1. Consumer Privacy An Introduction
Marty Abrams
August 20, 2008

2. Individuals Have Various Privacy Interests
As a consumer
How they relate to the market
As a worker
Employee
Small business principal
As a resident of a political unit
Government use of data it collects, purchases and demands
Scope of this session is consumer privacy interests

3. Privacy May Be Segmented Into Three Elements
Security of information
Information must have appropriate protections
Consumer protection
Protection from the harmful application of information
Cultural aspects of privacy
Space to be myself
Space to define myself

4. Mission of Protection Agencies Makes a Difference
US uses consumer protection agencies to enforce privacy
Impacts approach
Impacts scope
Europe and most others use pure privacy protection agencies
Scope is personal information
Procedurally based enforcement

5. US Consumer Privacy Legal Protections Are a Mosaic
Constitution
Very limited
Consumer protection laws with a defined harms based focus
FCRA
ECOA
Transparency based
GLBA
Market fairness based
Section 5 of the FTC Act
State Laws

6. Three Eras in US Consumer Privacy Protections
Industry specific laws (1972 – 1995) and Privacy Act protection over government records
Fair Information Practice Era (1995 – 2001)
Harms based enforcement (2001 – forward)

7. FTC Defined Harms Deception Fraud Intrusion without value
Absence of appropriate levels of security

8. Apples & Oranges of Harm
FTC harms as the basis for enforcement
FTC prevention of harms as the basis for enforcement
2008 Communiqué from 28th Annual Data Protection and Privacy conference
APEC Prevention of Harm principle
There is a difference between harms based enforcement and prevention of harm

9. Understanding and Mitigating Harm to Persons
Risky Business Practices
Harms to Persons
Inadequate security
Weak transparency/choice
Breakdown in the chain of data custody
Unnecessary collection/retention of data
Business process outside the box
Physical
Financial
Social
May lead to…
Evaluated by:
Social Norms and Enforcement Criteria
Socially unacceptable
Beyond established norms
Use out of proportion
Traditional consumer protection laws (fraud, unfair, deceptive)
Resulting in:
Legal actions
Awareness and change in public opinion
Legislation or new limitations
Change in business practices
Copyright The Center for Information Policy Leadership

10. Security Has Become Dominant
California Data Breach
40+ state laws
Enforcement based on data breaches

11. Outsourcing Creates Difficulties
We are talking about global sourcing as well as outsourcing
All process driven by data
Customer is required to pass on all obligations and do due diligence to assure vendor has capacity to protect data
Vendor has an obligation to both understand obligations and meet them

12. PII Trap
Privacy officers domain is Personal Information or Personally Identifiable Information
Increasingly we use information in a fashion that requires extra step to be identifiable
Regulators in the US are charging with protecting consumers
If your domain is limited to PII you have fallen into a trap

13. Regulatory Trend Is to Accountability
Safeguards rule is the model
Accountability is hard
Knowledge
Application of knowledge to decisions
Oversight
Answerability

14. Organizational Privacy Management
Current era is compliance driven
Tomorrow will be strategic information management
Transition will be difficult

15. How to Reach Me
hunton.com