Monday, March 11, 2013

Privacy Primer: Fair Information Practice Principles

Today while reading through a blog post by Michael Daniel, titled Improving the Security of the Nations Critical Infrastructure, I was drawn into the Privacy and Civil Liberties Protections section of the Executive Order on Improving Critical Infrastructure Cybersecurity. Michael says, "the executive order directs departments and agencies to incorporate privacy and civil liberties protections into cyber security activities based upon widely-accepted Fair Information Practice Principles, and other applicable privacy and civil liberties frameworks and policies."
Clicking the link to see the Fair Information Practice Principles, I read through the 2008 privacy policy guide that I frankly have never seen nor read before this. I found the guide to be a very interesting read. The eight Fair Information Practice Principles are: Transparency, Individual Participation, Purpose Specification, Data Minimization, Use Limitation, Data Quality and Integrity, Security, and Accountability and Auditing.

I thought it would be interesting to replace DHS with ORGANIZATION and read it again. Result? A short primer to privacy safeguards.
  • Transparency: ORGANIZATION should be transparent and provide notice to the individual regarding its collection, use, dissemination, and maintenance of personally identifiable information (PII).
  • Individual Participation: ORGANIZATION should involve the individual in the process of using PII and, to the extent practicable, seek individual consent for the collection, use, dissemination, and maintenance of PII.  ORGANIZATION should also provide mechanisms for appropriate access, correction, and redress regarding ORGANIZATION’s use of PII.
  • Purpose Specification: ORGANIZATION should specifically articulate the authority that permits the collection of PII and specifically articulate the purpose or purposes for which the PII is intended to be used.
  • Data Minimization: ORGANIZATION should only collect PII that is directly relevant and necessary to accomplish the specified purpose(s) and only retain PII for as long as is necessary to fulfill the specified purpose(s).
  • Use Limitation: ORGANIZATION should use PII solely for the purpose(s) specified in the notice. Sharing PII outside the Department should be for a purpose compatible with the purpose for which the PII was collected.
  • Data Quality and Integrity: ORGANIZATION should, to the extent practicable, ensure that PII is accurate, relevant, timely, and complete.
  • Security: ORGANIZATION should protect PII (in all media) through appropriate security safeguards against risks such as loss, unauthorized access or use, destruction, modification, or unintended or inappropriate disclosure.
  • Accountability and Auditing: ORGANIZATION should be accountable for complying with these principles, providing training to all employees and contractors who use PII, and auditing the actual use of PII to demonstrate compliance with these principles and all applicable privacy protection requirements.