US Private Sector Privacy Chapter 01 Introductionv2.pdf

MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP CHAPTER 1 Introduction to Privacy This chapter provides an introduction to the subject of protection of information about individuals. In the United States and other countries, laws in this area are known as privacy...

MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP CHAPTER 1 Introduction to Privacy This chapter provides an introduction to the subject of protection of information about individuals. In the United States and other countries, laws in this area are known as privacy law, or sometimes data privacy or information privacy law. In the European Union (EU) and other countries, laws in this area are known as data protection law. The discussion introduces the relevant vocabulary and describes the common principles and approaches used throughout the world for information privacy and data protection. This chapter continues by providing an understanding of the legal and policy structures for privacy and data protection around the world. It then outlines key models of privacy protection: the comprehensive, sectoral, self-regulatory or co-regulatory, and technology models. 1.1 Defining Privacy In 1890, Samuel Warren and Louis Brandeis published “The Right to Privacy” in the Harvard Law Review, setting forth the essential definition of privacy as “the right to be let alone.” 1 Both fundamental and concise, this definition underscored the personal and social dimensions of the concept that would linger long after publication of this landmark essay. Similar to this U.S. experience, most other countries have historical reasons that individuals, organizations, and government bodies have proposed their own privacy definitions. International organizations have also addressed the issue of privacy. Privacy has been defined as the desire of people to freely choose the circumstances and the degree to which individuals will expose their attitudes and behavior to others. 2 It has been connected to the human personality and used as a means to protect an individual’s independence, dignity and integrity. 3 Establishing an understanding of how privacy is defined and categorized—as well as how it has emerged as a social concern—is critical to understanding data protection and privacy law as they have been established today in the United States, Europe and elsewhere around the world. 1.2 Classes of Privacy As previously discussed, privacy can be defined in many ways. When examining data protection and privacy laws and practices, it can be helpful to focus on four categories or classes of privacy. 4 1. Information privacy is concerned with establishing rules that govern the collection and handling of personal information. Examples include financial information, medical information, government records and records of a person’s activities on the internet. 2. Bodily privacy is focused on a person’s physical being and any invasion thereof. Such an invasion can take the form of genetic testing, drug testing, or body cavity searches. It also encompasses issues such as birth control, abortion and adoption. 1 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP 3. Territorial privacy is concerned with placing limits on the ability to intrude into another individual’s environment. “Environment” is not limited to the home; it may be defined as the workplace or public space. Invasion into an individual’s territorial privacy typically takes the form of monitoring such as video surveillance, ID checks, and use of similar technology and procedures. 4. Communications privacy encompasses protection of the means of correspondence, including postal mail, telephone conversations, email, and other forms of communicative behavior and apparatus. While some of these categories may interrelate, this book will focus primarily on the legal, technological and practical components of information privacy. 1.3 The Historical and Social Origins of Privacy The concept of information privacy as a social concept is rooted in some of the oldest texts and cultures. 5 Privacy is referenced numerous times in the laws of classical Greece and in the Bible. The concept of the freedom from being watched has historically been recognized by Jewish law. 6 Privacy is similarly recognized in the Qur’an and in the sayings of Mohammed, where there is discussion of the privacy of prayer as well as in the avoidance of spying or talking ill of someone behind their back. 7 The legal protection of privacy rights has a similarly far-reaching history. In England, the Justices of the Peace Act, enacted in 1361, included provisions calling for the arrest of “peeping Toms” and eavesdroppers. 8 In 1765, British Lord Camden protected the privacy of the home, striking down a warrant to enter the home and seize papers from it. He wrote, “We can safely say there is no law in this country to justify the defendants in what they have done; if there was, it would destroy all the comforts of society, for papers are often the dearest property any man can have.” 9 Parliamentarian William Pitt shared this view, declaring that “the poorest man may in his cottage bid defiance to all the force of the Crown. It may be frail: its roof may shake; the wind may blow through it; the storms may enter; the rain may enter—but the King of England cannot enter; all his forces dare not cross the threshold of the ruined tenement.” 10 This British tradition of privacy protection was built into the U.S. Constitution, ratified in 1789. Although the word privacy does not appear in the Constitution, a number of provisions relate to privacy, including the Third Amendment, banning quartering of soldiers in a person’s home; the Fourth Amendment, generally requiring a search warrant before the police can enter a home or business; the Fifth Amendment, prohibiting persons from being compelled to testify against themselves; and, later, the Fourteenth Amendment, with its requirement of due process under the law, including for intrusions into a person’s bodily autonomy. By contrast, the California Constitution contains an explicit guarantee of the right to privacy, which the people of California added to the California Constitution by a ballot measure in November 1974. Article 1, Section 1 of the California Constitution states: 2 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. 11 In many parts of the world, modern privacy has arisen within the context of human rights. In December 1948, the General Assembly of the United Nations adopted and proclaimed the Universal Declaration of Human Rights. 12 This declaration formally announced that “no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence.” 13 In 1950, the Council of Europe set forth the European Convention for the Protection of Human Rights and Fundamental Freedoms. 