Reflections on the White House Privacy Office Peter P. Swire U.S. Chief Counselor for Privacy, OSU College of Law, 2001-present CFP, March 8, 2001

Overview n Clinton Administration Privacy Actions n What Privacy Institutions Should the U.S. Have? n The New Administration – Medical Privacy Rules

I. Clinton Administration Privacy Actions n Privacy hot buttons before I entered government in 2/99: – Clipper – CALEA – Know Your Customer n People, and even governments, learn

Actions since early 1999 n Brief & favorable descriptions n Q&A afterward on these

Medical Privacy Rule n HIPAA in 1996 n Support for legislation through 8/99 n Proposed rule 10/99 n 52,000 comments by 2/00 n Final rule 12/00 n Executive Order 12/00: limits on using health oversight record for law enforcement

Financial Privacy n Clinton speech 5/99 n House bill with half that 6/99 n Significant Administration push for privacy n Gramm-Leach-Bliley 11/99 n Administration proposal for more, 4/00

Federal Government Privacy n 6/99 OMB memorandum to post clear privacy policies on agency sites n 6/00 OMB memorandum presumption against cookies on federal sites & reports to OMB on privacy in the budget process n 12/00 OMB memorandum on agency data sharing, including push for privacy impact assessments n Federal CIO Council privacy committee

Some other privacy actions n Crypto policy change 9/99 n Genetic Discrimination E.O. 2/00 n NAS study now underway on authentication and privacy – CFP next year? n Bankruptcy and privacy study 1/01: public records and privacy issue

Other privacy actions n Safe Harbor (low number of companies because it is so strict?) n Network Advertising Code 6/00 n SSN bill proposed 6/00, and fought Gregg bill n Wiretapping bill summer 2000, with higher standards for trap-and-trace and wiretaps

How to find these documents? n Agency web sites change & not well archived n Presidential privacy web archive up this week n n Technology Policy Group of the Ohio Supercomputer Center n send documents you want to add to

II. The Privacy Office in the U.S. n Chief Counselor for Privacy, – U.S. Office of Management and Budget – Executive Office of the President – Old Executive Office Building n 4 functions: – Government data handling – Clearance – Enforcement/Ombudsman – Bully Pulpit

Government Data Handling n Big advantage if in OMB n Management – Office of Information & Technology Policy n Budget n Cant do in an independent agency n Major issue in U.S. privacy debates

Clearance n Testimony, legislative proposals cleared in OMB n Less formal statements also cleared n Examples: – FIDNet – Money laundering – New hire data base n Cant do as well in independent agency

Enforcement/Ombudsman n Cant do in OMB n HHS and financial agencies n FTC for consumer protection n Web seals & CPAs (expand scale)? n Private rights of action?

Bully pulpit n Cons: – Fishbowl in White House therefore cautious about statements – Cant comment on individual products or companies n Pro: – Big impact if President or Cabinet speak – Any White House official can raise the issues visibility & help on the Hill n Independent agency has more flexibility

The New Administration n Bush and Clinton statements similar n No privacy official named yet n My guess is that they wont until have some privacy blowups

Medical Privacy Rule n Why now? – HIPAA administrative simplification rule last summer – Protocols for electronic record sharing – Need to build in privacy & security at the same time – Delay means, at best, privacy will be a retrofit in medical systems

Fair Information Practices n Notice n Opt in consent for nonmedical purposes n Strong access protections n Security rule n HHS enforcement (need more) n Employee protections

Marketing provision n BAD name -- communications with existing customers n Doctor or insurer can communicate with own customer n If does so on behalf of 3d party, must say so and say who is paying, and opt out n Information to 3d party only as agent of the doctor, such as mail shop – 3d party cant use for its own purposes

What next? n Public comments by March 30 to HHS n Decision by April 15 whether to cancel n Best choice: let rules go into effect & make specific changes as needed n If not: huge homework for new Administration (it took us 70 people for a year) n If not: strong likelihood the rule will never issue

More information n n

Conclusion n Substantial privacy activity past two years n New Administration has made encouraging statements but we need to watch their actions n Will need organized U.S. ways to handle privacy issues over time