1. “Privacy and the Future of Justice Statistics” Peter P. Swire Chief Counselor for Privacy OMB/OIRA National Conf.on Privacy, Technology & Criminal Justice Information May 31, 2000

2. Overview n Free flow of information n Administration privacy policy n Government as a model n Public records n Concluding thoughts

3. I. “Free flow of information” n A noble goal, but what does it mean? – Security -- free flow to hackers? – Intellectual property -- free flow to pirates? – Privacy -- free flow to intruders? n Moral: – Many wonderful flows – Not all flows are wonderful

4. “Free flow” in the justice context n Common practice -- police have had unlisted phone numbers and addresses n Police concern about their own and their family’s safety at home

5. The Durham, N.C. example n Law enforcement officer concern n After debate, city council decided to make name a hidden field for all property records n County disagreed -- register of deeds decided to keep owners listed, online n County tax assessor plans to post blueprints of houses -- additional l.e. concern

6. Observations on “free flow” of information n Which flows of information make sense? n Do the flows happen automatically in the course of putting information on web sites? n When should there be thoughtful consideration of whether personal information should become increasingly available?

7. II. Administration Privacy Policy n Support self-regulation generally n Sensitive categories deserve legal protection – Medical & Genetic – Financial – Children’s Online n Government should lead by example

8. Internet Privacy n Quantity of policies – 15% to 66% to 88% from 1998 to 2000 n Quality of policies – Seek continued improvement n Incentives for good action by companies n Concern about “free riders” with no policies

9. Medical Records Privacy n HIPAA 1996 called for legislation by 8/99 n President announced proposed regs 10/99 n Over 53,000 submissions of comments n SOTU promise to make the regs final this year

10. Medical Records (cont.) n Fair information practices – Notice – Patient choice – Access – Security – Enforcement n Regs have other provisions, including for law enforcement access to medical records

11. Genetic Discrimination n February 8 Executive Order – Prohibits federal agencies from using genetic information in hiring or promotion n Call for legislation – Extend protections to private sector – Apply to purchase of health insurance n Genetic information and law enforcement – What will be public concerns over time about DNA databases?

12. Financial Privacy n Financial Modernization enacted in 1999 – Notice of uses – Choice to 3d parties – Enforcement n Administration Plan announced in April – Choice for affiliates, too – Opt in for especially sensitive data, including medical – Other provisions

13. Other Privacy Legislation n Children’s Online Privacy Protection Act of 1998 – FTC rules took effect 4/2000 – Key is “verifiable parental consent” n Identity Theft law in 1998 n Pretext Calling law in 1999 n “Opt in” for motor vehicle records for marketing in 1999

14. Summary on privacy legislation n Significant level of legislative activity n Significant level of public concern – WSJ poll in 9/99 n Seek balance among multiple goals – Privacy and public safety goals – Privacy and use of information for economic growth – Which uses of data are net beneficial, upon thoughtful consideration

15. III. Government as a Model n Government web sites n Government computer security n Privacy Impact Assessments n Oversight mechanisms

16. Government web sites n How is data collected and used at government web sites? n OMB guidance 6/99 for federal sites n All federal agencies had clearly posted privacy policies by the end of 1999

17. Government computer security n Good security is necessary for privacy – Weak security allows access to tax records, criminal investigative files, etc. – Good security stops hackers and other unauthorized users n Good security is not sufficient for privacy – What can an authorized user do with the data? – Post it to the Internet? – Privacy policies govern authorized users

18. Privacy Impact Assessments n Idea: build good security and privacy into new information technology systems n IRS has been approved as a Federal CIO Council “best practice” n FBI and Bureau of Justice Statistics in process

19. PIAs (continued) n Structured set of questions – What laws apply? Privacy Act? Others? – What agency or other policies apply? – The “friends and family” test -- do our practices seem reasonable and fair when they become public?

20. Oversight mechanisms n New databases and flows of information often achieve important public safety and other goals n What mechanisms exist to consider privacy and other values? n There may be public questions in the absence of oversight mechanisms?

21. IV. Public Records n Many criminal and other court records are “public records” n Dialogue with states on public records n Recent Supreme Court cases n The example of bankruptcy records

22. Supreme Court cases this term n United Reporting v. Los Angeles Police – State law with stricter limits on marketing than for press uses – State law upheld n Reno v. Condon – Federal statute limiting state release of motor vehicle records – Federal law upheld against federalism challenge

23. Bankruptcy records n What’s in the public bankruptcy file? – Bank account numbers – Social Security numbers n Should we place these online for millions of Americans? n President has asked OMB, Justice & Treasury to issue a report this year

24. Concluding thoughts n Many flows are good, but not all flows are good n Take advantage of new technologies to promote public safety, economic growth, public education, and other values n But, thoughtful consideration of the subset of flows that are possible but not advisable: – Home addresses of vulnerable people – Bank account numbers of individuals

25. For the justice system(s) n Improving technology makes many new flows less expensive and more practical n PIAs -- your practices should meet the requirements of – Applicable law – Applicable policies – Confidence of the public

26. Concluding thoughts n In the Information Age, there will be a constant stream of issues -- which information flows are good? n President Clinton has asked: how do we keep our traditional value of privacy in this era of new technology?

27. Conclusion n The answer will be in the good will of all of us who build the new information systems: – Medical – Genetic – Financial – Government generally – Justice systems in particular n We look forward to that challenge