Information privacy law

Information privacy laws cover the protection of information on private individuals from intentional or unintentional disclosure or misuse. The European Directive on Protection of Personal Data, released on July 25, 1995 was an attempt to unify the laws on data protection within the European Community. As a result, customers of international organizations such as Amazon and eBay in the EU have the ability to review and delete information, while Americans do not. In the United States the equivalent guiding philosophy is the Code of Fair Information Practice (FIP). This was developed by the Office of Technology Assessment in response to concerns about the potential for electronic surveillance.

The difference in language here is important: in the United States the debate is about privacy where in the European Community the debate is on data protection. Moving the debate from privacy to data protection is seen by some philosophers as a mechanism for moving forward in the practical realm while not requiring agreement on fundamental questions about the nature of privacy.

The basic principles of data protection in the EU are:
*For all data collected there should be a stated purpose
*Information collected by an individual cannot be disclosed to other organizations of individuals unless authorized by law or by consent of the individual.
*Records kept on an individual should be accurate and up to date.
*There should be mechanisms for individuals to review data about them, to ensure accuracy. This may include periodic reporting.
*Data should be deleted when it is no longer needed for the stated purpose.
*Transmission of personal information to locations where "equivalent" personal data protection cannot be assured is prohibited.
*Some data is too sensitive to be collected, unless there are extreme circumstances (e.g., sexual orientation, religion)

Despite the data protection requirements European national ID schemes include data coding standards with religion as a defined (but unused in the EU except in Greece) field.

Because of this, in theory the transfer of personal information from the EU to the US is prohibited when equivalent privacy protection is not in place in the US. In practice, data is transmitted from the EU to the US, India and other data havens. What is required is that the non-EU organization have a data protection or privacy policy. American companies that would work with EU data must comply with the [http://www.export.gov/safeharbor/ Safe Harbour] framework. The core principles of data protected are limited collection, consent of the subject, accuracy, integrity, security, subject right of review and deletion.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) was enacted by the U.S. Congress in 1996. HIPAA is also known as the Kennedy-Kassebaum Health Insurance Portability and Accountability Act (HIPAA-Public Law 104-191), effective August 21, 1996. The basic idea of HIPAA is that an individual who is a subject of individually identifiable health information should have:

*Established procedures for the exercise of individual health information privacy rights.
*The use and disclosure of individual health information should be authorized or required.

One difficulty with HIPAA is that there must be a mechanism to authenticate the patient who demands access to his or her data. As a result, medical facilities have begun to ask for Social Security Numbers from patients, thus arguably decreasing privacy by simplifying the act of correlating health records with other records. The issue of consent is problematic under HIPAA, because the medical providers simply make care contingent upon agreeing to the privacy standards in practice.

FCRA

The Fair Credit Reporting Act applies the principles of the Code of Fair Information Practice to credit reporting agencies. Because of the FCRA each person can obtain a [https://www.annualcreditreport.com free annual credit report] . The FCRA allows individuals to opt out of unwanted credit offers:

Equifax [phone] Equifax Options, P.O. Box 740123Atlanta GA 30374-0123.

Experian [phone] or (888) 5OPTOUT P.O. Box 919, Allen, TX 75013

Trans Union call [phone] or (888) 5OPTOUT P.O Box 97328, Jackson, MS 39238.

The Fair Credit Reporting Act has been effective in preventing the proliferation of specious so-called private credit guides. Previously, private credit guides offered detailed, if unreliable, information on easily identifiable individuals. Before the Fair Credit Reporting Act salacious unsubstantiated material could be included, in fact gossip was widely included in credit reports. EPIC has a www.epic.org/privacy/fcra/ FCRA page.

