Consumer Privacy An Introduction Marty Abrams August 20, 2008

Individuals Have Various Privacy Interests As a consumer How they relate to the market As a worker Employee Small business principal As a resident of a political unit Government use of data it collects, purchases and demands Scope of this session is consumer privacy interests

Privacy May Be Segmented Into Three Elements Security of information Information must have appropriate protections Consumer protection Protection from the harmful application of information Cultural aspects of privacy Space to be myself Space to define myself

Mission of Protection Agencies Makes a Difference US uses consumer protection agencies to enforce privacy Impacts approach Impacts scope Europe and most others use pure privacy protection agencies Scope is personal information Procedurally based enforcement

US Consumer Privacy Legal Protections Are a Mosaic Constitution Very limited Consumer protection laws with a defined harms based focus FCRA ECOA Transparency based GLBA Market fairness based Section 5 of the FTC Act State Laws

Three Eras in US Consumer Privacy Protections Industry specific laws (1972 – 1995) and Privacy Act protection over government records Fair Information Practice Era (1995 – 2001) Harms based enforcement (2001 – forward)

FTC Defined Harms Deception Fraud Intrusion without value Absence of appropriate levels of security

Apples & Oranges of Harm FTC harms as the basis for enforcement FTC prevention of harms as the basis for enforcement 2008 Communiqué from 28th Annual Data Protection and Privacy conference APEC Prevention of Harm principle There is a difference between harms based enforcement and prevention of harm

Understanding and Mitigating Harm to Persons Risky Business Practices Harms to Persons Inadequate security Weak transparency/choice Breakdown in the chain of data custody Unnecessary collection/retention of data Business process outside the box Physical Financial Social May lead to… Evaluated by: Social Norms and Enforcement Criteria Socially unacceptable Beyond established norms Use out of proportion Traditional consumer protection laws (fraud, unfair, deceptive) Resulting in: Legal actions Awareness and change in public opinion Legislation or new limitations Change in business practices Copyright 2008 The Center for Information Policy Leadership

Security Has Become Dominant California Data Breach 40+ state laws Enforcement based on data breaches

Outsourcing Creates Difficulties We are talking about global sourcing as well as outsourcing All process driven by data Customer is required to pass on all obligations and do due diligence to assure vendor has capacity to protect data Vendor has an obligation to both understand obligations and meet them

PII Trap Privacy officers domain is Personal Information or Personally Identifiable Information Increasingly we use information in a fashion that requires extra step to be identifiable Regulators in the US are charging with protecting consumers If your domain is limited to PII you have fallen into a trap

Regulatory Trend Is to Accountability Safeguards rule is the model Accountability is hard Knowledge Application of knowledge to decisions Oversight Answerability

Organizational Privacy Management Current era is compliance driven Tomorrow will be strategic information management Transition will be difficult

How to Reach Me mabrams@ hunton.com