[Politech logo]

Politech is the oldest Internet resource devoted to politics and technology. Launched in 1994 by Declan McCullagh, the mailing list has chronicled the growing intersection of law, culture, technology, and politics. Since 2000, so has the Politech web site.

Request for critique: a 16-point plan for privacy regulation

Here's an excerpt from one of their points. Would this affect 
journalists seeking public records?

"Access to personal information in public records shall be restricted 
for certain purposes.  For  example, accessing public records to obtain 
data for commercial solicitation should be  prohibited.  Other purposes 
shall be permitted: monitoring the government, research, educational 
purposes, tracing property ownership, and other traditional 
non-commercial purposes.  Data  brokers obtaining such data should be 
required to promise via contract, in return for receiving  such data, to 
be subject to reasonable use restrictions on that data and to demand 
that those to  whom the data is transferred also restrict uses and 


-------- Original Message --------
Subject: Model Regime to Address Commercial Data Brokers
Date: Fri, 11 Mar 2005 14:37:17 -0800
From: Chris Hoofnagle <hoofnagle@epic.org>
To: declan@well.com

Hi Declan,

I thought those on Politech would be interested in a paper that Dan
Solove and I wrote to address the commercial data broker problem
that is so prominently in the news.  Dan and I have proposed sixteen
reforms that would bring more accountability to the field.  We're
seeking comments on the draft--the abstract and TOC appear below.



A Model Regime of Privacy Protection

George Washington University Law School
Electronic Privacy Information Center West Coast Office

March 8, 2005

GWU Law School Public Law Research Paper No. 132


Privacy protection in the United States has often been criticized,
but critics have too infrequently suggested specific proposals for
reform. Recently, there has been significant legislative interest at
both the federal and state levels in addressing the privacy of
personal information. This was sparked when ChoicePoint, one of the
largest data brokers in the United States with records on almost
every adult American citizen, sold data on about 145,000 people to
fraudulent businesses set up by identity thieves.

In the aftermath of the ChoicePoint debacle, both of us have been
asked by Congressional legislative staffers, state legislative
policymakers, journalists, academics, and others about what
specifically should be done to better regulate information privacy.
In response to these questions, we believe that it is imperative to
have a discussion of concrete legislative solutions to privacy

What appears below is our attempt at such an endeavor. Privacy
experts have long suggested that information collection be
consistent with Fair Information Practices. This Model Regime
incorporates many of those practices and applies them specifically
to the context of commercial data brokers such as Choicepoint. We
hope that this will provide useful guidance to legislators and
policymakers in crafting laws and regulations. We also intend this
to be a work-in-progress in which we collaborate with others. We
welcome input from other academics, policymakers, journalists, and
experts as well as from the industries and businesses that will be
subject to the regulations we propose. We invite criticisms and
constructive suggestions, and we will update this Model Regime to
incorporate the comments we find most helpful and illuminating. We
also aim to discuss some of the comments we receive in a commentary
section. To the extent to which we incorporate suggestions and
commentary, and if those making suggestions want to be identified,
we will graciously acknowledge those assisting in our endeavor.

Notice, Consent, Control, and Access

1. Universal Notice
2. Meaningful Informed Consent
3. One-Step Exercise of Rights
4. Individual Credit Management
5. Access to and Accuracy of Personal Information

Security of Personal Information

6. Secure Identification
7. Disclosure of Security Breaches

Business Access to and Use of Personal Information

8. Social Security Number Use Limitation
9. Access and Use Restrictions for Public Records
10. Curbing Excessive Uses of Background Checks
11. Private Investigators

Government Access to and Use of Personal Data

12. Limiting Government Access to Business and Financial Records
13. Government Data Mining
14. Control of Government Maintenance of Personal Information

Privacy Innovation and Enforcement

15. Preserving the Innovative Role of the States
16. Effective Enforcement of Privacy Rights

Posted by Declan McCullagh on Mar 11, 2005 in category privacy

Get a Politech feed through RSS or Atom [RSS] [Atom]

The Politech general information pages and photographs are copyrighted by Declan McCullagh. Original posts distributed to the mailing list are licensed under a Creative Commons License.
Creative Commons License