The Fair Credit Reporting Act provides consumers the ability to view, correct, contest, and limit the uses of credit reports. The FCRA also protects the credit agency from the charge of negligent release in the case of misrepresentation by the requester. Credit agencies must ask the requester the purpose of a requested information release, but need make no effort to verify the truth of the requester’s assertions. In fact, the courts have ruled that, “The Act clearly does not provide a remedy for an illicit or abusive use of information about consumers” (Henry v Forbes, 1976). It is widely believed that in order to avoid the FCRA, ChoicePoint was created by Equifax at which time the parent company copied all its records to its newly created subsidiary. ChoicePoint is not a credit reporting agency, and thus FCRA does not apply.

The Fair Debt Collection Practices Act similarly limits dissemination of information about a consumer’s financial transactions. It prevents creditors or their agents from disclosing the fact that an individual is in debt to a third party, although it allows creditors and their agents to attempt to obtain information about a debtor's location. It limits the actions of those seeking payment of a debt. For example, debt collection agencies are prohibited from harassment or contacting individuals at work. The Bankruptcy Abuse Prevention and Consumer Protection Act of 2005 (which actually gutted consumer protections, for example in case of bankruptcy resulting from medical cost) limited some of these controls on debtors.

ECPA

The Electronic Communications Privacy Act (ECPA) establishes criminal sanctions for interception of electronic communication. However, the loopholes are so large as to render the Act effectively meaningless. For example, consent can be implied to any reading of electronic communications by accepting employment with an organization that practices surveillance against its employees.

"Safe Harbor" Privacy Framework

Unlike the U.S. approach to privacy protection, which relies on industry-specific legislation, regulation and self-regulation, the European Union relies on comprehensive privacy legislation. The European Directive on Data Protection that went into effect in October 1998, includes, for example, the requirement to create government data protection agencies, registration of databases with those agencies, and in some instances prior approval before personal data processing may begin. In order to bridge these different privacy approaches and provide a streamlined means for U.S. organizations to comply with the Directive, the U.S. Department of Commerce in consultation with the European Commission developed a "safe harbor" framework. The safe harbor - approved by the EU in July of 2000 - is a way for U.S. companies to comply with European privacy laws.

Computer Security, Privacy and Criminal Law

The following summarized some of the laws, regulations and directives related to the protection of information systems:

*1970 U.S. Fair Credit Reporting Act
*1970 U.S. Racketeer Influenced and Corrupt Organization (RICO) Act
*1974 U.S. Privacy Act
*1980 Organization for Economic Cooperation and Development (OECD) Guidelines
*1984 U.S. Medical Computer Crime Act
*1984 U.S. Federal Computer Crime Act (strengthened in 1986 and 1994)
*1986 U.S. Computer Fraud and Abuse Act (amended in 1986, 1994, 1996 and 2001)
*1986 Computer Fraud and Abuse Act|U.S. Electronic Communications Privacy Act (ECPA)
*1987 U.S. Computer Security Act
*1988 U.S. Video Privacy Protection Act
*1990 United Kingdom Computer Misuse Act
*1991 U.S. Federal Sentencing Guidelines
*1992 OECD Guidelines to Serve as a Total Security Framework
*1994 Communications Assistance for Law Enforcement Act
*1995 Council Directive on Data Protection for the European Union (EU)
*1996 U.S. Economic and Protection of Proprietary Information Act
*1996 Health Insurance Portability and Accountability Act (HIPAA) (requirement added in December 2000)
*1998 U.S. Digital Millennium Copyright Act (DMCA)
*1999 U.S. Uniform Computer Information Transactions Act (UCITA)
*2000 U.S. Congress Electronic Signatures in Global National Commerce Act ("ESIGN")
*2001 U.S. Provide Appropriate Tools Required to Intercept and Obstruct Terrorism (PATRIOT) Act

References

Office of Technology Assessment, 1985, Electronic Surveillance and Civil Liberties OTA-CIT-293, United States Government Printing Office; Gaithersburg, MA.

Warren S. and Brandeis L., 1890, “The right to privacy,” Harvard Law Review, Vol. 4, 193-220.

ee also

*Information Privacy
*Privacy Commissioner of Canada
*Center for Democracy and Technology