A One-Page Introduction to Information Privacy
Chris Jay Hoofnagle August 2003

What is Privacy?

Privacy is difficult to define, even for strong advocates of the right. I like Robert Ellis Smith's definition from his book, Ben Franklin's Web Site: Privacy is "the desire by each of us for physical space where we can be free of interruption, intrusion, embarrassment, or accountability and the attempt to control the time and manner of disclosures of personal information about ourselves." Privacy can encompass the desire for physical autonomy from interference; control over personal information; and mental autonomy, including the freedom to consider and take decisions, and the freedom from information.

Privacy is not merely "secrecy" or something that is "non-public." In fact, individuals have expectations of privacy in information that has been disclosed or learned by others. For instance, one may tell their doctor and financial institution about medical and monetary conditions, but doing so does not make the information public, or less private.

Fair Information Practices

Privacy advocates attempt to address privacy problems through Fair Information Practices (FIPs), rules that assign rights and responsibilities to data subjects and collectors. There are eight FIPs under 1980 guidelines developed by the Organization for Economic Cooperation and Development (OECD):

· Collection Limitation Principle: Entities should minimize the collection of data to what is necessary to administer a transaction; they should obtain data lawfully, with consent of the data subject.
· Data Quality Principle: Personal data should be accurate and compete.
· Purpose Specification Principle: Individuals should be informed of the purposes for which personal data are collected.
· Use Limitation Principle: Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with the purpose specification principle.
· Security Safeguards Principle: Personal data should be protected by reasonable security safeguards.
· Openness Principle: Individuals should have notice of developments, practices and policies with respect to personal data. There should be no secret databases.
· Individual Participation Principle: Individuals should have access to their personal information, and the ability to have data erased, rectified, completed or amended.
· Accountability Principle: Data collectors should be accountable for complying with the above practices.

Looking Forward

Because of regulatory developments, I think the big privacy battle of the next ten years will focus on affiliate sharing. Under current law, companies can exploit personal information amongst affiliates with no limitations. Since we now have huge financial service companies, their ability to affiliate share presents new risk of fraud, information security, and invasions of privacy.

In the law enforcement context, government access to personal information in the hands of commercial entities will continue to be a challenge. Commercial entities warded off privacy regulation in the 1990s by claiming that they were not interested in providing information to the government. Now that they have reneged on this representation, the battle in the next decade will focus on whether private entities should have extra responsibilities on their data collection practices to protect individuals against law enforcement.

For More Information See

· Electronic Privacy Information Center: http://www.epic.org/
· Robert Ellis Smith: http://www.privacyjournal.net/
· Daniel Solove: http://law.shu.edu/faculty/fulltime_faculty/soloveda/solove.html
· Roger Clarke: http://www.anu.edu.au/people/Roger.Clarke/DV/

Reply-To: hoofnagle@epic.org
From: "hoofnagle@epic.org"
To: karim.jamal@ualberta.ca, michael-maier@uiowa.edu, shyam.sunder@yale.edu
Subject: Privacy Study / Comment
Date: Sun, 17 Aug 2003 13:06:04 -0400

Greetings Professors Jamal, Maier, and Sunder,

I recently had the opportunity to read your paper (Enforced Standards
Versus Evolution by General Acceptance), and wanted to provide some
constructive criticism. I am Chris Hoofnagle of the Electronic Privacy
Information Center.

I think that your paper relies upon some false assumptions. In
reconsidering these assumptions, you may decide to change some of the
conclusions of the paper, or adjust research methods.

First, the US does not have privacy norms that have "evolved by general
acceptance." In fact, we have a common law of privacy that is constantly
expanding as a result of a series of Federal Trade Commission complaints.
As a result of cases dating back to In Re Geocities, the US has enforced
norms that include a prohibition on materially false or deceptive claims in
privacy policies, a prohibition on omitting material uses of personal
information on the privacy policy, making false security claims, etc.
There are also some specific privacy bans that have developed as a result
of AG enforcement, such as the problem of "pre-acquired account"
telemarketing. That practice is now highly regulated as a result of fraud.
We also have the COPPA.

Second, more fundamentally, there are serious problems in the assumption
that notice is a fair information practice that promotes privacy. Notice,
specifically, is not a fair information practice. If you visit the 1980 EU
Guidelines (which you incorrectly claim has only 5, rather than 8 fair
information practices--you have cited "FIPs Lite," the FTC guidelines),
you'll see that notice derives from the "openness" principle. That
principle stands for the premise that there should be no secret databases.
It is in fact derived from American studies (the 1973 HEW report and the
Privacy Act of 1974, which requires all agencies to disclose the presence
of all databases, even if classified).

In the US, and especially in the context of 4th Amendment rights, notice is
used to *eliminate privacy.* So, when you visit an airport, the sign says
"we may search your personal belongings." This is an attempt to relieve
individuals of expectations of privacy so that they do not have a 4th
Amendment claim against those who search them.

In the context of commercial privacy policies, you'll see that one may have
more privacy without them. Your study assumes that presence of a notice is
a good thing, where in reality the notice just serves as a disclaimer.
Take for instance, the privacy policy of ticketmaster.com, which does not
allow individuals to opt-out of anything. Saying that a privacy policy
protects privacy is just like saying that a food with a nutrition
disclosure is nutritious.

As far as fair information practices go, the OECD's first, collection
limitation, is far more important than any other practice. Many of the
privacy problems we experience would be eliminated if collection were
limited to what is necessary to administer a transaction, with the consent
and knowledge of the data subject.

So, your study highlights the least important aspect of privacy, while more
or less glossing over a much more important issue—use of 3rd party cookies.
The study could have just as easily concluded that websites in the UK are
better because they are less likely to use 3rd party cookies, and when they
do employ them, they are more likely to give notice of the fact.

Third, it is a generally accepted fact that so called "web seals" are
pointless. Truste is a joke. It's been known for some time that the group
has been captured, and even if it were not, business will always private
enforcement actions (ADR) rather than a public one that is more
accountable. Robert Gellman's work in this field is necessary for an
understanding of web seal weaknesses.

Much valuable research could be done in this field. I would suggest, if
you are interested in doing more privacy work, to address the issue of
*actual* privacy practices, especially in the arena of cross-selling and
CRM within the big banks. The banks are very secretive about these
practices. I suspect that they are objectionable practices. Additionally,
the problem of customer exclusion have not received enough attention. But,
it is clearly a new trend in this field—that is, excluding customers
because they are too troublesome, or because they aren't profitable to the
company.

I hope this is helpful, and please contact me with any concerns or
questions.

Regards,
Chris Hoofnagle