Background

CALEA was passed in 1994 in order to facilitate law enforcement authorities’ wiretapping of digital telephone networks. It was the first piece of legislation in history that required telecommunications companies to modify their equipment in order to facilitate government surveillance. The FBI originally proposed the CALEA in 1992. This proposal was broadly inclusive – for instance, computer networks would have been part of this Act, in the name of government surveillance.

The CALEA essentially forced telephone companies to redesign their architectures in order to facilitate wiretapping. Notably, the CALEA did not regulate data traveling over the internet.

According to privacy watchdogs, wiretapping of suspected criminal activity by law enforcement agencies can rapidly degenerate into suspicionless monitoring of the general public, which violates the Fourth Amendment.

According to the Privacy Rights Clearinghouse, “Wiretapping is any interception of a telephone transmission by accessing the telephone signal itself.” Another related concept is ‘electronic eavesdropping,’ which is defined as “the use of an electronic transmitting or recording device to monitor conversations without the consent of the parties.”

Under US law, there are very few situations in which wiretaps are legal. However, technological improvements have made it increasingly easier to illegally wiretap communications.

Evolution of CALEA

In August 2004, the Federal Communications Commission (FCC) released a Notice of Proposed Rule Making (NPRM), which expanded the boundaries of CALEA by redefining what constitutes telephone service, concluding that broadband Internet access providers and managed VoIP systems substantially replace local exchanges and therefore are subject to the requirements of CALEA.

In August 2005, the FCC announced a Final Rule, which expanded CALEA to Internet broadband providers and certain VoIP providers.

Critics Say…

In response to the expanding reach of CALEA, the Electronic Frontier Foundation (EFF) has listed a number of objections and concerns. These are briefly summarized below.

• Wiretapping Convenience – According to the EFF, wiretapping is already a relatively easy practice as is. Existing legislation already permits law enforcement agencies to place Internet users under surveillance, regardless of what programs or protocols being used to communicate. The reality is that most types of surveillance has gotten easier in this day and age.
• “Tappability Principle” is Problematic – The FBI suggested that if something is legally searchable sometimes, it should be physically searchable all the time (the “tappability principle”). However, this could lead to all individual phones having built-in bugs, leaving consumers to trust that the phone companies or law enforcement would not activate those bugs without a legitimate reason.
• Increased Costs for Services – Expanding CALEA in the manner suggested by the FCC’s NPRM would cause broadband providers to spend millions of dollars restructuring their network architectures and design and manufacture surveillance-friendly technologies. This would cause telecommunications bills to skyrocket. It would also eliminate privacy-friendly technologies from the marketplace.
• Takes a Toll on Innovation – CALEA compliance would significantly reduce the scope of technological research and development. It would also allow the FCC to have authority over a wider range of technologies. CALEA’s requirements might result in economic incentives for software developers to create new programs (e.g. email, IM programs) that are more surveillance-friendly. This would mean that innovators will need to work within the guidelines of CALEA’s surveillance.
• Phone Regulations are not Applicable – The NPRM assumes that regulations that apply within the phone network (a closed, insulated system) should be extended to the internet (an open, always-changing system). This could severely hamper technological development and innovation on the Internet, where new services and devices are being introduced all the time.
• Internet Insecurities – Unfortunately, many of the technologies that are used to create surveillance-friendly computer networks might increase the risk of attacks or breaches of personal data. Broadband service providers who must make their networks or applications more tappable end up introducing potential points of vulnerability into their system. Many users are unaware of this reality when they register for such services.

Surveillance-Industrial Complex

Services that facilitate wiretapping, and the types of policies that are necessitated by such legislation as the CALEA essentially facilitates what the American Civil Liberties Union (ACLU) refers to as the surveillance-industrial complex, which involves the integration of private individuals and organizations with a government-sanctioned surveillance network. Private entities motivated by profiting from surveillance activities have an incentive to lobby for increased government surveillance authority.

Regarding the CALEA, the ACLU comments,

“Americans have long feared the specter of the government maintaining dossiers filled with information about the lives of individual, innocent citizens. Data retention, whether mandatory or de facto, achieves the same goal indirectly, by ensuring that information is stored by corporations – from where, as we have seen, it can easily be accessed by the authorities.”