14 Article 8 of that Convention, which has been the subject of extensive litigation, provides that “everyone has the right to respect for his private and family life, his home and his correspondence,” with this right conditioned where necessary to protect national security and other goals, as necessary to preserve a democratic society. 15 1.4 Fair Information Practices Since the 1970s, fair information practices (FIPs), sometimes called fair information privacy practices or principles (FIPPs), have been a significant means for organizing the multiple individual rights and organizational responsibilities that exist with respect to personal information. The precise definitions of FIPs have varied over time and by geographic location; nonetheless, strong similarities exist for the major themes. In practice, there are various exceptions to the clear statements provided here and the degree to which the FIPs are legally binding. Important codifications of FIPs include: • The 1973 U.S. Department of Health, Education and Welfare Fair Information Practice Principles • The 1980 Organisation for Economic Co-operation and Development (OECD) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (“OECD Guidelines”) • The 1981 Council of Europe Convention for the Protection of Individuals with Regard to the Automatic Processing of Personal Data (“Convention 108”) • The Asia-Pacific Economic Cooperation (APEC), which in 2004 agreed to a Privacy Framework • The 2009 Madrid Resolution—International Standards on the Protection of Personal Data and Privacy 1.4.1 Overview of Fair Information Practices FIPs are guidelines for handling, storing and managing data with privacy, security and fairness in an information society that is rapidly evolving. 16 These principles can be conceived in four categories: rights of individuals, controls on the information, information life cycle and management. 1.4.1.1 Rights of Individuals With regard to the rights of individuals, organizations should address notice, choice and consent, as well as data subject access. 3 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP • Notice. Organizations should provide notice about their privacy policies and procedures and should identify the purpose for which personal information is collected, used, retained and disclosed. • Choice and consent. Organizations should describe the choices available to individuals and should get implicit or explicit consent with respect to the collection, use, retention and disclosure of personal information. Consent is often considered especially important for disclosures of personal information to other data controllers. • Data subject access. Organizations should provide individuals with access to their personal information for review and update. 1.4.1.2 Controls on the Information Regarding controls on the information, organizations should focus on information security and information quality. • Information security. Organizations should use reasonable administrative, technical and physical safeguards to protect personal information against unauthorized access, use, disclosure, modification and destruction. • Information quality. Organizations should maintain accurate, complete and relevant personal information for the purposes identified in the notice. 1.4.1.3 Information Life Cycle Organizations should address the life cycle of information, including collection, use and retention, and disclosure. • Collection. Organizations should collect personal information only for the purposes identified in the notice. • Use and retention. Organizations should limit the use of personal information to the purposes identified in the notice and for which the individual has provided implicit or explicit consent. Organizations should also retain personal information for only as long as necessary to fulfill the stated purpose. • Disclosure. Organizations should disclose personal information to third parties only for the purposes identified in the notice and with the implicit or explicit consent of the individual. 1.4.1.4 Management Regarding management, organizations should ensure that they address both management and administration as well as monitoring and enforcement. • Management and administration. Organizations should define, document, communicate and assign accountability for their privacy policies and procedures. • Monitoring and enforcement. Organizations should monitor compliance with their privacy policies and procedures and have procedures to address privacy-related complaints and disputes. 4 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP 1.4.2 U.S. Health, Education and Welfare FIPs (1973) The FIPs used widely today date back to a 1973 report by the U.S. Department of Health, Education and Welfare Advisory Committee on Automated Systems. 17 The original Code of Fair Information Practices provided: • There must be no personal data recordkeeping systems whose very existence is secret • There must be a way for a person to find out what information about the person is in a record and how it is used • There must be a way for a person to prevent information about the person that was obtained for one purpose from being used or made available for other purposes without the individual’s consent • There must be a way for a person to correct or amend a record of identifiable information about the person • Any organization creating, maintaining, using or disseminating records of identifiable personal data must assure the reliability of the data for its intended use and must take precautions to prevent misuse of the data 1.4.3 Organisation for Economic Co-operation and Development Guidelines (1980) In 1980, the OECD, an international organization that originally included the U.S. and European countries but has since expanded, published a set of privacy principles entitled “Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.” 18 The OECD Guidelines, updated in 2013, are perhaps the most widely recognized framework for FIPs and have been endorsed by the U.S. Federal Trade Commission (FTC) and many other government organizations. 19 The guidelines provide the following privacy framework: Collection Limitation Principle. There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject. Data Quality Principle. Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up to date. Purpose Specification Principle. The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfillment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose. Use Limitation Principle. Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with [the Purpose Specification Principle] except: (a) with the consent of the data subject or (b) by the authority of law. 5 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP Security Safeguards Principle. Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification or disclosure of data. Openness Principle. There should be a general policy of openness about developments, practices and policies with respect to personal data. Means should be readily available of establishing the existence and nature of personal data, and the main purposes of their use, as well as the identity and usual residence of the data controller. Individual Participation Principle. An individual should have the right: (a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him; (b) to have communicated to him, data relating to him, within a reasonable time, at a charge, if any, that is not excessive, in a reasonable manner, and in a form that is readily intelligible to him; (c) to be given reasons if a request made under subparagraphs (a) and (b) is denied, and to be able to challenge such denial; and (d) to challenge data relating to him and, if the challenge is successful to have the data erased, rectified, completed or amended. Accountability Principle. A data controller should be accountable for complying with measures which give effect to the principles stated above. 20 In 2020, the governments involved with the OECD, including the U.S., embarked on a process to formulate common principles for government access, both for law enforcement and national security purposes, to personal data held by private companies. As of the writing of this book, this OECD work is ongoing. 21 1.4.4 Council of Europe Convention (1981) In 1981, the Council of Europe passed the Convention for the Protection of Individuals with Regard to the Automatic Processing of Personal Data ("Convention 108"). This convention required member states of the Council of Europe that signed the treaty to incorporate certain data protection provisions into their domestic law. 22 Convention 108 provided for the following: • Quality of data. Data of a personal nature that is automatically processed should be obtained and stored only for specified and legitimate purposes. Data should be stored in a form that permits identification of the data subject no longer than needed for the required purpose. • Special categories of data. Unless domestic law provides appropriate safeguards, personal data revealing the following categories cannot be automatically processed: racial origin, political opinions, religious beliefs, health, sex life, or criminal convictions. • Data security. Appropriate security measures should be taken for files containing personal data. These measures must be adapted for the particular function of the file as well as for risks involved. 6 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP • Transborder data flows. When transferring data from one party of the Convention to another party, privacy concerns shall not prohibit the transborder flow of data. Exceptions to this provision include special regulations concerning certain categories of personal data. 23 The Convention was broadly similar to the OECD Guidelines, and its principles were important contributors to national data protection laws in Europe in the 1980s and 1990s. 24 In 2018, the Council of Europe adopted an update to the Convention, referred to as Convention 108+. 25 The changes brought the Convention in line with the EU’s General Data Protection Regulation (GDPR). In particular, the updates focus on necessary and proportionate requirements for data processing; obligations on controllers to provide notice when a data breach occurs; and requirements for transborder data flows. 26 As of the writing of this book, the U.S. is not expected to ratify Convention 108 or Convention 108+. 27 1.4.5 APEC Privacy Framework (2004) APEC is a multinational organization with 21 Pacific Coast members in Asia and the Americas. Unlike the EU, the APEC organization operates under nonbinding agreement. It was established in 1989 to enhance economic growth for the region. In 2003, the APEC Privacy Subgroup was established under the auspices of the Electronic Commerce Steering Group in order to develop a framework for privacy practices. This framework was designed to provide support to APEC-member economic legislation that would both protect individual interests and ensure the continued economic development of all APEC member economies. The APEC Privacy Framework was approved by the APEC ministers in 2004 and updated in 2015. 28 It contains nine information privacy principles that generally mirror the OECD Guidelines, but in some areas are more explicit about exceptions. The APEC privacy principles spelled out in the framework are: 1. Preventing Harm. Recognizing the interests of the individual to legitimate expectations of privacy, personal information protection should be designed to prevent the misuse of such information. Further, acknowledging the risk that harm may result from such misuse of personal information, specific obligations should take account of such risk and remedial measures should be proportionate to the likelihood and severity of the harm threatened by the collection, use and transfer of personal information. 2. Notice. Personal information controllers should provide clear and easily accessible statements about their practices and policies with respect to personal information that should include: a. the fact that personal information is being collected; b. the purposes for which personal information is collected; c. the types of persons or organizations to whom personal information might be disclosed; 7 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP d. the identity and location of the personal information controller, including information on how to contact it about its practices and handling of personal information; e. the choices and means the personal information controller offers individuals for limiting the use and disclosure of personal information, and for accessing and correcting it. All reasonably practicable steps shall be taken to ensure that such information is provided either before or at the time of collection of personal information. Otherwise, such information should be provided as soon after as is practicable. It may not be appropriate for personal information controllers to provide notice regarding the collection and use of publicly available information. 2. Collection Limitation. The collection of personal information should be limited to information that is relevant to the purposes of collection and any such information should be obtained by lawful and fair means, and, where appropriate, with notice to, or consent of, the individual concerned. 3. Uses of Personal Information. Personal information collected should be used only to fulfill the purposes of collection and other compatible purposes except: a. with the consent of the individual whose personal information is collected; b. when necessary to provide a service or product requested by the individual; or, c. by the authority of law and other legal instruments, proclamations and pronouncements of legal effect. 