1. Information Privacy: Public Policy and Institutional Policies Wendy Wigen Policy Analyst, EDUCAUSE Copyright Wendy Wigen, 2004. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

2. EDUCAUSE Policy Program  Policy Website http://www.educause.edu/policy/ http://www.educause.edu/policy/ Issue Briefs Legislative Tracking Chart Comparison of Legislation Hot Topics in Washington  Policy Analysts  Policy Conference: May 19-20

3. Information Privacy  Technology and privacy  Security and privacy  Main tenants of privacy policy Awareness of collection Awareness of what is collected Awareness of how it is to be used Ability to correct Assurance of reasonable security

4. Current Privacy Issues  Privacy Policies  Identity Theft  Spam  Spyware  Patriot Act  CALEA and the Internet

5. Privacy Policies – Public Policy  Legislation & Regulations FERPA, HIPAA, Gramm-Leach Bliley State level (Maryland Data Security & Privacy Policies)  Trends Privacy notices that are more readable and useful

6. Privacy Policies - Implications  Complicated in large, decentralized academic institutions  Applies to “paper” as well as “electronic” practices  Diligence: Training, Oversight, and Advocacy  Balancing “compliance” with “ethical” standards

7. Identity Theft – Public Policy  Fair and Accurate Credit Transactions Act – Signed December 4, 2003 Will serve as model for privacy/ID theft Incorporates most Identity Theft proposals  Prevention: SSN’s Credit Card truncation and red alerts i.e. address change/new card  Victim Assistance: rights and education  Enforcement: coordination and improved technology

8. Identity Theft - Implications  Eliminate use of Social Security numbers as primary identifiers  Limit access to records and information on reports  Identity Theft Awareness & Resources Create a webpage: U of MiamiU of Miami Link to the FTCFTC “privacy advocate” job description

9. SPAM – Public Policy  CAN-SPAM Act: December 15, 2003  Work in progress: main goals Establish a National Law/ work toward an International agreement Target egregious spammers/ enable law enforcement Protect legitimate e-marketing/ establish standards Wait: well-publicized cases with heavy penalties

10. SPAM - Implications  Educate users  Refer user complaints to LE/FTC  Acceptable Use Policy  SPAM Filtering Software

11. Spyware  Problem: It will discourage Internet use  SPY BLOCK Act (S. 2145)  FTC Workshop How do you distinguish good software from bad? Are new laws needed? Technology fix?

12. USA PATRIOT Act – Public Policy  Proposed legislation: SAFE Act ( Security and Freedom Ensured ) and Protecting the Rights of Individuals Act (S 1709/HR3352)  Strong counterbalance to DoJ/ signals awareness in Congress

13. CALEA: Wiretapping the Internet  Communications Assistance to Law Enforcement Act of 1994 “CALEA”  Timing: A brief history of wiretapping…  Implications for Campuses Cost to make systems compliant Cost to privacy Cost to innovation

14. What is the outlook?  PATRIOT Act has strong Presidential support; strong Congressional opposition  CALEA decision will go to Congress  Telecommunications Laws will be brought up to date  Security and Privacy: The political dance will continue

15. For more information: EDUCAUSE D.C. Office http://www.educause.edu/policy (202)872.4200 rpetersen@educause.edu wwigen@educause.edu gsern@educause.edu