Summary

This article takes a look at the Communications Assistance for Law Enforcement Act (CALEA), which was passed in 1994 to facilitate law enforcement authorities’ wiretapping of digital telephone networks. In 2004, the FCC suggested substantial expansions in the scope of the CALEA in its Notice of Proposed Rulemaking (NPRM). In August 2005, the FCC’s Final Rule expanded the CALEA to include Internet broadband and VoIP providers. This article also explores privacy watchdogs’ criticism of government surveillance expansion.

CIPP Exam Preparation

In preparation for the Certified Information Privacy Professional (CIPP) exam, a privacy professional should be comfortable with topics related to this post, including:

• Communications Assistance to Law Enforcement Act – CALEA (I.B.a.iii.3.)

On May 19, 2011, the US Senate Committee on Commerce, Science and Transportation had a hearing that focused on “Consumer Privacy & Protection in the Mobile Market Place.” Present were representatives from Google, Apple and Facebook, as well as David Vladeck, director of the Bureau of Consumer Protection of the Federal Trade Commission (FTC).

Voicing Concerns

At the subcommittee hearing, Senator John Rockefeller expressed concerns about the amount of information mobile devices are actually able to collect about their owners. He demanded stronger controls over how and when such personal data is shared, saying, “As smartphones become more powerful, more personal information is being concentrated in one place. Consumers want to understand and have control of their personal information. ” Senator Rockefeller is the chairman of the US Senate Committee on Commerce, Science and Transportation.

According to Senator Al Franken, the chairman of the judiciary subcommittee on Privacy, Technology and the Law, “Consumers have a fundamental right to know what data is being collected about them. I also believe they have a right to decide whether or not they want to share that information and with who they want to share it and when.”

Jessica Rich from the FTC expressed worries about mobile device safety, saying, “These concerns stem from the always-on, always-with-you personal nature of mobile devices.” She also pointed out the possible hazards of “invisible collection and sharing of data with multiple parties, the ability to track consumers – including children and teens – to their precise location.”

Responding to the Fears

In response to the increased concerns regarding mobile data collection, Catherine Novelli, Apple’s VP of worldwide government affairs explained that the company currently provides tools allowing customers to control the collection and use of data on its mobile devices, including location data. Novelli said, “Apple does not track users’ locations – Apple has never done so and has no plans to ever do so.” However, the recent flurry of activity over the company’s iPhone and 3G-enabled iPads speak to the contrary.

Alan Davidson, Google’s director of public policy for the Americas responded that Google supports the development of a legal privacy framework that ensures broad-based user trust and that will support continued innovation.

Bret Taylor, the Chief Technology Officer of Facebook, warned that too much regulation may stifle innovation amongst mobile technology and service providers: “Adopting overly restrictive policies will prevent our social features from functioning in the way that individuals expect and demand.”

FTC Suggestions

In its statement to the subcommittee, the FTC suggested extending the application of its Do-Not-Track mechanism. Introduced in December 2010, the Do Not Track feature for internet browsers would allow users to opt out of sharing browsing data completely and protect their privacy. This suggestion was made in order to give end users increased control over the amount and type of personal data stored by companies, preventing the sharing of sensitive data with third parties, or the use of sensitive data against the individual’s wishes.

The FTC recommended that this Do-Not-Track mechanism should apply to mobile and desktop devices: “At least for purposes of web browsing, the issues surrounding implementation of Do Not Track are the same on mobile devices and desk top computers.” Currently, FTC staff is developing ways to implement Do Not Track mechanisms on mobile apps.

Summary

This article takes a look at the May 19, 2011 Senate Subcommittee hearing on “Consumer Privacy & Protection in the Mobile Market Place.” As mobile phones and location-based apps are becoming more ubiquitous, this has raised a number of consumer concerns regarding the amount and type of sensitive information that is being collected, stored and shared by developers and third-parties. The subcommittee hearing was an opportunity for those on both sides of the debate to express their opinions. The FTC suggested extending the Do Not Track mechanism for web browsers to include mobile devices as well.

CIPP Exam Preparation

In preparation for the Certified Information Privacy Professional/Information Technology (CIPP/IT) exam, a privacy professional should be comfortable with topics related to this post, including:

• Sensitive Personal Information (SPI) (I.A.b.)
• Data accountability (I.B.c.)
• Consumer privacy concerns (II.A.a.)
• Government and citizen surveillance (II.A.k.)
• Social networking services (VI.C.)
• Location-based services (VI.E.)

