The United States Commission's fair information practice principles (FIPPs) are guidelines that represent widely accepted concepts concerning fair information practice in an electronic marketplace.[1]
FTC Fair Information Practice Principles are the result of the commission's inquiry into the way in which online entities collect and use personal information and safeguards to assure that practice is fair and provides adequate information privacy protection.[2] The FTC has been studying online privacy issues since 1995, and in its 1998 report,[3] the Commission described the widely accepted Fair Information Practice Principles of Notice, Choice, Access, and Security.[1] The commission also identified Enforcement, the use of a reliable mechanism to provide sanctions for noncompliance as a critical component of any governmental or self-regulatory program to protect online privacy.[1] [4]
Fair Information Practice was initially proposed and named[5] by the US Secretary's Advisory Committee on Automated Personal Data Systems in a 1973 report, Records, Computers and the Rights of Citizens,[6] issued in response to the growing use of automated data systems containing information about individuals. The central contribution of the Advisory Committee was the development of a code of fair information practice for automated personal data systems. The Privacy Protection Study Commission also may have contributed to the development of FIPs principles in its 1977 report, Personal Privacy in an Information Society.[7]
As privacy laws spread to other countries in Europe, international institutions took up privacy with a focus on the international implications of privacy regulation. In 1980, the Council of Europe adopted a Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data.[8] At the same time, the Organisation for Economic Cooperation and Development (OECD) proposed similar privacy guidelines in the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.[9] The OECD Guidelines, Council of Europe Convention, and European Union Data Protection Directive[10] relied on FIPs as core principles. All three organizations revised and extended the original U.S. statement of FIPs, with the OECD Privacy Guidelines being the version most often cited in subsequent years.[11]
The core principles of privacy addressed by these principles are:
1. Notice/Awareness[12] Consumers should be given notice of an entity's information practices before any personal information is collected from them.[12] This requires that companies explicitly notify some or all of the following:
2. Choice/Consent[13] Choice and consent in an on-line information-gathering sense means giving consumers options to control how their data is used. Specifically, choice relates to secondary uses of information beyond the immediate needs of the information collector to complete the consumer's transaction. The two typical types of choice models are 'opt-in' or 'opt-out.' The 'opt-in' method requires that consumers affirmatively give permission for their information to be used for other purposes. Without the consumer taking these affirmative steps in an 'opt-in' system, the information gatherer assumes that it cannot use the information for any other purpose. The 'opt-out' method requires consumers to affirmatively decline permission for other uses. Without the consumer taking these affirmative steps in an 'opt-out' system, the information gatherer assumes that it can use the consumer's information for other purposes. Each of these systems can be designed to allow an individual consumer to tailor the information gatherer's use of the information to fit their preferences by checking boxes to grant or deny permission for specific purposes rather than using a simple "all or nothing" method.[13]
3. Access/Participation[14] Access as defined in the Fair Information Practice Principles includes not only a consumer's ability to view the data collected, but also to verify and contest its accuracy. This access must be inexpensive and timely in order to be useful to the consumer.[14]
4. Integrity/Security[15] Information collectors should ensure that the data they collect is accurate and secure. They can improve the integrity of data by cross-referencing it with only reputable databases and by providing access for the consumer to verify it. Information collectors can keep their data secure by protecting against both internal and external security threats. They can limit access within their company to only necessary employees to protect against internal threats, and they can use encryption and other computer-based security systems to stop outside threats.[15]
5. Enforcement/Redress[16] In order to ensure that companies follow the Fair Information Practice Principles, there must be enforcement measures. The FTC identified three types of enforcement measures: self-regulation by the information collectors or an appointed regulatory body; private remedies that give civil causes of action for individuals whose information has been misused to sue violators; and government enforcement that can include civil and criminal penalties levied by the government.[16]
Currently the FTC version of the Fair Information Principles are only recommendations for maintaining privacy-friendly, consumer-oriented data collection practices, and are not enforceable by law. The enforcement of and adherence to these principles is principally performed through self-regulation. The FTC has, however, undertaken efforts to evaluate industry self-regulation practices,[17] provides guidance for industry in developing information practices,[18] and uses its authority under the FTC Act to enforce promises made by corporations in their privacy policies.[19]
Since self-regulatory initiatives fall short of ideal implementation of the principles (the 2000 FTC Report noted, for example, that self-regulatory initiatives lacked meaningful monitoring and enforcement policies and practices), the Commission recommends that the United States Congress enact legislation that, in conjunction with continuing self-regulatory programs, will ensure adequate protection of consumer privacy online.[20] "The legislation recommended by the Commission would set forth a basic level of privacy protection for consumer-oriented commercial Web sites" and "would establish basic standards of practice for the collection of information online...consumer-oriented commercial Web sites that collect personal identifying information from or about consumers online... would be required to comply with the four widely-accepted fair information practices."
The principles, however, form the basis of many individual laws at both the federal and state levels—called the "sectoral approach." Examples are the Fair Credit Reporting Act, the Right to Financial Privacy Act, the Electronic Communications Privacy Act, the Video Privacy Protection Act (VPPA), and the Cable Television Protection and Competition Act.[21] Additionally, the principles continue to serve as a model for privacy protections in newly developing areas, such as in designing Smart Grid programs.[22]
The Organisation for Economic Co-operation and Development (OECD) and European Union, among others, have adopted more comprehensive approaches to fair information practices. The OECD principles provide added protections via the Individual Participation principle where specific requirements are made for access and modification of personally collected information by the individual and the Accountability principle (a data controller should be accountable for complying with measures which give effect to the principles stated above).[23] [24]
The European Union Data Protection Directive is another model for comprehensive privacy protections.[25]
The FIPPs are criticized by some scholars for being less comprehensive in scope than privacy regimes in other countries, in particular in the European Union and other OECD countries. Additionally, the FTC's formulation of the principles has been criticized in comparison to those issued by other agencies. The FTC's 2000 version of FIPs is shorter and less complete than the privacy protection principles issued by the Privacy Office of the Department of Homeland Security in 2008, which include eight principles closely aligned with the OECD principles.[21]
Some in the privacy community criticize the FIPPs for being too weak, allowing too many exemptions, failing to require a privacy agency, failing to account for the weaknesses of self-regulation, and not keeping pace with information technology.[26] Many privacy experts have called for omnibus privacy protection legislation in the US[27] in lieu of the current blend of self-regulation and selective codification in certain sectors.[28]
Critics from a business perspective often prefer to limit FIPs to reduced elements of notice, consent, and accountability. They complain that other elements are unworkable, expensive, or inconsistent with openness or free speech principles.
Some commentators argue that consumers do not have a fair say in the consent process. For example, customers provide their health information such as their social insurance number or health card number while making on-line an appointment for a dental check-up. Customers are commonly asked to sign an agreement stating that a ‘third-party may have an access to the information you provide under certain conditions.’ The certain conditions are rarely specified in any part of the agreement. Later on, the third-party may share the information with their subsidiary institutions. Thus, access to customers’ personal information is beyond their control.[29]