Subject: IITF Privacy Working Group Request for Comments on Principles ---------------------------------------------------------------------- From: CMATTEY@ntia.doc.gov Date: Wed, 04 May 1994 14:53:26 -0400 X-Deadline: June 13, 1994! [...]this is indeed time sensitive, and we want people to have ample opportunity to review it and react. Please disseminate it however you think appropriate. I hope it is not too confusing to publicize this document after publicizing NTIA's Notice of Inquiry; people may wonder why there are two separate bodies in government examining privacy issues. Some background explanation for you: the Privacy Working Group (part of the interagency NII task force) is trying to develop a broad framework for dealing with privacy issues that span all sectors of the economy, while NTIA (the Executive branch agency specifically responsible for developing positions on telecommunications policy) is examining privacy issues affecting the telecommunications and media industries. [...] (I am involved in both efforts, as I am NTIA's representative to the interagency Privacy Working Group. As such, I obviously am trying to make sure both efforts are in sync with one another.) Feel free to contact me if you have any questions. Carol Mattey ************************************************************ The following file is posted at the request of the Information Infrastructure Task Force's Privacy Working Group, chaired by Robert Veeder, Office of Management and Budget ************************************************************ Request for Comments on the draft Principles for Providing and Using Personal Information and their Commentary. The draft Principles for Providing and Using Personal Information and the associated Commentary are the first work product of the Information Infrastructure Task Force's Working Group on Privacy. They are intended to update the Code of Fair Information Practices that was developed in the early 1970s. While many of the Code's principles are still valid, the Code itself was developed in an era when paper records were the norm. The advent of the National Information Infrastructure has caused two things to change dramatically. No longer is information usage bound by the limitations of paper -- the seamless web of networks linking us to each other is creating an interactive environment in which all of the participants must share certain responsibilities. Moreover, non-governmental usage rivals the government's, and is largely unregulated. The following Principles were developed with the goal of providing guidance to all participants in this new interactive world. The Working Group recognizes that the Principles cannot apply uniformly to all sectors. They must be carefully adapted to specific circumstances. Nevertheless, the developers believe that the responsibilities and relationships the Principles describe are basic ones. As such, they are intended to assist legislators, regulators, and companies as they develop codes of practice. The Working Group invites public comment on the Principles and Commentary. We are especially interested in understanding how the Principles would work in this new interactive electronic environment and particularly in non- governmental settings. Are they workable? How, if at all, should they be changed? We hope that those who obtain the Principles for review and comment will also share them as widely as possible with others who might be interested in them. The Comment period will close on June 13, 1994. Comments should be sent to the Working Group on Privacy c/o the NII Secretariat, National Telecommunications and Information Administration, US Department of Commerce, Room 4892, Washington, D.C. 20230. The Principles and Commentary can be downloaded from the IITF Gopher/Bulletin Board System: 202-501- 1920. The IITF Gopher/Bulletin Board can be accessed through the Internet by pointing your Gopher Client to iitf.doc.gov or by telnet to iitf.doc.gov and login as gopher. Electronic comments may be sent to nii@ntia.doc.gov. ***************************************************************** DRAFT: April 21, 1994 Principles for Providing and Using Personal Information Preamble The United States is committed to building a National Information Infrastructure (NII) to meet the information needs of its citizens. This infrastructure, essentially created by advances in technology, is expanding the level of interactivity, enhancing communication, and allowing easier access to services. As a result, many more users are discovering new, previously unimagined uses for personal information. In this environment, we are challenged to develop new principles to guide participants in the NII in the fair use of personal information. Traditional fair information practices, developed in the age of paper records, must be adapted to this new environment where information and communications are sent and received over networks on which users have very different capabilities, objectives and perspectives. Specifically, new principles must acknowledge that all members of our society (government, industry, and individual citizens), share responsibility for ensuring the fair treatment of individuals in the use of personal information, whether in paper or electronic form. Moreover, the principles should recognize that the interactive nature of the NII will empower individuals to participate in protecting information about themselves. The new principles should also make it clear that this is an active responsibility requiring openness about the process, a commitment to fairness and accountability, and continued attention to