Crucial Evidence

In his statement before the Subcommittee on Crime, Terrorism, and Homeland Security, Jason Weinstein, deputy assistant attorney general at the Justice Department, pointed out that retaining data from ISPs and cell phone service providers can help provide crucial evidence in cases “including child exploitation, violent crime, fraud, terrorism, public corruption, drug trafficking, online piracy, computer hacking, and other privacy crimes.”

According to Weinstein, many of the Justice Department’s current criminal investigations are being hindered by its inability to monitor and store the online activity of users. He provided numerous examples in which the retention policies of service providers were obstructing federal, state and local law enforcement investigations. Weinstein said, “These decisions by providers to delete records are rarely done out of a lack of desire to cooperate with law enforcement; rather, they are usually done out of an understandable desire to cut costs.  Some providers also seem to delete records out of a concern for customer privacy.”

Current Practices

At this point, ISPs are required to preserve usage data only at the request of law enforcement authorities. Many ISPs are also collecting and maintaining “non-content records,” for instance a subscriber’s login records, information on who is using their services and how. ISPs have widely varying policies and practices regarding the storage of non-content records. In some cases, it will be deleted within days, while others may retain the data for months. Weinstein would like to see this retention period standardized, so that authorities are guaranteed to be able to access such data, should they require it.

There is currently no law that requires ISPs to retain user data. However, the push for extensive data retention legislation is not a new issue. In the past, FBI director Robert Mueller requested that Congress consider such legislation for similar reasons.

Critics Say…

Undoubtedly, the January 25^th hearing has brought to the surface a number of privacy and freedom of speech concerns. The notion of law enforcement authorities tracking and retaining large amounts of information on over 230 million Americans is an unacceptable outcome for many. This may significantly impact free and anonymous speech and will change how individuals use the internet.

Jim Harper, the director of information policy studies at the Cato Institute, commenting on the issue of mandatory data retention, says “I fail to see where the Fourth Amendment permits the government to require dragnet surveillance of Internet users.”

Another issue is that while the federal government is pushing for pro-privacy laws, it is also contradicting itself with anti-privacy laws, such as this data retention legislation. Recently, the FTC proposed that browsers include Do-Not-Track features, which would help users ensure that their information is not being retained while they browse the internet. At the same time, the Justice Department has asked for more extensive retention laws, though the two are seemingly in conflict with each other.

According to John Morris, the general counsel for the Washington DC-based think-tank Center for Democracy and Technology, the hearing does not necessarily mean that a data retention bill is on the way. It is also uncertain what kind of data ISPs would be expected to retain, or if other online services (e.g. e-mail providers) might be included in the new legislation. Morris said:

“In the best-case scenario, a data retention bill will only require ISPs to track and store Internet Protocol (IP) address allocation data to help law enforcement better link Internet use to specific users. In the worst-case scenario, it could require ISPs and all sorts of online service providers to store and track everything from IP addresses to source data involving e-mail, instant messaging (IM), social media interactions and Web sites visited.”

Summary

On January 25, 2011, the US Department of Justice brought the issue of mandatory data retention to the House Subcommittee on Crime, Terrorism, and Homeland Security. Currently, there is no law requiring internet service providers (ISPs) to retain user data, and ISP retention practices are inconsistent in terms of type of data and retention period. Law enforcement authorities have long argued that mandatory data retention would advance criminal investigations, especially those dealing with child pornography and sexual predators. Critics argue that retention of user data would result in numerous privacy and freedom of speech concerns.

CIPP Exam Preparation

In preparation for the Certified Information Privacy Professional/Information Technology (CIPP/IT) exam, a privacy professional should be comfortable with topics related to this post, including:

• Methods of Data Collection (I.B.a.)
• Privacy Concerns – Consumer Perspective (II.A.a.)
• Government and Citizen Surveillance (II.A.k.)
• Privacy Expectations – Consumer Behaviors (II.B.a.)
• Online Privacy (V.D.i.1.)

What is RFID?

RFID is a term for a group of technologies that enable machines to identify objects. This may include bar codes, smart cards, optical character readers, biometric technologies and more. RFID uses radio waves to identify items. Its first application was the identification of aircraft during WWII. Since then, developments in technology have reduced the cost and increased potential applications of RFID technology. The automatic identification offered by RFID is attractive to many organizations and retail stores, as it reduces the time and labor necessary to manually input data and to improve data accuracy.