2. Choice. Where appropriate, individuals should be provided with clear, prominent, easily understandable, accessible and affordable mechanisms to exercise choice in relation to the collection, use and disclosure of their personal information. It may not be appropriate for personal information controllers to provide these mechanisms when collecting publicly available information. 3. Integrity of Personal Information. Personal information should be accurate, complete and kept up-to-date to the extent necessary for the purposes of use. 4. Security Safeguards. Personal information controllers should protect personal information that they hold with appropriate safeguards against risks, such as loss or unauthorized access to personal information, or unauthorized destruction, use, modification or disclosure of information or other misuses. Such safeguards should be proportional to the likelihood and severity of the harm threatened, the sensitivity of the information and the context in which it is held, and should be subject to periodic review and reassessment. 5. Access and Correction. Individuals should be able to: a. obtain from the personal information controller confirmation of whether or not the personal information controller holds personal information about them 8 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP b. have communicated to them, after having provided sufficient proof of their identity, personal information about them i. within a reasonable time; ii. at a charge, if any, that is not excessive; iii. in a reasonable manner; iv. in a form that is generally understandable; and, b. challenge the accuracy of information relating to them and, if possible and as appropriate, have the information rectified, completed, amended or deleted. c. such access and opportunity for correction should be provided except where: i. the burden or expense of doing so would be unreasonable or disproportionate to the risks to the individual’s privacy in the case in question; ii. the information should not be disclosed due to legal or security reasons or to protect confidential commercial information; or iii. the information privacy of persons other than the individual would be violated If a request under (a) or (b) or a challenge under (c) is denied, the individual should be provided with reasons why and be able to challenge such denial. 6. Accountability. A personal information controller should be accountable for complying with measures that give effect to the principles stated above. When personal information is to be transferred to another person or organization, whether domestically or internationally, the personal information controller should obtain the consent of the individual or exercise due diligence and take reasonable steps to ensure that the recipient person or organization will protect the information consistently with these principles. 29 In 2022, the U.S., Canada, Japan, Singapore, the Philippines, the Republic of Korea, and Chinese Taipei announced that they will establish an international certification system based on the existing APEC Cross-Border Privacy Rules and Privacy Recognition for Processors (PRP) Systems. The new approach, known as the Global Cross-Border Privacy Rules Forum (Global CGPR Forum), will technically be independent of the existing APEC framework, allowing non-APEC members to participate. 30 1.4.6 Madrid Resolution (2009) In 2009, the Madrid Resolution was approved by the independent data protection and privacy commissioners (not the governments themselves) at the annual International Conference of Data Protection and Privacy Commissioners held in Madrid, Spain. 31 There were dual purposes for the Madrid Resolution: to define a set of principles and rights guaranteeing (1) the effective and 9 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP internationally uniform protection of privacy with regard to the processing of personal data and (2) the facilitation of the international flows of personal data needed in a globalized world. The resolution has several basic principles: • Principle of lawfulness and fairness. Personal data must be fairly processed, respecting the applicable national legislation as well as the rights and freedoms of individuals. Any processing that gives rise to unlawful or arbitrary discrimination against the data subject shall be deemed unfair. • Purpose specification principle. Processing of personal data should be limited to the fulfillment of the specific, explicit and legitimate purposes of the responsible person; processing that is noncompatible with the purposes for which personal data was collected requires the unambiguous consent of the data subject. • Proportionality principle. Processing of personal data should be limited to such processing as is adequate, relevant and not excessive in relation to the purposes. Reasonable efforts should be made to limit processing to the minimum necessary. • Data quality. The responsible person should at all times ensure that personal data is accurate, sufficient and kept up to date in such a way as to fulfill the purposes for which it is processed. The period of retention of the personal data shall be limited to the minimum necessary. Personal data no longer necessary to fulfill the purposes that legitimized its processing must be deleted or rendered anonymous. • Openness principle. The responsible person shall provide to the data subjects, as a minimum, information about the responsible person’s identity, the intended purpose of processing, the recipients to whom their personal data will be disclosed, and how data subjects may exercise their rights. When data is collected directly from the data subject, this information must be provided at the time of collection, unless it has already been provided. When data is not collected directly from the data subject, the responsible person must inform them about the source of personal data. This information must be provided in an intelligible form, using clear and plain language, in particular for any processing addressed specifically to minors. • Accountability. The responsible person shall take all the necessary measures to observe the principles and obligations set out in the resolution and in the applicable national legislation and have the necessary internal mechanisms in place for demonstrating such observance both to data subjects and to the supervisory authorities in the exercise of their powers. 