FTC Fair Information Practice - Principles

Principles

The core principles of privacy addressed by these principles are:

1. Notice/Awareness Consumers should be given notice of an entity's information practices before any personal information is collected from them. This requires that companies explicitly notify of some or all of the following:

• identification of the entity collecting the data;
• identification of the uses to which the data will be put;
• identification of any potential recipients of the data;
• the nature of the data collected and the means by which it is collected;
• whether the provision of the requested data is voluntary or required;
• the steps taken by the data collector to ensure the confidentiality, integrity and quality of the data.

2. Choice/Consent Choice and consent in an online information-gathering sense means giving consumers options to control how their data is used. Specifically, choice relates to secondary uses of information beyond the immediate needs of the information collector to complete the consumer's transaction. The two typical types of choice models are 'opt-in' or 'opt-out.' The 'opt-in' method requires that consumers affirmatively give permission for their information to be used for other purposes; without the consumer taking these affirmative steps in an 'opt-in' system, the information gatherer assumes that it cannot use the information for any other purpose. The 'opt-out' method requires consumers to affirmatively decline permission for other uses; without the consumer taking these affirmative steps in an 'opt-out' system, the information gatherer assumes that it can use the consumer's information for other purposes. Each of these systems can be designed to allow an individual consumer to tailor the information gatherer's use of the information to fit his or her preferences by checking boxes to grant or deny permission for specific purposes rather than using a simple "all or nothing" method.

2-1. Problems with Choice/Consent Consumers do not have a fair say in the consent process. For example, customers provide their health information such as their social insurance number or health card number while making an appointment for a dental check-up through on-line. Customers are commonly asked to sign an agreement stating that ‘third-party may have an access to the information you provide under certain conditions.’ The certain conditions are rarely specified in any part of the agreement. Later on, the third-party may share the information with their subsidiary institutions. Thus, access to customers’ personal information is beyond their control.

3. Access/Participation Access as defined in the Fair Information Practice Principles includes not only a consumer's ability to view the data collected, but also to verify and contest its accuracy. This access must be inexpensive and timely in order to be useful to the consumer.

4. Integrity/Security Information collectors should ensure that the data they collect is accurate and secure. They can improve the integrity of data by cross-referencing it with only reputable databases and by providing access for the consumer to verify it. Information collectors can keep their data secure by protecting against both internal and external security threats. They can limit access within their company to only necessary employees to protect against internal threats, and they can use encryption and other computer-based security systems to stop outside threats.

5. Enforcement/Redress In order to ensure that companies follow the Fair Information Practice Principles, there must be enforcement measures. The FTC identified three types of enforcement measures: self-regulation by the information collectors or an appointed regulatory body; private remedies that give civil causes of action for individuals whose information has been misused to sue violators; and government enforcement, which can include civil and criminal penalties levied by the government.