FTC fair information practice

The United States Federal Trade Commission's Fair Information Practice Principles (FIPs) are guidelines that represent widely-accepted concepts concerning fair information practices in an electronic marketplace.

Introduction

The FTC Fair Information Practice Principles are the result of the Commission's inquiry into the manner in which online entities collect and use personal information and safeguards to assure those practices are fair and provide adequate information privacy protection. The FTC has been studying online privacy issues since 1995, and in its 1998 report, the Commission described the widely-accepted Fair Information Practice Principles of Notice, Choice, Access, and Security. The Commission also identified Enforcement, the use of a reliable mechanism to provide sanctions for noncompliance as a critical component of any governmental or self-regulatory program to protect online privacy.

History and Development

Fair Information Practices were initially proposed and named by the US Secretary's Advisory Committee on Automated Personal Data Systems in a 1973 report, Records, Computers and the Rights of Citizens, issued in response to the growing use of automated data systems containing information about individuals. The central contribution of the Advisory Committee was the development of a code of fair information practices for automated personal data systems. The Privacy Protection Study Commission also may have contributed to the development of FIPs principles in its 1977 report, Personal Privacy in an Information Society.

As privacy laws spread to other countries in Europe, international institutions took up privacy with a focus on the international implications of privacy regulation. In 1980, the Council of Europe adopted a Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data. At the same time, the Organisation for Economic Cooperation and Development (OECD) proposed similar privacy guidelines in the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. Both the Council of Europe Convention and the OECD Guidelines relied on FIPs as core principles, although neither document used the term. Both organizations revised and extended the original U.S. statement of FIPs, with the OECD Privacy Guidelines being the version most often cited in subsequent years.

The FTC Fair Information Practice Principles

The core principles of privacy addressed by these principles are:

1. Notice/Awareness Consumers should be given notice of an entity's information practices before any personal information is collected from them. This includes an explicit statement regarding:

• identification of the entity collecting the data; identification of the uses to which the data will be put;
• identification of any potential recipients of the data;
• the nature of the data collected and the means by which it is collected;
• whether the provision of the requested data is voluntary or required;
• the steps taken by the data collector to ensure the confidentiality, integrity and quality of the data.

2. Choice/Consent Giving consumers options as to how any personal information collected from them may be used. Specifically, choice relates to secondary uses of information -- uses beyond those necessary to complete the contemplated transaction. The two typical types of choice models are 'opt-in' or 'opt-out'. Opt-in requires affirmative steps by the consumer to allow the collection and/or use of information; opt-out requires affirmative steps to prevent the collection and/or use of such information. The distinction lies in the default rule when no affirmative steps are taken by the consumer.

3. Access/Participation An individual's ability both to access data an entity has collected on himself and to contest that data's accuracy and completeness.

4. Integrity/Security Data should be accurate and secure. Collectors must take reasonable steps, such as using only reputable sources of data and cross-referencing data against multiple sources, providing consumer access to data, and destroying untimely data or converting it to anonymous form.

5. Enforcement/Redress Enforcement mechanisms to ensure compliance with core fair information practice principles. Among the possible enforcement approaches are industry self-regulation; legislation that would create private remedies for consumers; and/or regulatory measures enforceable through civil and criminal sanctions.

Enforcing the Principles

Currently the FTC version of the Fair Information Principles are only recommendations for maintaining privacy-friendly, consumer-oriented data collection practices, and are not enforceable by law. The enforcement of and adherence to these principles is currently therefore exclusively self-regulatory within industry. Because self-regulatory initiatives fall far short of an ideal implementation of the principles, the Commission recommends that the United States Congress enact legislation that, in conjunction with continuing self-regulatory programs, will ensure adequate protection of consumer privacy online.

The legislation recommended by the Commission would set forth a basic level of privacy protection for consumer-oriented commercial Web sites and would establish basic standards of practice for the collection of information online. Consumer-oriented commercial Web sites that collect personal identifying information from or about consumers online would be required to comply with the four widely-accepted fair information practices.

Alternate Proposals Regarding 'Fair Information'

Alternate proposals regarding the fair use of consumer information online have been presented by such organizations as the Organisation for Economic Co-operation and Development (OECD) The OECD principles are thought to be more comprehensive and provide added protections via the Individual Participation principle where specific requirements are made for access and modification of personally collected information by the individual and the Accountability principle (a data controller should be accountable for complying with measures which give effect to the principles stated above).

Criticism of the FTC Principles

Robert Gellman, a DC-based privacy and information policy consultant, suggests the FIPs are much less comprehensive in scope than laws in some other countries in. In Fair Information Practices: A Basic History he suggests the FTC's 2000 version of FIPs is shorter and less complete than a version issued by the Privacy Office at the Department of Homeland Security in 2008, which includes eight principles that match up closely with the OECD version. Gellman also says some in the privacy community believe that FIPs are too weak, allow too many exemptions, do not require a privacy agency, fail to account for the weaknesses of self-regulation, and have not kept pace with information technology. Critics from a business perspective often prefer to limit FIPs to reduced elements of notice, consent, and accountability. They complain that other elements are unworkable, expensive, or inconsistent with openness or free speech principles.

Many privacy experts have called for omnibus privacy protection legislation in the US. However, the Principles have formed the basis of many individual laws at the both federal and state levels -- called the "sectoral approach." Examples are the Fair Credit Reporting Act, the Right to Financial Privacy Act, the Electronic Communications Privacy Act, and the Video Privacy Protection Act.

See also

• Federal Trade Commission
• Code of Fair Information Practice
• Information protection policy
• Information security

External links

• FTC Fair Information Practice Principles (FIPs)
• FTC 2000 Privacy Report
• FTC Privacy Online: A Report to Congress
• OECD Fair Information Practices
• OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data
• The Privacy Act of 1974, 5 U.S.C. § 552a.