1.5 Information Privacy, Data Protection, and the Advent of Information Technology Modern ideas about privacy have been decisively shaped by the rapid development of information technology (IT). Mainframe computers emerged by the 1960s to handle the data processing and storage needs of business, government, educational and other institutions. As hardware and software evolved, there were clear and large benefits to individuals and society, ranging from 10 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP increased economic growth to easier communications for individuals. The unprecedented accumulation of personal data, and the resulting potential for increased surveillance, also triggered an acute interest in privacy practices and the privacy rights of individuals. A vivid image of the risk came from George Orwell’s 1949 book 1984, in which the government kept citizens under surveillance at all times, warning them with the slogan “Big Brother is watching you.” 32 To prevent the creation of “Big Brother,” by the late 1960s, nearly two decades after Orwell wrote his masterpiece, there were increasing demands for formal rules to govern the collection and handling of personal information. In response to this sort of concern, in 1970 the German state of Hesse enacted the first known modern data protection law. This German law was motivated in part by the growing potential of IT systems as well as a desire to prevent a reoccurrence of the personal information abuses that took place under Hitler’s Third Reich before and during World War II. Such concerns were not confined to Germany, and over the next decade, several European countries enacted national privacy laws of differing objectives and scope. In 1970, the United States passed its first national privacy law, the Fair Credit Reporting Act (FCRA), which focused solely on information about consumer credit. 1.6 Personal and Nonpersonal Information Because information privacy is concerned with establishing rules that govern the collection and handling of personal information, an understanding of what constitutes personal information is key. A central issue to determine is the extent to which information can be linked to a particular person. This can be contrasted with aggregate or statistical information, which generally does not raise privacy compliance issues. 1.6.1 Personal Information In the United States, the terms personal information and personally identifiable information (PII) are generally used to define the information that is covered by privacy laws. These definitions include information that makes it possible to identify an individual. Examples include names, Social Security numbers or passport numbers. The terms also include information about an “identified” or “identifiable” individual. For instance, street address, telephone number, and email address are generally considered sufficiently related to a particular person to count as identifiable information within the scope of privacy protections. The definitions generally apply to both electronic and paper records. Sensitive personal information is an important subset of personal information. The definition of what is considered sensitive varies depending on jurisdiction and particular regulations. In the United States, Social Security numbers and financial information are commonly treated as sensitive information, as are driver’s license numbers and health information. In general, sensitive information requires additional privacy and security limitations to safeguard its collection, use and disclosure. 1.6.2 Nonpersonal Information If the data elements used to identify the individual are removed, the remaining data becomes nonpersonal information, and privacy and data protection laws generally do not apply. 33 Similar terms used include deidentified or anonymized information. This type of information is frequently 11 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP used for research, statistical or aggregate purposes. “Pseudonymized” data exists where information about individuals is retained under pseudonyms, such as a unique numerical code for each person, that renders data temporarily nonpersonal. Pseudonymized data can be reversed, reidentifying the individuals. This reversibility can be important in certain situations, for instance, in a drug trial where the medicine is discovered to have adverse side effects. 34 1.6.3 The Line between Personal and Nonpersonal Information The difference between personal and nonpersonal information depends on what is identifiable. The line between these two categories is not always clear, and regulators and courts in different jurisdictions may disagree on what counts as personal information. Other Information Assets of an Organization As part of their normal activities, organizations also may collect and generate information that by its nature would not be considered personal information but is nevertheless a key part of the information assets of the organization. Examples of such information include: • Financial data • Operational data • Intellectual property • Information about the organization’s products and services Though not personal information, such information needs to be protected and secured to ensure its confidentiality. As an example of how different regimes have defined the line between personal and nonpersonal information, consider the internet protocol (IP) address, the numbers that identify the location of computers in communications over the internet. The EU generally considers IP addresses “personal data,” taking the view that IP addresses are identifiable. 35 In the United States, federal agencies operating under the Privacy Act do not consider IP addresses to be covered by the statute. 36 The FTC, an independent agency in the United States, has stated, however, that in connection with breaches of healthcare information, IP addresses are personal information. 37 For the privacy professional, it is important to check the line between personal and nonpersonal information for the appropriate regulatory regime. Assessing an Organization’s Personal Information Responsibilities The line between personal and nonpersonal information illustrates a critical first step in assessing an organization’s personal information responsibilities—determining whether the organization is covered by a law or other obligation. With globalization, information privacy professionals may need to determine when the laws of a particular jurisdiction apply. In addition, some laws apply only to particular sectors or types of information. The 12 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP Health Insurance Portability and Accountability Act (HIPAA) in the United States, for instance, applies only to certain organizations (“covered entities”) and certain information (“personal health information”). Changes in technology can also shift the line between personal and nonpersonal information. For instance, historically, IP addresses were usually “dynamic”—individuals would generally get a new IP address assigned by their internet service provider each time they logged on to the internet. Over time, more individuals have had “static” IP addresses, which stay the same for each computer device, linking the device more closely to an identifiable person. 