Data Privacy Day 2015: Reinterpreting Fair Information Practice Principles

By Paula J. Bruening, Senior Counsel, Global Privacy Policy, Intel

Today is Data Privacy Day, an occasion when businesses, governments, regulators and advocates around the world recognize and highlight the importance of data protection and privacy. Intel helped bring Data Privacy Day to North America seven years ago and is honored to work with the National Cyber Security Alliance to continue to use the day to promote privacy awareness and recognize the core privacy values shared globally. Data Privacy Day has grown each year, as Privacy issues have become more central to how individuals use technology and live their lives.

Intel is taking this opportunity to release “Rethinking Privacy: Fair Information Practices Reinterpreted.” This document continues our ongoing effort to explore how best to protect data and the privacy of individuals at a time when robust, innovative uses of data are key to solving social problems; encouraging economic growth, and advancing progress in medicine, research and energy distribution.  Over the last two years, we’ve written and spoken about the critical need to optimize privacy and innovation. We’ve emphasized that the fair information practice principles – while still relevant – should be re-examined to better serve emerging technologies and the dynamic data environment.

Privacy can be a platform for innovation, as it helps individuals to collaborate, use technology in new ways and have trust in the use of data to improve society and their lives. This paper is part of our effort to demonstrate that we do not need to accept false tradeoffs between privacy and other values. We can and should fight for Privacy AND Progress. We call this effort “Rethinking Privacy.” As a component of the initiative, and as part of his speech accepting the International Association of Privacy Professionals Vanguard Award, David Hoffman, Intel’s Director of Security Policy and Global Privacy Officer, has asked people to take the Data Innovation Pledge, by tweeting with the hashtag #datainnovationpledge.

The paper we release today begins to describe how the Fair Information Practice Principles can be applied practically to help make David’s Pledge real. We look at each principle of fair information practices in turn, considering first its historical relevance and application. We then discuss how each is challenged by the new data environment, how each remains relevant, and initial thoughts about how organizations can implement each principle to enable both privacy protection and data innovation. We also note that rote compliance with each individual principle does not necessarily result in good privacy outcomes, and propose that the principles be viewed as a whole – as a series of levers to be pulled or adjusted, or weights to be added or removed. In cases where application of one principle (e.g., consent) is not practicable, another (e.g., transparency) should be applied more robustly.

We hope that this document will advance the discussion about how principles of fair information practices can continue to provide protections. But this is just one more phase in a multi-part discussion. Attempts at policy solutions inevitably raise additional questions about the practical details of their application. While this document proposes what some of those specifics might look like, we understand that organizations – especially the people in them charged with making these protections a reality – will benefit from more concrete guidance. What uses are so commonly accepted or socially beneficial that consent is not required? And what uses are always prohibited? What criteria should companies use to assess risk? How can we provide transparency across platforms and applications? These are only a few examples.

Questions such as these deserve more consideration and more concrete answers. As we continue to engage in the global effort toward solutions, we will refine and solidify our thinking. Comments we receive on this paper will be an important contribution to that process. We look forward to developing workable ways to apply the FIPPs in practice, and to contributing those ideas to the public dialogue in the next version of this paper. We will be posting the results of that work here. Please join us in the Rethink.