There are three components in an RFID system:

1. Tag: this is usually made up of a microchip unit, antenna and encapsulating material. Microchips can store up to two kB of data. This may be information about a certain product, such as its destination or sell-by date. An RFID system may include multiple tags.

Tags are also referred to as transponders. They can be read-only or read-write tags. “Read-only” means that the information on the tags cannot be changed in any way. Read-write tags can have the information modified or erased multiple times. Since they offer greater functionality, their price is much higher than read-only tags.

1. Reader: this is a device that has at least one antenna to communicate with the RFID tag. It emits radio waves and receives signals back from the tag. The reader passes digital information to a computer system. Readers are also known as interrogators. They can be portable, handheld devices or fixed terminals positioned in strategic places, such as loading bays or doorways.
2. Infrastructure: this includes the necessary hardware and software for supporting the RFID system. The RFID software translates the data from the tag into the information about the goods and orders. This information is transmitted into other databases and applications for processing.

How can RFID be used?

RFID technology has and will be applied in a variety of public and private sector organizations. Uses include:

• Product Integrity – to ensure that products are authentic and untampered with
• Supply Chain Management – to monitor and control the flow of goods through the supply chain (i.e. from raw material to finished product to consumer)
• Warranty Services – goods with tags incorporated into the materials, in order to facilitate warranty services
• ID, Travel & Ticketing – to verify the identity of the traveller; to ensure that travel documents are genuine
• Baggage Tracking – to monitor and control the movement of baggage (e.g. from check-in to loading)
• Patient Care & Management – to rapidly, accurately verify patient information (e.g. allergies, prescription, health history, etc.)

Privacy Issues

According to the Canadian PIAC (Public Interest Advocacy Center), RFID technology presents a challenge to Canadian privacy legislation. The basic surveillance capabilities of RFID are unlikely to violate privacy, though the PIPEDA significantly limits the use of RFID for consumer surveillance purposes.

However, later Office of the Privacy Commissioner of Canada (OPC) research indicated that there were significant concerns regarding the use of RFID in the workplace. Through a number of public consultations, the OPC was able to establish the perspectives of academics, RFID vendors, industry groups and private citizens. Numerous privacy threats were identified:

Repeated collection of information

• Since RFID tags are very small, they can easily be embedded on/in objects or documents without the individual’s knowledge. It is possible to read RFID tags through fabric, plastic and other materials, as radio waves are not restricted to line of sight. Tags can also be read from a distance. These factors render it impossible for individuals to know if/when he/she is being scanned.

Tracking Movements

• If there is a sufficient network of RFID readers, the tags can be tracked in time and space. This is possible through a combination of GPS (Global Positioning Systems) and RIFD technologies.

Profiling Individuals

• RFID technology means that each object has its own unique identification. This contrasts bar code technology, which gives the same identification to all similar objects (e.g. in a grocery store, all orange juice cartons of the same brand have the same bar code). If unique identifiers are associated with individuals, then profiles of purchasing habits can be compiled.

Secondary Use

• Creating profiles and tracking individual movement can be linked to other information which the individual may not want revealed.

Massive Data Aggregation

• RFID records may be linked with personally identifying data, which may facilitate any of the other privacy threats listed previously.

OPC Responses

The OPC recommends that the ten principles of the CSA Model Code, as well as the PIPEDA form the basis for an RFID privacy management framework. OPC research responds to each of the ten CSA principles, with respect to RFID technologies:

1. Accountability – Who has access to and who is accountable for the data generated by RFID systems, as well as other data collection systems in the workplace?
2. Identifying Purposes – RFID systems that are used for legitimate business purposes (e.g. supply chain management) are more likely to be supported than RFID systems used for secondary purposes or surveillance (e.g. employee surveillance, workforce management). The OPC identified that industry standards, policies or guidelines can help to ensure that the data collected through these systems are used and disclosed for identified purposes.
3. Consent – Meaningful consent must be secured before an RFID system is implemented. However, there is the challenge of securing meaningful and completely voluntary consent in a workplace setting.
4. Limiting Collection – Reasonable expectations of privacy must be balanced with reasonable management of RFID systems. While reasonable expectations of employees are important, the reasonable management of the RFID system is the employer’s responsibility. This involves the protection of employee privacy.
5. Limiting Use, Disclosure & Retention – The issue of RFID implants was a significant concern for OPC and other groups who were consulted, as implants present significant privacy and security issues. For instance, employee conduct might be monitored during and after work hours, at lunch, during vacation, and for tracking physical movements and conduct. This may pose a serious security issue.