38 The increasingly used version of the internet protocol (IPv6) employs a new numbering scheme that, by default, uses information about the computer to generate an IPv6 address, making it even easier to link devices (including smartphones) and their users. 1.7 Sources of Personal Information Sometimes the same information about an individual is treated differently based on the source of the information. To illustrate this point, consider three sources of personal information: public records, publicly available information, and nonpublic information. 1. Public records consist of information collected and maintained by a government entity and available to the public. These government entities include the national, state or provincial, and local governments. Public records laws vary considerably across jurisdictions. 39 2. Publicly available information is information that is generally available to a wide range of persons. Some traditional examples are names and addresses in telephone books and information published in newspapers or other public media. Today, search engines are a major source of publicly available information. 3. Nonpublic information is not generally available or easily accessed due to law or custom. Examples of this type of data are medical records, financial information, and adoption records. A company’s customer or employee database usually contains nonpublic information. Organizations should be alert to the possibility that the same information may be public record, publicly available, and nonpublic. For example, a name and address may be a matter of public record on a real estate deed, publicly available in the telephone book, and included in nonpublic databases, such as in a healthcare patient file. To understand how to handle the name and address, one must understand the source that provided it—restrictions may apply to use of the name and address in the patient file, but not to public records or publicly available information. 1.8 Processing Personal Information As previously introduced, almost anything that someone may do with personal information might constitute processing under privacy and data protection laws. The term processing refers to the collection, recording, organization, storage, updating or modification, retrieval, consultation, and 13 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP use of personal information. It also includes the disclosure by transmission, dissemination or making available in any other form, linking, alignment or combination, blocking, erasure, or destruction of personal information. The following common terms, first widely used in the EU, apply to data processing: • Data subject is the individual about whom information is being processed, such as the patient at a medical facility, the employee of a company, or the customer of a retail store. • Data controller is an organization that has the authority to decide how and why personal information is to be processed. This entity is the focus of most obligations under privacy and data protection laws—it controls the use of personal information by determining the purposes for its use and the manner in which the information will be processed. 40 The data controller may be an individual or an organization that is legally treated as an individual, such as a corporation or partnership. • Data processor is an individual or organization, often a third-party outsourcing service, that processes data on behalf of the data controller. Under the HIPAA medical privacy rule, these data processors are called business associates. A data controller might not have the employees or expertise in-house to do some types of activities, or might find it more efficient to get assistance from other organizations. For instance, a data controller may hire another organization to do accounting and back-office operations. The first data processor, in turn, might hire other organizations to act as data processors on its behalf, for example, if a company providing back-office operations hired a subcontractor to manage its website. Each organization in the chain—from data controller, to data processor, to any subsequent data processor acting on behalf of the first data processor—is expected to act in a trusted way, doing operations that are consistent with the direction of the data controller. The data processors are not authorized to do additional data processing outside of the scope of what is permitted for the data controller itself. 1.9 Sources of Privacy Protection There is no single approach to protecting privacy and security. Rather, privacy protection is derived from several sources: market forces, technology, legal controls, and self-regulation. • Markets. The market can be a useful way of approaching privacy protection. When consumers raise concerns about their privacy, companies respond. Businesses that are brand sensitive are especially likely to adopt strict privacy practices to build up their reputations as trustworthy organizations. In turn, this can create market competition, spurring other companies to also implement privacy practices into their operations. • Technology. Technology also can provide robust privacy protection. The rapid advancement of technology such as encryption provides people with new and advanced means of protecting themselves. Even if privacy protection from law or market forces is weak, information privacy and security best practices can remain strong. • Law. Law is the traditional approach to privacy regulation. However, simply enacting more laws does not necessarily result in better privacy and security. Laws may not be well drafted 14 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP and may be poorly enforced. Laws should be understood as one very important source of privacy protection, but in practice, actual protection also depends on markets, technology and self-regulation. • Self-regulation and co-regulation. Self-regulation (and the closely related concept of coregulation) is a complement to law that comes from the government. The term selfregulation can refer to any or all of three components: legislation, enforcement and adjudication. Legislation refers to the question of who defines privacy rules. For selfregulation, this typically occurs through the privacy policy of a company or other entity, or by an industry association. Enforcement refers to the question of who should initiate enforcement action. Actions may be brought by data protection authorities (DPAs), other government agencies, industry code enforcement, or, in some cases, the affected individuals. Finally, adjudication refers to the question of who should decide whether an organization has violated a privacy rule. The decision-maker can be an industry association, a government agency, or a judicial officer. Thus, the term self-regulation covers a broad range of institutional arrangements. For a clear understanding of data privacy responsibilities, privacy professionals should consider who defines the requirements, which organization brings enforcement action, and who actually makes the judicial decisions. 