Information Privacy: Public Policy and Institutional Policies Wendy Wigen Policy Analyst, EDUCAUSE Copyright Wendy Wigen, This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

EDUCAUSE Policy Program  Policy Website Issue Briefs Legislative Tracking Chart Comparison of Legislation Hot Topics in Washington  Policy Analysts  Policy Conference: May 19-20

Information Privacy  Technology and privacy  Security and privacy  Main tenants of privacy policy Awareness of collection Awareness of what is collected Awareness of how it is to be used Ability to correct Assurance of reasonable security

Current Privacy Issues  Privacy Policies  Identity Theft  Spam  Spyware  Patriot Act  CALEA and the Internet

Privacy Policies – Public Policy  Legislation & Regulations FERPA, HIPAA, Gramm-Leach Bliley State level (Maryland Data Security & Privacy Policies)  Trends Privacy notices that are more readable and useful

Privacy Policies - Implications  Complicated in large, decentralized academic institutions  Applies to “paper” as well as “electronic” practices  Diligence: Training, Oversight, and Advocacy  Balancing “compliance” with “ethical” standards

Identity Theft – Public Policy  Fair and Accurate Credit Transactions Act – Signed December 4, 2003 Will serve as model for privacy/ID theft Incorporates most Identity Theft proposals  Prevention: SSN’s Credit Card truncation and red alerts i.e. address change/new card  Victim Assistance: rights and education  Enforcement: coordination and improved technology

Identity Theft - Implications  Eliminate use of Social Security numbers as primary identifiers  Limit access to records and information on reports  Identity Theft Awareness & Resources Create a webpage: U of MiamiU of Miami Link to the FTCFTC “privacy advocate” job description

SPAM – Public Policy  CAN-SPAM Act: December 15, 2003  Work in progress: main goals Establish a National Law/ work toward an International agreement Target egregious spammers/ enable law enforcement Protect legitimate e-marketing/ establish standards Wait: well-publicized cases with heavy penalties

SPAM - Implications  Educate users  Refer user complaints to LE/FTC  Acceptable Use Policy  SPAM Filtering Software

Spyware  Problem: It will discourage Internet use  SPY BLOCK Act (S. 2145)  FTC Workshop How do you distinguish good software from bad? Are new laws needed? Technology fix?

USA PATRIOT Act – Public Policy  Proposed legislation: SAFE Act ( Security and Freedom Ensured ) and Protecting the Rights of Individuals Act (S 1709/HR3352)  Strong counterbalance to DoJ/ signals awareness in Congress

CALEA: Wiretapping the Internet  Communications Assistance to Law Enforcement Act of 1994 “CALEA”  Timing: A brief history of wiretapping…  Implications for Campuses Cost to make systems compliant Cost to privacy Cost to innovation

What is the outlook?  PATRIOT Act has strong Presidential support; strong Congressional opposition  CALEA decision will go to Congress  Telecommunications Laws will be brought up to date  Security and Privacy: The political dance will continue

For more information: EDUCAUSE D.C. Office (202)