Home -> Law Blog Directory -> Intellectual Property Law Blogs -> IBLS Internet Law Blog

Intellectual Property Law

: IBLS Internet Law Blog

Online Data Privacy and Methods or Mechanisms to Detect Violations

By Martha L. Arias

In the United States, online private companies' collection and use of customers" personal and identifiable information is subject to government regulations on data privacy.  Some of these regulations may be specific to the nature of the website or information collected.  For instance, collection of banking data, credit card and any related financial data are subject to explicit federal laws like the Fair Credit Reporting Act, among others (listing them is beyond the scope of this article).  Further, collection and use of personal information by companies outside the financial, medical or other specifically regulated field, is subject to the general jurisdiction and requirements of the U.S. Federal Trade Commission- FTC.  This article explains the U.S. approach to data collection and use by online private companies outside a specifically regulated sector, and provides an example of non-government methods invented to detect violations of data privacy.    

 

For obvious reasons, collection and use of personal data by online companies has become a controversial issue for individuals, multinational companies and even governments around the world.  You might recall when in 1998, the European Union (EU) requested that U.S. adopted data protection laws that could assure the safety of online personal data transfers from the EU to the U.S.  At that time, the EU had already adopted Directive 95/46/EC of the European Parliament and other personal data protection laws.   Yet, U.S. was still assuming an 'industry self-regulation' approach to the issue of online personal data collection.  As per the EU's request, the U.S. adopted the OECD (Organization of Economic Co-operation and Development) guidelines on the Protection of Privacy and Transborder Flows of Personal Data.  Thus, the current U.S. data protection policy is based on the OECD principles.

The current U.S. policy on persona data collection is based on the following principles:

1. Collection Requirement: Personal data should be provided, when possible, with the consent of the data subject. Data must be obtained by lawful means.
2. Relevant for a specific purpose: personal data must be relevant for the specific purpose it is collected and is going to be used.  To accomplish this purpose, the data must be accurate, complete and up-to-date.
3. Notice of purpose:  data collectors must inform the data subject about the purpose of the collection of personal data. Any subsequent use of the personal data by the data collector must be according to this informed purpose.
4. Use limitation: personal data should not be disclosed or used for any other purpose different than the purpose for which it was collected. There are two exceptions to this principle: when the data subject authorizes, and when it is required by law. 
5. Security Safeguards: personal data should be protected with reasonable security measures to prevent authorized access, destruction, disclosure, modification.
6. Openness: Those collecting personal data should inform that the data exists, how they use it, and the type of personal data they collect.
7. Data subject right: the data subject should have the right to know if a specific data controller has personal data related to him.  Data subjects should also have the right to amend or correct his personal data. 
8. Accountability:  data controllers should be accountable for complying with these data protection principles. 

The Federal Trade Commission- FTC is the U.S. Government organization enforcing these personal data protection principles under the jurisdiction and regulations of the Federal Trade Commission Act; particularly under its specific obligation to stop "unfair and deceptive acts or practices."  Indeed, the FTC has filed complaints against numerous online companies collecting private information and transferring or using this information in violation of the above principles and other FTC principles.  For instance, see the case of GeoCity previously reported here in IBLS:  

http://www.ibls.com/internet_law_news_portal_view.aspx?s=latestnews&id=1905   

Hence, besides the shelter offered by the OECD principles and the FTC jurisdiction and enforcement, protection of personal data has become others' aim.   Online methods or mechanisms have been created to track personal data violations.  Most of these methods are software designed to crawl the web and find personal data that has been wrongfully used or handled out of the data privacy principles.  How they do that?  I do not know.  But, we should be proud of living in a society where people with this intellectual capacity live.  An example of this method is called "method or mechanism for data screening," invented by Edmund G. Lee. This method was conferred a U.S. patent assigned to Pharsight Corporation.  

The U.S. Patent Office (USPO) defining the method states: "The present invention is directed to a method and mechanism to selectively evaluate data items and search queries for privacy violations. According to an embodiment of the invention, attributes of a data item are identified and quantified to evaluate its potential to violate privacy interests." 

How does method work?  USPO says: "search queries can be evaluated before accessing the records according to an embodiment, which improves operating efficiency and provides additional privacy protections. The query evaluation determines whether to disallow a query or withhold a query result if an individual or a small group of individuals can be identified by the results or if variables revealed will violate privacy policies."

It is even more interesting to know that this patented method for online protection of personal information may be adapted to the data collector specifications.  "The invention enables a provider of information to systematically evaluated (sic) the selectivity and visibility of attributes that are analyzed to allow or disallow queries and to set thresholds for different combinations of attributes. This allows implementation of different privacy policies, which may vary based on the database, the attributes, and/or the source of the query."

Certainly, these are great news for the online community.  People covet to have their personal information protected while at the same time enjoy the convenience of the Internet. Likewise, companies are besieged, and obliged, to protect users' personal information, and these types of inventions are truly practical to achieve this goal.    

 

Full post as published by IBLS Internet Law Blog on January 22, 2008 (boomark / email).