Employers should limit the collection of personally identifiable information, including RFID-related data. Data from RFID systems should not be linked to other databases, unless there is a proven need.

1. Accuracy – It is the responsibility of the employer to ensure that personal information is accurate, complete and up to date for the purposes for which it is to be used. An audit trail might be established and maintained regarding the lifecycle of the RFID data.
2. Safeguards – RFID systems that contain personal information must be protected in a way that is proportionate to its sensitivity. Employers should be made accountable for any breach of RIFD technology. Protecting data in each distinct part of the system is an effective approach to safeguarding employee privacy.
3. Openness – For instance, hidden tags or readers should not be implemented. Clients, employees and/or unions should be consulted before RFID systems are installed. Tags and readers ought to be in plain sight, never used for covert surveillance.
4. Individual Access – Individuals (e.g. clients, employees, union leaders) should be guaranteed access to any personally identifiable data generated by RFID systems.
5. Challenging Compliance – Individuals ought to be able to challenge compliance with other principles. This may be the ability to make inquiries or lodge a complaint if necessary.

After examining each principle individually, the OPC stated some guiding applications for the implementation of RFID technology in a way that respects Fair Information Practices:

• If the RIFD chip has an individual’s personal information contained on it, then it is defined as a repository of personal information.
• If the tag is unique, it can be associated with an individual. The tag becomes a unique identifier for that individual.
• Personal information includes information about possessions, purchases or behaviors that can be processed to create a profile.

Summary

This article provides a brief introduction to RFID (radio frequency identification) technology. It explores some uses of this technology in consumer and work settings. Privacy concerns regarding RFID systems are raised. The article also offers some responses and recommendations made by the Privacy Commissioner of Canada regarding implementation of RFID technology.

CIPP/C Preparation

In preparation for the Certified Information Privacy Professional/Canada exam, a privacy professional should be comfortable with topics related to this post, including:

• CSA Model Code for the Protection of Personal Information (II.A.a.i.)
• Radio Frequency Identification (RFID) (V.A.a.5.)
• Security threats and vulnerabilities (V.A.b.)
• Information management (V.c.i.)

Bills C-46 & C-47

In June 2009, the Canadian federal government tabled two significant pieces of legislation: the Investigative Powers for the 21^st Century Act (Bill C-46) and the Technical Assistance for Law Enforcement in the 21^st Century Act (Bill C-47).

Bill C-46 allows police and other authorities to collect digital evidence amongst numerous devices and computer networks. These may be interprovincial or even international. A motivating factor for this bill is to ensure that multiple avenues are examined, in a timely manner, especially since digital data often has a short life span. Some important issues in the Bill C-46 legislation include:

Transmission Data

• This includes the data from telephone and internet communications. However, this does not include the content.
• This ensures that communications can be traced back to the original service provider. This allows police to trace domestic and international cybercrime.
• Determining the origin of transmission can help identify the jurisdiction of telecommunications.

Preservation Order

• A preservation order is a temporary order that requires a telecommunications service provider to safeguard and store data (e.g. usage and location) related to a specific communication. It is also known as a “quick freeze” order.
• This is restricted only to the data that is related to a particular investigation.

Tracking Warrants

• This allows police to remotely activate tracking devices found in some technologies (e.g. cell phones, car tracking devices).
• This may permit police to install new devices to enable tracking.
• Authorities can have special orders for tracing mobile communications devices as well as their owners.

International Considerations

• International cooperation is crucial for many cybercrime investigations.
• The proposals in this bill strengthen the instruments that enable broad-based international cooperation in investigation as well as prosecution of computer-related crimes.

Bill C-47 does not provide police or other law enforcement authorities with additional powers, but it does mandate that authorities have a technical solution in place to actually intercept telecommunications. At this point, Canada does not require companies to build interception capability into their telecommunications networks. This means that when warrants are issued, they cannot be acted upon, since the service provider’s network cannot be intercepted. This may create a safe haven for criminal activity.