1.10 World Models of Data Protection As of the writing of this book, more than 160 countries have privacy or data protection regimes, and more than half of them first enacted such laws after the year 2000. 41 In varying degrees, the different data protection models around the world all draw upon law, markets, technology and selfregulation as sources for privacy protection. 42 Comprehensive data protection laws are those in which the government has defined requirements throughout the economy. On the other hand, sectoral laws, such as those in the United States, exist in selected market segments, often in response to a particular need or problem. The scope of data protection laws, as described above, varies depending on how much the specific country relies on government laws versus industry codes and standards. The various data protection models used globally also differ in enforcement and adjudication. However, each regime falls along a continuum, with clearly defined legislative, enforcement and adjudication mechanisms established by the government at one end and no stated, defined baseline at the other. In practice, no regime is so comprehensive that all laws are written, enforced and adjudicated by the government. Even in the United States, however, which is often used as an example of a less regulatory-oriented regime, the government has written numerous privacy laws. Some of the most common data protection models in use today are comprehensive and sectoral frameworks, co-regulatory or self-regulatory models, and the technology-based model. Following are the basic approaches, along with major arguments for and against each approach. 1.10.1 Comprehensive Model Comprehensive data protection laws govern the collection, use and dissemination of personal information in the public and private sectors. 43 Generally speaking, a country that has enacted such laws hosts an official or agency responsible for overseeing enforcement. 44 This official or agency, 15 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP often referred to as a DPA in Europe, ensures compliance with the law and investigates alleged breaches of the law’s provisions. In many countries, the official also bears responsibility for educating the public on data protection matters and acts as an international liaison for data protection issues. Enforcement and funding are two critical issues in a comprehensive data protection scheme. Data protection officials are granted varying degrees of enforcement power from country to country. Further, countries choose to allocate varying levels of resources to the enforcement of data protection laws, leaving some countries inadequately funded to meet the laws’ stated goals. Over time, countries have adopted comprehensive privacy and data protection laws for a combination of at least three reasons: 45 1. Remedy past injustices. A number of countries, particularly those previously subject to authoritarian regimes, have enacted comprehensive laws as a means to remedy past privacy violations. For instance, Germany is widely regarded as having one of the strictest privacy regimes. At least part of the reason is likely a reaction to its history during the Nazi regime and under the heavy surveillance by the Stasi (Ministry of State Security) in East Germany before the two parts of Germany were reunified in 1990. 2. Ensure consistency with European privacy laws. As discussed later in the book, the General Data Protection Regulation (GDPR) in the EU limits transfer of personal data to countries that lack “adequate” privacy protections. 46 Some countries passed privacy laws as part of the process of joining the EU. Other countries have enacted privacy laws at least in part to prevent any disruption in trade with EU countries. 3. Promote electronic commerce. Countries have developed privacy laws to provide assurance to potentially uneasy consumers engaged in electronic commerce. Critics of the comprehensive approach express concern that the costs of the regulations can outweigh the benefits. One-size-fits-all rules may not address risk well. If the rules are strict enough to ensure protection for especially sensitive data, such as medical data or information that can lead to identity theft, that same level of strictness may not be justified for less sensitive data. Along with the strictness of controls, comprehensive approaches can involve costly paperwork, documentation, audit and similar requirements even for settings where the risks are low. A different critique of comprehensive regimes is that they may provide insufficient opportunity for innovation in data processing. With the continued evolution of IT, individuals have access today to many products and services that were unimaginable a decade or two ago, from smartphones to social networks and the full range of services that have developed since the internet emerged in the 1990s. To the extent that comprehensive laws may discourage the emergence of new services involving personal information or require prior approval from regulators, the pace and diversity of technological innovation may slow. 1.10.2 Sectoral Model (United States) This framework protects personal information by enacting laws that address a particular industry sector. 