security. Finally, principles must recognize the need to educate all participants about the new information infrastructure and how it will affect their lives. These "Principles for Providing and Using Personal Information" recognize the changing roles of government and industry in information collection and use. Thus they are intended to be equally applicable to public and private entities that collect and use personal information. However, these Principles are not intended to address all information uses and protection concerns for each segment of the economy or function of government. Rather, they should provide the framework from which specialized principles can be developed. I. General Principles for the National Information Infrastructure A. Information Privacy Principle 1. Individuals are entitled to a reasonable expectation of information privacy. B. Information Integrity Principles Participants in the NII rely upon the integrity of the information it contains. It is therefore the responsibility of all participants to ensure that integrity. In particular, participants in the NII should, to the extent reasonable: 1. Ensure that information is secure, using whatever means are appropriate; 2. Ensure that information is accurate, timely, complete, and relevant for the purpose for which it is given. II. Principle for Information Collectors (i.e. entities that collect personal information directly from the individual) A. Collection Principle Before individuals make a decision to provide personal information, they need to know how it is intended to be used, how it will be protected, and what will happen if they provide or withhold the information. Therefore, collectors of this information should: 1. Tell the individual why they are collecting the information, what they expect it will be used for, what steps they will take to protect its confidentiality and integrity, the consequences of providing or withholding information, and any rights of redress. III. Principles for Information Users (i.e. Information Collectors and entities that obtain, process, send or store personal information) A. Acquisition and Use Principles Users of personal information must recognize and respect the stake individuals have in the use of personal information. Therefore, users of personal information should: 1. Assess the impact on personal privacy of current or planned activities before obtaining or using personal information; 2. Obtain and keep only information that could reasonably be expected to support current or planned activities and use the information only for those or compatible purposes; 3. Assure that personal information is as accurate, timely, complete and relevant as necessary for the intended use; B. Protection Principle Users of personal information must take reasonable steps to prevent the information they have from being disclosed or altered improperly. Such users should: 1. Use appropriate managerial and technical controls to protect the confidentiality and integrity of personal information. C. Education Principle The full effect of the NII on both data use and personal privacy is not readily apparent, and individuals may not recognize how their lives can be affected by networked information. Therefore, information users should: 1. Educate themselves, their employees, and the public about how personal information is obtained, sent, stored and protected, and how these activities affect others. D. Fairness Principles Because information is used to make decisions that affect individuals, those decisions should be fair. Information users should, as appropriate: 1. Provide individuals a reasonable means to obtain, review, and correct their own information; 2. Inform individuals about any final actions taken against them and provide individuals with means to redress harm resulting from improper use of personal information; 3. Allow individuals to limit the use of their personal information if the intended use is incompatible with the original purpose for which it was collected, unless that use is authorized by law. IV. Principles for Individuals who Provide Personal Information A. Awareness Principles While information collectors have a responsibility to tell individuals why they want information about them, individuals also have a responsibility to understand the consequences of providing personal information to others. Therefore, individuals should obtain adequate, relevant information about: 1. Planned primary and secondary uses of the information; 2. Any efforts that will be made to protect the confidentiality and integrity of the information; 3. Consequences for the individual of providing or withholding information; 4. Any rights of redress the individual has if harmed by improper use of the information. B. Redress Principles Individuals should be protected from harm resulting from inaccurate or improperly used personal information. Therefore, individuals should, as appropriate: 1. Be given means to obtain their information and be provided opportunity to correct inaccurate information that could harm them; 2. Be informed of any final actions taken against them and what information was used as a basis for the decision; 3. Have a means of redress if harmed by an improper use of their personal information. A document of IITF commentary on and detailed description of these principles is available at: ftp.eff.org, /pub/EFF/Policy/Privacy/iitf_principles.comments gopher.eff.org, 1/EFF/Policy/Privacy, iitf_principles.comments gopher://gopher.eff.org/11/EFF/Policy/Privacy, iitf_principles.comments http://www.eff.org/pub/EFF/Policy/Privacy/iitf_principles.comments