In response, Bill C-47 requires companies to create intercept-capable infrastructures, which includes paying for the new equipment and software involved. The government will provide compensation for any required retrofits. The intention is to introduce intercept solutions as flexibly and gradually as possible. This will ensure that telecommunication services are able to build and maintain interception capability without creating undue burdens on the company. Eventually, Bill C-47 will allow authorities to obtain individual information such as name, phone number, address, IP address, and other mobile phone identifiers.

Perspectives

Some proponents of the Bills have argued that the legislation is not too different from other criminal legislation affecting privacy interests. They argue that Canada is far behind the curve in terms of lawful access legislation. For instance, both the US and Australia have implemented such legislation for more than ten years. Introducing such measures will enable Canadian companies to comply with international obligations, facilitating international competition.

However, others have cautioned that these measures should not simply be implemented because of the choices of other countries. It is important to note that in a number of countries interception and surveillance measures were passed, in spite of public opposition.

Opponents of the bills argue that while the proposals are presented as security measures, they may lead to a “chilling effect.” This means that citizens may become nervous about the monitoring of their online activities. Lawful surveillance may silence debates and shut down the development of legal online activities.

Other observers commented on the fact that there is increased collaboration between government and private actors to track citizens’ actions and activities in the digital world. Surveillance and interception is largely justified based on user agreements. These contain provisions which allow the telecommunications service providers to monitor and transmit the information to authorities. However, many users do not read or understand these agreements. They are also unable to negotiate the terms with the service providers. Arguably, users have no choice but to hand over their constitutional rights, if they want to have access to such necessities as telephone and internet services.

OPC Concerns

The Office of the Privacy Commissioner of Canada (OPC) recommends that Parliament remain cautious about surveillance and interception legislation, which will often have repercussions on other jurisdictions as well as a significant impact upon the privacy rights of Canadians. In a joint resolution issued by the federal Privacy Commissioner as well as provincial commissioners and ombudspersons, there must be a clear and demonstrable need for acquiring before expanding investigative powers of law enforcement and other national security agencies. According to the Commissioners and ombudspersons, the federal government has not provided satisfactory evidence that supports the need for the new powers outlined in the proposed legislations.

The joint resolution argues that the proposed legislations allow authorities to access personal information, such as unlisted telephone numbers, email addresses and IP addresses. However, Canadians consider this information extremely sensitive and expect it to remain confidential. The use of computers and other remote devices should also remain private. Arguably, the proposed legislation does not only target serious criminal offenses, but it might also be applied to investigations of minor infractions and non-criminal matters.

While the OPC and the ombudspersons are not completely opposed to legislation regarding the monitoring of digital data, it must take into account individual privacy rights and the legitimate needs of law enforcement authorities. The following outlines the OPC’s recommendations regarding Bill C-46 and Bill C-47:

• The federal government needs to demonstrate that the expanded surveillance is actually essential and justified.
• The federal government should explore alternatives to the proposed Bills.
• The Bills should be limited to only specific, serious crimes and life-threatening emergencies.

If there are any legislative proposals on surveillance, they should embody the following characteristics:

• Minimally intrusive
• Have well-defined limits on the use of the new powers.
• Have appropriate legal thresholds for court authorization.
• Require draft regulations to be publicly reviewed before being enforced.
• Provide effective oversight.
• Publicly report the use of powers.
• Have a five-year Parliamentary review.

In taking these recommendations into account, Parliament will be able to update surveillance and investigation legislation appropriately to meet the needs of law enforcement.

Summary

This article examines the proposals in Bill C-46 and Bill C-47, which are the Investigative powers for the 21^st Century Act and the Technical Assistance for Law Enforcement in the 21^st Century Act, respectively. It looks at the new powers that may be afforded to police and other law enforcement bodies across Canada. It introduces a number of different perspectives on the Bills. For some, the Bills do not present an issue for concern, as many other countries have introduced similar legislation and Canada is simply catching up with these obligations. But for others, those who are opposed to the Bills point out the repercussions in varied contexts. Finally, the article examines the OPC’s response and recommendations to surveillance legislation.

CIPP/C Preparation

In preparation for the Certified Information Privacy Professional/Canada exam, a privacy professional should be comfortable with topics related to this post, including:

• Privacy policy, legal requirements (V.C.b.b.)
• End user expectations (V.C.c.a.i.)
• Vendor and contract management (V.C.e.)

The Privacy Act of 1974 is a public sector law that regulates the use of personal information by the United States Government.  Specifically it establishes rules, similar to the Fair Information Practice Principles that determine what information may be collected and how it may be used in order to protect the personal privacy of U.S. citizens.