47 For example, in the United States, different laws delineate conduct and specify the requisite level of data protection for video rental records, consumer financial transactions, credit 16 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP records, law enforcement, and medical records. In a comprehensive model, laws addressing specific market segments may be enacted to provide more specific protection for data particular to that segment, such as the healthcare sector. Supporters of the sectoral approach emphasize that different parts of the economy face different privacy and security challenges; it is appropriate, for instance, to have stricter regulation for medical records than for ordinary commerce. Supporters also underscore the cost savings and lack of regulatory burden for organizations outside of the regulated sectors. Critics of the sectoral approach express concern about the lack of a single DPA to oversee personal information issues. They also point out the problems of gaps and overlaps in coverage. Gaps can occur when legislation lags technological change, and unregulated segments may suddenly face privacy threats with no legislative guidance. Whereas laws under the comprehensive approach apply to new technologies, there are no similar governmental rules under the sectoral approach until the legislature or other responsible body acts. As a recent example, drones are becoming more common in the United States, but there have not been any national privacy rules governing surveillance by drones. Moreover, there can be political obstacles to creating new legislation if industry or other stakeholders oppose such laws. An example of a gap being filled is the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, which introduced a breach notification requirement for vendors of personal health records. These were not “covered entities” under HIPAA. The new law addressed a gap, where entities not traditionally involved in healthcare offered services involving the collection and use of large volumes of healthcare information. Similarly, overlaps can exist in a sectoral approach. For instance, HIPAA-covered entities such as medical healthcare providers are subject to enforcement either by the U.S. Department of Health and Human Services (HHS) under HIPAA or by the FTC under its general authority to take action against unfair and deceptive practices. As the boundaries between industries change over time, previously separate industries can converge, potentially leading to different legal treatment of functionally similar activities. 1.10.3 The Co-Regulatory and Self-Regulatory Models Co-regulation and self-regulation are quite similar, with co-regulation generally referring to laws such as those in Australia, 48 which are closer to the comprehensive model, and self-regulation generally referring to approaches such as those in the United States, where there are no general laws applying to personal information. 49 Under both approaches, a mix of government and nongovernment institutions protects personal information. The co-regulatory model emphasizes industry development of enforceable codes or standards for privacy and data protection against the backdrop of legal requirements by the government. Coregulation can exist under both comprehensive and sectoral models. One U.S. example is the Children’s Online Privacy Protection Act (COPPA) in the United States, which allows compliance with codes to be sufficient for compliance with the statute once the codes have been approved by the FTC. The self-regulatory model emphasizes creation of codes of practice for the protection of personal information by a company, industry or independent body. In contrast to the co-regulatory model, there may be no generally applicable data protection law that creates a legal framework for 17 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class. MGT 6727 (Spring Semester 2024) at Georgia Tech Chapter 1 – as of 01/05/2024 © IAPP the self-regulatory code. 50 A prominent example that affects the wide range of businesses that process credit card data is the Payment Card Industry Data Security Standard (PCI DSS), which enhances cardholder data security and facilitates the broad adoption of consistent data security measures globally. Seal programs are another form of self-regulation. A seal program requires its participants to abide by codes of information practices and submit to some variation of monitoring to ensure compliance. 51 Companies that abide by the terms of the seal program are then allowed to display the program’s privacy seal on their website. Seal programs recognized by the FTC for the COPPA are Aristotle International Inc., Children’s Advertising Review Unit (CARU), Entertainment Software Rating Board (ESRB), iKeepSafe, kidSAFE, PRIVO, and TrustArc (formerly TRUSTe). 52 Supporters of a self-regulatory approach tend to emphasize the expertise of the industry to inform its own personal information practices, and thus use the most efficient ways to ensure privacy and security. 53 Self-regulatory codes may also be more flexible and quick to adjust to new technology without the need for prior governmental approval. Critics of the self-regulatory approach often express concerns about adequacy and enforcement. Industry-developed codes can provide limited data protection and may not adequately incorporate the perspectives and interests of consumers and other stakeholders who are not part of the industry. The strength of enforcement can also vary. In some cases, where an organization has signed up for a code, any violation is treated just like a violation of a statute. In others, however, penalties can be weak, and there may be no effective enforcement authority. An alternative to the protections that arise from an organization’s administrative compliance with laws or self-regulatory codes that is worth considering is a technology-based model. Individuals and organizations in some settings can use technical measures that reduce the relative importance of administrative measures for overall privacy protection. For example, global web email providers such as Google and Microsoft have increased their use of encryption between the sender and recipient. Chapters 4 and 5 further discuss the interrelated roles of technical, administrative and physical safeguards for personal information. 1.11 Conclusion This chapter introduced key terminology about privacy and data protection laws and policies. It traced the history of these topics and the continued growth of legal requirements to accompany the evolution of IT since the 1960s. As legal requirements have increased, the number of data protection and privacy professionals has grown rapidly, and their role has expanded in many organizations. Similar but not identical forms of FIPS have been the basis of privacy and data protection laws in numerous countries around the globe. This chapter introduces the reader to the legal and policy structures for privacy and data protection around the world. The key models of privacy protection have been examined: the comprehensive, sectoral, self-regulatory or coregulatory, and technology models. 1 Samuel Warren and Louis Brandeis, “The Right to Privacy,” Harvard Law Review 4, no. 5 (December 15, 1890): 193, http://groups.csail.mit.edu/mac/classes/6.805/articles/privacy/Privacy_brand_warr2.html. There are numerous sources of legal privacy, including tort privacy (Warren and Brandeis’s original conception), Fourth Amendment privacy, First Amendment privacy, fundamental-decision privacy and state constitutional privacy. 18 NOT FOR DISSEMINATION The materials in this course are provided only for the personal use of students in this class in association with this class.