gov/reports/privacy2000/privacy2000.pdf
  21. 1 2 Department of Homeland Security, Privacy Policy Guidance Memorandum (2008) (Memorandum Number 2008-1), https://www.dhs.gov/xlibrary/assets/privacy/privacy_policyguide_2008-01.pdf
  22. ↑ Electronic Frontier Foundation and Center for Democracy and Technology Joint Filing with the California Public Utilities Commission regarding California's Smart Grid Program. http://www.cpuc.ca.gov/EFILE/CM/114696.pdf; https://www.eff.org/deeplinks/2010/03/new-smart-meters-energy-use-put-privacy-risk
  23. ↑ Organisation for Economic Cooperation and Development (OECD), OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (Sep. 23, 1980).http://www.oecd.org/document/18/0,3343,en_2649_34255_1815186_1_1_1_1,00.html
  24. ↑ Pam Dixon, A Brief Introduction to Fair Information Practices World Privacy Forum (June 5, 2006).
  25. ↑ Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
  26. ↑ Spiros Simitis, From the Market to the Polis: The EU Directive on the Protection of Personal Data, 80 Iowa L. Rev. 445 (1995).
  27. ↑ Annecharico, David (2002). "Online Transactions: Squaring the Gramm-Leach-Bliley Act Privacy Provisions with FTC Fair Information Practice Principles". North Carolina Banking Institute. 6: 637–664.
  28. ↑ Paul M. Schwartz, Privacy and Democracy in Cyberspace, 52 Vand. L. Rev. 1609 (1999); Joel R. Reidenberg, Restoring Americans' Privacy in Electronic Commerce, 14 Berkeley Tech. L. J. 771 (1999).
  29. ↑ Examples are the Fair Credit Reporting Act, the Right to Financial Privacy Act, the Electronic Communications Privacy Act, and the Video Privacy Protection Act. Beth Givens, A Review of the Fair Information Principles : The Foundation of Privacy Public Policy Archived 2009-04-08 at the Wayback Machine (posted 1997, updated 2004).
  30. ↑ Tavani, H.T. & Bottis M. (2010, June). The consent process in medical research involving DNA databanks: some ethical implications and challenges. ACM SIGCAS Computers and Society, 40(2), 11-21. doi : 10.1145/1839994.1839996
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.