Data Collection and Management

The Privacy Act of 1974 applies to Federal Government Agencies and governs their use of a system of records. By definition, a system of records is “any group of records under the control of any agency from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifying particular assigned to the individual.”

The following rules govern the use of a system of records:

• No Federal Government record keeping system may be kept secret
• No agency may disclose personal information to third parties without the consent of the individual (with some exceptions)
• No agency may maintain files on how a citizen exercises their First Amendment rights
• Federal personal information files are limited only to data that is relevant and necessary
• Personal information may able be used for the purposes it was originally collected unless consent is received from the individual.
• Citizens must receive notice of any third party disclosures including with whom the information is shared, the type of information disclosed and the reasons for its disclosure.
• Citizens must have access to the files maintained about them by the Federal Government
• Citizens must have the opportunity to correct or amend any inaccuracies or incompleteness in their files

Data Sharing

The Privacy Act of 1974 places restrictions on the ability of Federal agencies to share a system of records with third parties, including other agencies. However, the Privacy Act does recognize the need of the government to share records in order to improve security, maintain accuracy and consolidate resources. This is often accomplished through matching programs which allow certain data elements in one system of records to be searched against records in another system in order to find any data matches. Such matches would link together the information from both systems.

In order for any agency to run a matching program with a system of records from an another agency, their must first be a written agreement between both parties. The Committee on Governmental Affairs of the Senate, and the Committee on Government Operations of the House must receive a copy of the agreement. It must also be made available to the public.

A Data Sharing Agreement:

• Must state the purposes and legal justifications for the matching program
• Must provide rational for the program by estimating the results and savings that will be achieved
• Must describe the records to be matched including the specific data elements, estimate the number of records to be matched and provide estimated start and completion dates for the program
• Must describe how the privacy principles of the Privacy Act will be implemented in the program (ie: notice to the individual, ensure accuracy and completeness, limited used of results)
• Must provide an accuracy assessment of the unmatched records
• Must include a statement allowing the Comptroller General to monitor compliance with the Privacy Act if necessary.

Federal Register

To ensure that no system of records is kept secret, the Privacy Act requires all government agencies to provide a System of Records Notice (SORN) to biennially to be published in the Federal Register. Each SORN must also be published on the agencies website under the Electronic Privacy Act Amendment.

Each SORN must contain:

• The name location of the records system
• The title and business address of the individual overseeing the system of records at the agency
• The types of individuals about whom records are kept
• The categories of records kept in the system
• The general sources from which data is collected
• The privacy and usage policies of the agency, including those for access controls, storage, retrievability and destruction.
• How an individual may determine if an agency maintains a record about them in their system of records
• How an individual may gain access to the records an agency maintains about them

Exceptions to the Privacy Act

While the Privacy Act did take significant steps towards protecting privacy, there are a few important distinctions within the act that create holes in its protection.

The Privacy Act only applies to a system of records maintained by an agency. Records systems kept by government institutions not considered an agency are exempt. Further more a system of records is defined as a group of records which uses personally identifiably information or signifiers to retrieve a file. There may be records systems which contain personal information but does not use that information to search for and gain access to a record. Such system of records would also be exempt under the Act.

The Privacy Act also contains a “routine use” exception which allows the disclosure of information without the notice or consent of the individual. Routine use is defined as “the use of such record for a purpose which is compatible with the purpose for which it was collected.” The vague definition of routine use allows agencies to expand their definition of compatible purpose at will, eventually allowing more and more information to be disclosed under the routine use exception. As long as the SORN contains a listing of the routine uses of the information, an agency is considered compliant with the Privacy Act.

Summary

Like the Freedom of Information Act, the Privacy Act of 1974 seeks to protect the privacy of U.S. citizens by giving them the ability to monitor the use of their personal information by the U.S. government. Though the Privacy Act does make significant steps in the protecting the right of privacy, it is also limited enough in its scope and implementation to only provide adequate protection. Privacy professionals and U.S. citizens should be familiar with the Privacy Act of 1974 in order to effectively understand their rights and work to create more comprehensive privacy legislation in the future.

CIPP/G Candidate Preparation

In preparation for the Certified Information Privacy Professional Government exam, a privacy professional should be comfortable with topics related to this post including:

• The Privacy Act of 1974 (I.C.b.i.-iv.)